PRIVACY POLICY

Kurk Functional Foods Ltd

Who We Are

When we refer to 'we' (or 'our' or 'us'), that means Kurk Functional Foods Ltd. Kurk Functional Foods Ltd is our legal company name but we are trading as Kurk Functional Foods Ltd. To keep things simple, we will use our trading name 'Kurk Functional Foods Ltd' throughout this Privacy Notice. KURK is based in the United Kingdom.

Corporate Structure and Group Companies

Kurk Functional Foods Ltd is a subsidiary of TruthCorp Holdings Limited (the "Parent Company"). References to 'we', 'our', or 'us' in this Privacy Policy include both Kurk Functional Foods Ltd and, where applicable, TruthCorp Holdings Limited and its group companies. TruthCorp Holdings Limited operates as the parent company of a group that includes various subsidiary companies operating in different jurisdictions (together, the "Group" or "Group Companies").

Privacy Notice Overview

This privacy notice describes how and why we, as Data Controller, obtain, store and process personal data.

'Personal data' means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

We commit to processing your personal data fairly, lawfully, and transparently. Please do not hesitate to contact us if you have questions in addition to the information provided in this Privacy Notice at talk@kurk.life.

The Personal Data We Collect

Depending on the type and level of engagement you have with us, we may collect the following categories of personal data:

Identifying and Demographic Information: such as your full name, date of birth, email address and phone number (if provided)

Purchase and Billing Information: such as purchase history, payment preferences, address, bank account details and billing address (if provided)

Communications: such as a record of our interactions with you using one or multiple of the following; direct messages, emails, posts, phone conversations

User Feedback: while using our services, occasionally you may be asked to provide feedback. Providing this feedback is entirely optional.

Customer Account Information: such as login details, interaction information, purchase history, your preferences, and other personal data included in your Customer Account (if provided)

Career Application Details: such as employment history, education history, contact details and other personal data included in your application (if provided)

Video Recordings: such as CCTV footage in any of our physical premises. Please contact us at talk@kurk.life for more information on our data retention policy for CCTV footage.

Digital Images: such as ID and photographs for verification of identity purposes

When you visit our website, we collect technical data such as:

Usage data: (if permitted) we collect certain information related to your device. This can include your computer or mobile device operating system type and version number, manufacturer and model, browser type, screen resolution, IP address, the website you visited before browsing our site, what pages your device visited, the time that your device visited our website, how long you spent on a page or screen, navigation paths between pages or screens, information about your activity on a page or screen, and general location information such as city, state or geographic area (for more information please see the 'Our Use of Analytics' and 'Our Use of Cookies' sections later in this policy)

Children

While our services are designed for a general audience, we will not knowingly collect any data from children under the age of 16 or sell products to children, without the consent of a parental guardian to do so. If you are under the age of 16 and we do not have the consent of a parental guardian, you are not permitted to use or submit your data to the website.

Sensitive Personal Data

As part of providing our service to you, we will need to collect and process sensitive data (otherwise known as 'Special Categories of Personal Data'). Sensitive data refers to specific categories of personal information that are considered highly private and require special protection. This includes (but is not limited to) data related to an individual's race or ethnicity, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health information, and any data revealing sex life or sexual orientation. Processing sensitive data requires a higher level of precaution due to its potential impact on an individual's fundamental rights and freedoms.

When it comes to processing sensitive data, we will only process or share your sensitive data with your explicit consent unless there is a specific legal basis that allows processing without consent. Explicit consent means obtaining clear and unambiguous permission from you, presented in a way that is separate from other terms and conditions. You will be fully informed about the purpose of processing the sensitive data and any potential consequences.

How We Collect Your Data

We may collect your personal data in one of the following ways:

When you visit our website

When you buy products/services using our online checkout

When you provide information directly into our products and services

When you download a form or guide

When you express an interest to use our services

When you create an account with us

When you subscribe to our newsletter or blog

When you engage with us on social media

When you contact us with queries using our website chatbot

When you review our services

When you apply for an employment vacancy

We may also receive personal data about you from various third parties, including:

Technical data from analytics providers. Please see further information in the section entitled 'Our Use of Analytics'

Technical data from our website and cookies providers. Please see further information in the section entitled 'Our Use of Cookies'

Contact and/or transactional data from our trusted third-party providers. Please see further information in the section entitled 'How We Share Your Data'

How We Use Your Personal Data

We will only collect and process your personal data where we have a legal basis to do so. As a data controller, the legal basis for our collection and use of your personal data varies depending on the manner and purpose for which we collected it. We will only collect personal data from you when:

We have your consent to do so, or

We need your personal data to perform a contract with you, or

We are pursuing our legitimate interests in a way that you might reasonably expect to be a part of running our business and that does not significantly impact your interests, rights, and freedoms. For example, communicating with you if we have a sufficient legal ground based on the e-marketing laws in your country

We have a legal obligation to collect or disclose personal data from you (for example, in suspected instances of fraud we may need to give personal data to relevant government bodies).

Email marketing (if applicable): Where we have a legal basis, we may send emails about our store, new products, and other updates (see our "Marketing Preferences" section for more information).

Text marketing (if applicable): We may send text messages about our store, new products, and other updates. Updates include Checkout Reminders. The website uses webhooks and cookies (with your consent) to help keep track of items you put into your shopping cart including when you have abandoned your cart and this information is used to determine when to send cart reminder messages via SMS (see our "Marketing Preferences" section for more information).

Why We Process Your Personal Data

We process your personal data in order to fulfill any of the activities below:

Setting up an account with us (Legal basis: Performance of a contract)

Providing, operating, and maintaining our services (Legal basis: Performance of a contract)

Providing marketing communications to existing customers or subscribed users (Legal basis: Consent or Legitimate Interest)

Email marketing (if applicable): Where we have a legal basis, we may send emails about our store, new products, and other updates (Legal basis: Legitimate Interest or Consent)

Text marketing (if applicable): We may send text messages about our store, new products, and other updates including Checkout Reminders (Legal basis: Legitimate Interest or Consent)

Processing and completing transactions, and sending related information, including transaction confirmations and invoices (Legal basis: Performance of a contract)

Managing our customers' use of our services, responding to enquiries and comments, and providing customer service and support (Legal basis: Performance of a contract or Legitimate Interest)

Sending customers technical alerts, updates, security notifications, and administrative communications (Legal basis: Performance of a contract)

Analytics to improve our website, products, services, and features for a better user experience (Legal basis: Legitimate Interest or Consent)

Investigating and preventing fraudulent activities, unauthorised access to our services, and other illegal activities (Legal basis: Legal Obligation)

Processing your job application (Legal basis: Consent)

Sharing data within our corporate group for internal administration, business operations, analytics, and to provide you with a consistent service across our Group Companies (Legal basis: Legitimate Interest)

Marketing Preferences

We would like to send you information about products and services of ours that we think you might like. We may send you direct marketing communications, product information and promotional offers:

If you have consented to receiving such communications from us

If we have an existing business relationship with you and can rely on your implied consent

If you are from a country where the laws permit us to send you such communications based on our legitimate interests, if you have bought a product or service from us, and have not opted out of receiving communications from us (for example the EEA or UK)

If you are from a country where the laws permit us to send you such communications

The marketing communications we send will be in relation to our own products or services, your personal data will not be used for third-party direct marketing unless separate explicit consent has been collected for that or you are from a country where the laws permit such processing.

You will always have full control of your marketing preferences. If you do not wish to continue receiving marketing information from us at any time:

You can unsubscribe by using the unsubscribe directions or link included in marketing communication from us; or

You may withdraw your consent by contacting us by e-mail at talk@kurk.life

Customers located in certain regions, such as the EEA and UK, also have the right to object to their personal data being processed for direct marketing purposes at any time. If you would like to object you can contact us by e-mail at talk@kurk.life

We will process all requests as soon as possible, but please note that due to the nature of our IT systems and servers it may take a few days for any opt-out request to be implemented.

How We Share Your Data

We sometimes share your personal data with trusted parties to conduct our business. These include:

TruthCorp Holdings Limited and Group Companies

As part of the TruthCorp Holdings Limited corporate group, we share your personal data with our Parent Company and other Group Companies for the following purposes:

(a) Fulfilling your orders and providing customer service across our brands;

(b) Internal business operations, administration, and centralised record-keeping;

(c) Marketing and promotional activities (where you have consented to receive marketing communications);

(d) Product development, research, and improvement;

(e) Analytics, business intelligence, and reporting;

(f) Compliance with legal and regulatory requirements; and

(g) IT infrastructure and security management.

Legal Basis: We rely on our legitimate interests under Article 6(1)(f) of the UK GDPR for sharing data within our corporate group, as this is necessary for internal administrative purposes and to operate an efficient group business structure. We have conducted a legitimate interests assessment and concluded that this processing does not override your rights and freedoms. For marketing communications, we rely on your consent under Article 6(1)(a), which you may withdraw at any time.

TruthCorp Holdings Limited and all Group Companies are bound by this Privacy Policy and appropriate intra-group data sharing agreements to ensure your personal data is protected to the same standards wherever it is processed within our Group.

Third-Party Service Providers

Our trusted categories of third parties include:

Website provider

Cloud service (SaaS) providers

Professional services providers (e.g., our lawyers, accountants, and insurance providers)

E-marketing providers (including Klaviyo)

Advertising providers

Recruitment partners

Payment providers

As part of fraud monitoring and prevention, we may be legally required to share your personal data with government bodies and law enforcement. Please note that these bodies may retain a record of the information that we provide to them for this purpose.

Sale or Merger

We may share your personal information as part of a merger or acquisition. If KURK or TruthCorp Holdings Limited is involved in a merger, financing, transaction or proceeding involving sale, transfer, divestiture, or disclosure of all or a portion of our business or assets, or in the event of a liquidation, insolvency, bankruptcy, or receivership, we may share your information with that company before and after the transaction closes. In such a case, unless otherwise directed by applicable law, your information would remain subject to the terms of the applicable privacy policy in effect at the time of such transfer. You will be notified of any such changes in advance.

Our Use of Cookies

Our website uses cookies. They help us to provide you with the very best experience when you browse our website and to make improvements to our website. You can accept or reject cookies by clicking on the cookie consent banner on our website.

For detailed information on the cookies we use and the reasons why we use them, please refer to our Cookie Policy on our website.

Our Use of Analytics

We use analytics to continuously enhance our website, products, services, and features, ensuring an improved user experience. To achieve this, we rely on third-party tools and services that provide valuable insights and analysis of user behavior.

These third-party tools help us collect information automatically when you visit our website (where we have a legal basis to do so). The data includes details such as device type, browser, IP address, pages visited, and the date and time of your visit. By analyzing this information, we gain valuable insights into user preferences, interactions, and usage patterns. Through the use of these analytics tools, we can optimize website performance, personalize content, and enhance our offerings to better meet customer expectations.

For example, where users have accepted cookies, we enhance our marketing efforts using Klaviyo's segmentation feature. This allows us to segment our customer base and create targeted marketing campaigns. We categorize customers based on their preferences, behaviors, and purchase history, ensuring that we send personalized and relevant content to individuals (where we have a legal basis to do so). The information used for segmentation may include but is not limited to email addresses, browsing activity on our website, product preferences, order history, and demographic data. This enables us to provide tailored promotions, discounts, and product recommendations, increasing the overall shopping experience for our customers.

If you would like any further information about the data collected by these third parties or the way in which the data is used, please contact us on talk@kurk.life.

Our Use of Targeted Advertising

We use targeted advertising tools to advertise our services, including (but not limited to):

Google Analytics

YouTube

Google Ads

Meta (Facebook and Instagram)

Polar Analytics

We use these tools to deliver relevant content to you in marketing communications (where applicable), and to measure the effectiveness of the advertising provided.

Some of our service providers (including cloud storage, analytics and advertising partners) may be based outside the US/UK/EEA/Australia. Where this results in a transfer of personal data, we ensure appropriate safeguards are in place, such as adequacy regulations, the UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses approved by the ICO. Copies of these safeguards can be obtained by contacting talk@kurk.life

If you would like any further information about the data collected by these third parties or would like to opt-out of targeted advertising, please contact us on talk@kurk.life.

Links to Other Websites and Third Parties

Our website may include links to social media platforms and other websites. If you follow a link to any of these platforms or websites, please note that they have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to their platforms or websites.

Securing Your Data

The communication between your browser and our website uses a secure encrypted connection wherever your personal data is involved.

We have put in place physical, electronic, and managerial security procedures in the storage and disclosure of your personal data to protect it against accidental loss, destruction or damage. Nevertheless, any data transmission over the internet or by any other means can never be fully secure, such is the character of the internet, and provision of personal data by you to us is at your own risk. We take all reasonable measures to protect your personal data by putting appropriate technical and operational security measures in place.

When we disclose your personal data to trusted third parties (for the purposes set out in this Privacy Notice), including TruthCorp Holdings Limited and Group Companies, we require all third parties to have appropriate technical and operational security measures in place to protect your personal data, and we work with them to ensure that your data privacy rights are respected. Where your personal data is shared with a third party, it must only be used for the purposes for which it was supplied.

In the unfortunate event of a personal data breach, we will notify you and any applicable data protection authority when we are legally required to do so.

Retaining Your Data

We will not keep your personal data for longer than is necessary and when we no longer need to keep it, we will securely destroy, delete or anonymise it in line with our Data Retention policy.

Having obtained your consent (or other legal basis) to contact you, we will retain your personal data for marketing and analysis purposes until you withdraw your consent or unsubscribe. If you choose to withdraw your consent or unsubscribe from marketing, we will delete your personal data from our systems, unless we have another legal basis to retain it, which may include performance of our contract with you or to maintain your contact details on an 'unsubscribed list' to ensure we do not send you further communications.

We may need to retain your personal data to satisfy our legal obligations, to deal with complaints and queries, in order to resolve, litigate or defend a dispute and to prevent fraud and abuse.

Data Transfers

For Users from the European Economic Area ("EEA") and the United Kingdom, your personal data may be processed outside the EEA or UK by staff who work for us, by TruthCorp Holdings Limited and its Group Companies, or by one of our Data Sub-processors.

Transfers to Group Companies

Where your personal data is transferred to TruthCorp Holdings Limited or other Group Companies located outside the United Kingdom in countries not deemed to provide an adequate level of protection, we ensure appropriate safeguards are in place, including:

(a) The UK International Data Transfer Agreement (IDTA); or

(b) The UK Addendum to the EU Standard Contractual Clauses; or

(c) Reliance on adequacy decisions made by the UK Government under UK data protection law.

Transfers to Other Third Parties

When we transfer your information outside of the European Economic Area or United Kingdom to other third parties, we ensure it benefits from an adequate level of data protection by:

Relying on adequacy decisions by the European Commission made under Article 45 of the GDPR, or by the UK Government, finding that the third country to which the information is being transferred offers an adequate level of data protection; or

If there is no adequacy decision, using standard contractual clauses approved or permitted under Article 46 of the GDPR, the UK IDTA, or the UK Addendum.

We will take all steps necessary to ensure that your data is treated securely and in accordance with this privacy notice. Please contact us if you want further information on the countries to which we may transfer personal data and the specific mechanism used by us when transferring your personal data outside the EEA or UK – talk@kurk.life.

Your Rights & Our Commitment to You

You have rights under data privacy laws and KURK is committed to you being able to freely exercise your Rights. Send us an email at talk@kurk.life to exercise your rights. You are not required to pay any charge for exercising your rights.

Canada's Personal Information Protection and Electronic Documents Act (PIPEDA)

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) your rights include, with certain legal restrictions, the below:

Right of Access or Rectification: you have the right to ask us for copies of the personal data we hold about you. You are also entitled to have your personal data corrected or updated if it is inaccurate.

Right to Withdraw Consent: in cases where we are relying on your consent for the processing of your personal data, you have the right to withdraw your consent at any time. In respect of the e-marketing we conduct, an unsubscribe (withdraw consent) option is included with every e-marketing communication we send.

EEA and UK General Data Protection Regulation (EU GDPR and UK GDPR)

Users located in the UK or European Economic Area (EEA) have the above rights as well as the below under the EU GDPR and UK GDPR.

Right of erasure: you have the right of access to personal data erased if we do not have a legitimate reason for retaining your data.

Right to data portability: you have the right to obtain a digital copy of your personal data, request the transfer of your personal data to another company or request to move your data from one IT system to another in a safe and secure way. This right only applies to personal data you provide to us, and we process it with your consent or in order to fulfil our contract with you by automated means. It also only applies to the extent that it does not affect the rights and freedoms of others.

Right to restriction of processing: you have the right to restrict the processing of your personal data where you are contesting the accuracy of that information, you have objected to processing (as described below), or where the processing is unlawful. Where processing is restricted, we may need to retain sufficient information about you to ensure that the restriction is respected in future.

Right to object to processing: you have the right to object to the processing of your personal information in certain circumstances such as where your personal data is being processed based on our legitimate interests or the legitimate interests of a third party. This includes the right to object to data sharing within our corporate group where such sharing is based on legitimate interests.

To object to automated decision-making including profiling: you have the right not to be the subject of any automated decision-making or profiling by us.

To complain to the relevant supervisory authority: should you have any concerns or complaints regarding the way in which we process your data, you also have the right to make a complaint to the Information Commissioner's Office (ICO) in the UK at www.ico.org.uk or the relevant European Supervisory Authority. We would, however, appreciate the chance to deal with your concerns before you approach a Supervisory Authority, so please do contact us in the first instance - talk@kurk.life. The contact details of European Supervisory Authorities can be found here: https://edpb.europa.eu/about-edpb/about-edpb/members_en

Changes to This Privacy Notice

We may change this policy from time to time, to reflect how we are processing your data. If we make significant changes, we will make that clear on our website or by some other means of contact such as email, so that you are able to review the changes before you continue to use our services.

How to Contact Us

We welcome feedback and are happy to answer any questions you may have about your data.

You can contact us at:

Email: talk@kurk.life

Address: Kurk Functional Foods Ltd, 71-75 Shelton St, London, WC2H 9JQ

Company Number: 13782707

This notice was most recently updated: January 2025