Privacy Policy

1. Who is responsible for your data

The controller is Ascend Wellness, 21 Villa Road, Stanway, Colchester, Essex CO3 0RH, England, United Kingdom. Email: office@ascendwellness.shop.

We have not appointed a data protection officer. For any privacy question or request, email office@ascendwellness.shop.

2. Data we collect

• Order and checkout data: email address, full name, delivery address (street, apartment, postal code, city, region and country), phone number (optional), the products ordered, prices, shipping charge, any promotional code, order number and order status.
• Payment data: you enter your card details directly on our payment processor’s secure hosted page (Authorize.net’s payment page). We do not receive your full card number or payment credentials. We receive the payment status, the amount charged and the processor’s transaction reference. We send Authorize.net your order number, the amount to charge, an order description, and your name, email address and delivery address, so that you do not have to enter them again. We do not ask for or send a separate billing address.
• Shipping data: carrier, tracking number and delivery status, and the information on customs declarations (your name, address, the goods and their value).
• Customer account (optional): email address, name, password (stored only as a salted hash, never in readable form), saved addresses and order history.
• Eligibility confirmations: when you pass the catalog gate, a cookie records that you confirmed you are 18 or older and accepted the research-use-only statement. We do not link this to your identity. If we ask you to verify research eligibility, we keep the information you send us.
• Research brief sign-up: your email address, if you ask to receive batch and inventory updates.
• Correspondence: emails you send us and our replies. We also keep a copy of each transactional email we send you (recipient, subject, content and time).
• Technical data: our hosting provider’s servers process your IP address, browser type, the pages requested and timestamps in request logs, for security and operation of the website, including limiting repeated attempts (for example, too many sign-in or checkout attempts). Our hosting provider (Replit) also adds its own website analytics script to the pages it hosts, which records page views and processes your IP address and browser details. Our application logs may record order events and the email address an order message was sent to. We read your browser’s language setting to pre-select your country at checkout; it is not stored.

We do not ask for, and please do not send us, health information. Our website is not intended for anyone under 18 and we do not knowingly collect their data.

3. Why we use your data and our legal bases

We do not sell your data, use it for advertising, or make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Who we share your data with

We share personal data only as needed for the purposes above, with:

• Replit, Inc. (United States) — hosts the website and the database in which order and account data are stored, and provides hosting analytics (page views) for the website (processor). Replit runs on Google Cloud (Google LLC), whose servers set a technical cookie for routing.
• Authorize.net (a Visa solution), United States — provides our hosted card payment page and payment gateway. Card payments are then handled by our merchant account provider, its acquiring bank and the card networks (Visa and Mastercard). Each may also act as an independent controller for payment data (for example, for fraud prevention and card-network rules); their own privacy notices apply.
• Postmark, operated by ActiveCampaign, LLC (United States) — sends order and dispatch emails (processor).
• Google (Google Workspace) — hosts our business mailbox for correspondence with you (processor).
• Carriers and postal operators — currently expected to be Royal Mail Group Ltd (United Kingdom), plus the postal operator in your country for final delivery — receive your name, address, phone number (if given) and parcel details.
• Customs and tax authorities — receive the information on customs declarations and tax records as required by law.
• Professional advisers (such as accountants and lawyers), and courts, regulators or law enforcement where we are legally required to share data.

If we change a provider (for example, our carrier), we will update this list.

5. International transfers

We are based in the United Kingdom. If you live in the EU, EEA or Switzerland, your data is transferred to the UK, which the European Commission and Switzerland recognise as providing an adequate level of data protection. Some of our providers (Replit, Authorize.net and our merchant account provider, Postmark and Google) process data in the United States or other countries. Where they do, we rely on the UK Extension to the EU–US Data Privacy Framework (and the EU–US and Swiss–US frameworks) where the provider is certified, or otherwise on the UK International Data Transfer Agreement or Addendum and the European Commission’s Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.

6. How long we keep your data

• Order, payment, invoice and customs records: 6 years after the end of the financial year in which the order was placed, as required for UK tax and accounting purposes, or longer if needed for a legal claim.
• Customer accounts: until you ask us to close the account. Order records are then kept as above.
• Abandoned carts: up to 12 months.
• Copies of transactional emails we send: up to 24 months.
• Correspondence: up to 3 years after our last contact with you.
• Research brief sign-up: until you withdraw consent.
• Server request logs: according to our hosting provider’s standard retention period.

7. Security

The website uses encrypted connections (HTTPS). Passwords are stored only as salted hashes, session cookies cannot be read by scripts, and access to order data is limited to authorised staff. No system is completely secure, but we take reasonable steps to protect your data.

8. Your rights

You have the right to access your personal data; to have it corrected; to have it erased; to restrict or object to its use (including use based on our legitimate interests); to receive it in a portable format; and to withdraw consent at any time where we rely on consent. To exercise any of these rights, email office@ascendwellness.shop. We will reply within one month and may need to verify your identity first. Some rights are limited — for example, we must keep order records for tax purposes.

You can complain to the UK Information Commissioner’s Office (ico.org.uk, 0303 123 1113), to the data protection authority in the EU or EEA country where you live or work, or, in Switzerland, to the Federal Data Protection and Information Commissioner (edoeb.admin.ch). We would appreciate the chance to deal with your concern first.

9. Cookies

We set only cookies that are strictly necessary for the website to work. We do not use advertising or social-media cookies or tracking pixels. Our hosting provider (Replit, on Google Cloud) sets a technical routing cookie (GAESA) and adds its own website analytics script that counts page views; we do not use these for advertising.

Card payments are entered on Authorize.net’s hosted payment page (accept.authorize.net), which is operated by Authorize.net; it may set its own cookies for security and fraud prevention — see its privacy notice. You can block or delete cookies in your browser settings, but the catalog gate, cart and sign-in will then not work.

10. Changes to this policy

We may update this policy. The date at the top shows when it last changed. We will tell you about significant changes that affect you.