This privacy policy explains how Camden Medicals (“we”, “us”, “our”) collects, uses, stores and protects your personal data when you visit camdenmedicals.co.uk or place an order with us. We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Data Controller
Camden Medicals Limited, 2 Frederick Street, Kings Cross, London WC1X 0ND. Email: info@camdenmedicals.co.uk.
Camden Medicals Limited is registered with the Information Commissioner’s Office (ICO), registration reference ZC110890.
2. What Data We Collect
We may collect the following personal data:
- Identity data: name, company name (for trade accounts)
- Contact data: email address, telephone number, delivery and billing address
- Transaction data: order history, payment details (processed securely by our payment providers — we do not store card numbers)
- Account data: username, password (encrypted), trade account details, company registration number
- Technical data: IP address, browser type, operating system, pages visited, referring site
- Communication data: correspondence with us via email, contact forms, or phone
3. How We Use Your Data
We process your personal data on the following lawful bases:
- Contract performance: to process and fulfil your orders, manage your account, and provide customer support
- Legitimate interests: to improve our website, detect fraud, and manage our business operations
- Legal obligation: to comply with tax, accounting, and regulatory requirements
- Consent: to send marketing communications where you have opted in (you may withdraw consent at any time)
4. Cookies
Our website uses cookies to provide essential functionality (such as your shopping cart and login session) and to understand how visitors use our site. When you first visit, you will be asked to accept or manage cookie preferences. Essential cookies cannot be disabled as they are necessary for the website to function. Analytics cookies help us understand site usage and are only set with your consent.
5. Who We Share Data With
We may share your data with:
- Courier and delivery partners — to deliver your order
- Payment processors (Stripe, PayPal) — to process your payment securely
- Hosting provider (Cloudways/DigitalOcean) — to store and serve our website
- Email service providers — to send order confirmations and, where consented, marketing emails
- HMRC or regulatory bodies — where required by law
We do not sell your personal data to third parties.
6. Data Retention
We retain your personal data for as long as necessary to fulfil the purposes for which it was collected:
- Order data: 7 years (to comply with HMRC tax record requirements)
- Account data: for the duration of your account, plus 2 years after closure
- Marketing data: until you unsubscribe or withdraw consent
- Technical/analytics data: up to 26 months
7. Your Rights
Under UK GDPR, you have the right to:
- Access your personal data (subject access request)
- Rectify inaccurate or incomplete data
- Erase your data (“right to be forgotten”) where there is no compelling reason to continue processing
- Restrict processing in certain circumstances
- Data portability — receive your data in a structured, machine-readable format
- Object to processing based on legitimate interests or for direct marketing
- Withdraw consent at any time for consent-based processing
To exercise any of these rights, please email info@camdenmedicals.co.uk. We will respond within one month.
8. Security
We use SSL/TLS encryption across our entire website. Payment processing is handled by PCI-DSS compliant providers (Stripe, PayPal). Access to personal data is restricted to authorised personnel only.
8.1 Passkeys (WebAuthn sign-in)
If you choose to register a passkey for signing in to your Camden Medicals account, we store:
- A credential identifier generated by your device
- A public key generated by your device
- The name you gave the passkey (if any) and the date you added it
- A count of how many times the passkey has been used, and the date it was last used
- The AAGUID (a non-unique identifier for the type of authenticator you registered, e.g. "Apple iCloud Keychain" or "YubiKey 5")
We do not receive or store your biometric data (fingerprint, face, PIN). That stays on your device and never leaves it.
You can view, rename, or remove any registered passkey at any time from your account’s Security section at My account → Edit account. We will send an email to the address on your account whenever a passkey is added, renamed, or removed. If you delete your account, all registered passkeys are removed.
Legal basis: legitimate interest (operating a secure sign-in service for our customers).
Retention: for as long as your account is active, or until you remove the passkey.
9. Complaints
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.
10. Changes to This Policy
We may update this policy from time to time. Any changes will be posted on this page. Last updated: March 2026.