Privacy Policy for Trade Customers, Retailers and Distributors

1. About this policy

API Supplements ([registered company name], company number [number], registered office [address]) ("API Supplements", "we", "us") manufactures finished dietary supplement products and supplies them to retailers, distributors, wholesalers and other trade customers ("Customers").

This policy explains how we handle personal data about individuals connected with our trade relationships: buyers, directors, owners, sole traders, partners, account managers, accounts and logistics staff, quality and regulatory contacts, visitors to our trade website and portal, and the equivalent people at our distributors, agents, suppliers and contractors, and referees they name ("you").

It applies to prospective, current and former Customers. It does not cover sales to consumers; where we sell directly to consumers, our separate Consumer Privacy Policy applies [delete if not relevant].

We comply with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 ("DPA 2018") and the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"), each as amended by the Data (Use and Access) Act 2025.

Please read this policy together with any other privacy notice we give you, for example our Website Privacy Notice https://www.apisupplements.com/pages/privacy-policy or a notice given at an event or site visit. Where another notice deals specifically with an activity, that notice governs that activity and this policy covers everything else.

2. Our role and the limits of our responsibility

2.1 We are a controller of business contact data. For the personal data described in this policy we are an independent controller. We decide why and how it is used.

2.2 We supply businesses, not consumers. We do not sell to our customers’ end consumers through the trade channel, we do not ask for consumer data, and we do not want it. Customers should not send us consumer personal data except where Section 8 (product safety) requires it.

2.3 Customers are responsible for their own data. Each Customer is separately and solely responsible for the personal data of its own consumers, staff, website visitors and marketing audiences. That includes its lawful basis, privacy notices, retention, security and responding to rights requests. We do not process that data on a customer’s behalf.

2.4 We are not a processor unless we say so in writing. Nothing in a supply, white-label or private-label relationship makes API Supplements a processor or joint controller of a customer’s data. That role arises only where a data processing agreement signed by both parties expressly says so.

2.5 Consumer data we do receive. If we receive consumer data (for example in a forwarded complaint, an adverse reaction report or a recall), we use it as an independent controller only for the purposes in Section 8. We may refer the consumer back to the retailer who sold them the product.

2.6 Data we give you. Where we share contact or traceability information with a Customer, the Customer may use it only for the purpose it was provided and must comply with data protection law when doing so.

3. The information we collect

Category	Examples	Where it comes from
Identity and contact	Name, job title, employer, business email, phone, address	You, your employer, trade shows, introductions, LinkedIn and other public business sources
Account and trading	Customer account details, authorised users, order and delivery history, pricing agreements, specifications, artwork approvals	You, your employer, our systems
Credit and finance	Company and director details, trade references, credit reports, payment history, bank details (for refunds and direct debits), and for sole traders and partnerships, personal financial information	You, credit reference agencies, Companies House, trade credit insurers
Compliance and due diligence	Identity checks, sanctions and export-control screening, anti-bribery and anti-money-laundering checks, beneficial ownership information	You, screening providers, public registers
Quality and regulatory	Names of quality, regulatory and technical contacts, audit and inspection records, complaints, recall communications, batch and traceability records linked to named individuals	You, your employer, regulators, auditors
Communications	Emails, call and meeting notes, enquiry forms, survey responses	You, our systems
Marketing	Preferences, event attendance, opt-ins and opt-outs	You, our systems
Technical	IP address, device and browser data, trade portal log-in and activity logs, cookie identifiers	Your device, our systems
Visitors to our premises	Name, company, vehicle registration, CCTV images, signing-in records	You, our systems
Distributor, agent and supplier vetting	Qualifications and experience, authority to bind, territories and languages covered, references and referee details	You, your employer, referees you name, public sources
Ethical trading and compliance	Contact details of compliance staff, modern slavery and responsible sourcing responses, audit and certification contacts	You, your employer, auditors, public sources

We do not intentionally collect special category data (such as health data) or children's data from Customers. The exceptions are information you choose to give us about a visit to our premises or an event, such as dietary or accessibility requirements, which we use only to look after you safely, and the safety reports described in Section 8.

4. How we use your information and our lawful bases

Purpose	Lawful basis
Setting up and managing trade accounts, taking and fulfilling orders, delivery, invoicing and collection, and telling you about changes to our terms and this policy	Performance of a contract (where you are the contracting party), otherwise legitimate interests in operating our business
Credit assessment, credit control, trade credit insurance and debt recovery	Legitimate interests in managing credit risk and recovering what we are owed
Know-your-customer, sanctions, export-control, anti-bribery, anti-money-laundering, modern slavery and ethical trading compliance checks	Legal obligation, and legitimate interests in preventing financial crime
Product quality, traceability, complaints, audits, recalls and safety reporting	Legal obligation, legitimate interests in product safety and defending claims, and (where needed to protect someone's life) vital interests
Meeting tax, accounting and company law requirements	Legal obligation
Managing, supporting and securing our website, trade portal, systems and premises	Legitimate interests in security and fraud prevention
Business-to-business marketing and relationship management	Legitimate interests, or consent where PECR requires it (see Section 5)
Market research, product development and customer feedback	Legitimate interests
Establishing, exercising or defending legal claims, enforcing our contracts and protecting our intellectual property	Legitimate interests and, where applicable, legal obligation
Business sales, mergers, financing and restructuring	Legitimate interests
Assessing and onboarding distributors, agents and suppliers, including taking up references	Legitimate interests in making sure our partners are suitable to represent our brands and meet our quality standards
Monitoring compliance with our contracts, policies, codes of practice and quality standards, including audits	Legitimate interests in protecting our products, brands and regulatory position
Health and safety, site security and looking after visitors, including dietary and accessibility needs you tell us about	Legal obligation and legitimate interests; for dietary or accessibility information, your explicit consent

Where we rely on legitimate interests we have carried out and recorded an assessment balancing our interests against yours. Some purposes (for example, certain crime-prevention and safeguarding purposes) are now "recognised legitimate interests" under the Data (Use and Access) Act 2025, and where we use one we will still consider whether the processing is necessary. You may ask us for details of the assessment that applies to you.

Where you are required to give us information to enter or perform a contract or to meet a legal requirement, we may be unable to deal with you if you do not provide it.

5. Business marketing and PECR

Corporate subscribers. We may send marketing emails to business addresses of limited companies, LLPs and other corporate bodies without prior consent, provided we identify ourselves and give a simple way to opt out.

Individual subscribers. For sole traders, most partnerships and personal email addresses, we market only with your consent, or where you are an existing Customer and the "soft opt-in" applies to similar products, with a clear opt-out at collection and in every message.

Calls and SMS. We check numbers against the Telephone Preference Service and Corporate TPS before making marketing calls and will not market by SMS without consent.

Opt-out. You can opt out of marketing at any time using the link in a message or by contacting us. We keep a suppression record, so we do not contact you again. Opting out of marketing does not affect operational messages about orders, deliveries, quality or safety.

No lists. We do not buy or rent marketing lists, and we do not sell marketing data.

Enforcement. Breaches of PECR can now attract the same maximum penalties as UK GDPR (up to £17.5 million or 4% of worldwide annual turnover, whichever is higher). We take our obligations seriously and expect any affiliate or agent marketing on our behalf to do the same.

6. Who we share personal data with

We do not sell personal data. We share it only where necessary, and only with:

Service providers acting for us (processors) under written contracts: IT and cloud hosting, ERP and CRM systems, email and marketing platforms, website and portal providers, document management, accounting and payroll software, IT security and backup providers;

Logistics partners: couriers, hauliers, freight forwarders, customs agents and warehouse operators;

Finance and risk partners: banks, payment providers, factoring and invoice finance companies, credit reference agencies, trade credit insurers, debt collection agencies and screening providers;

Professional advisers: lawyers, accountants, auditors, insurers, brokers and consultants;

Certification and audit bodies: retailers' auditors, third-party audit schemes (for example BRCGS or equivalent) and testing laboratories, where an audit or investigation requires it;

Regulators and public authorities: including Trading Standards, the Food Standards Agency and local authority food teams, the Office for Product Safety and Standards, the Medicines and Healthcare products Regulatory Agency, HMRC, the ICO, customs and law enforcement, where we are required or entitled to do so;

Customers further down or up the supply chain, for traceability, complaint investigation and recall purposes, limited to what is necessary;

A prospective buyer, investor or lender of all or part of our business, under confidentiality; and

Anyone else where you ask us to, or where the law requires or permits.

Group companies [delete if none]: other companies in our group, for management, accounting, compliance and marketing purposes, under the same safeguards as this policy.

We require our processors to keep data secure and use it only on our instructions. We maintain a register of suppliers that handle personal data.

7. International transfers

Some of our service providers and some of our customers, distributors and logistics partners are outside the UK. We transfer personal data internationally only where:

the destination is covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the US recipient is certified);

we have put in place the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and have assessed that the protection for the data is not materially lower than under UK law; or

a specific exception applies, such as where the transfer is necessary to perform a contract with you or at your request.

You can ask us for details of the safeguards we use for transfers relating to you.

8. Product safety, complaints and recalls

As a manufacturer we have legal duties to trace our products, investigate problems and cooperate with regulators. This can involve personal data in the following situations.

Traceability. We keep records of which Customers received which batches, including named contacts. This allows us to identify where a product has gone if there is a problem.

Complaints and adverse events. If a customer passes us a complaint or report of an adverse reaction, it may include a consumer's name, contact details and, occasionally, health information. We use it only to investigate, to take corrective action, to notify regulators and Customers where required, and to establish or defend legal claims. Where the information is special category data we rely on the substantial public interest, legal claims or other appropriate conditions under UK GDPR and DPA 2018.

Recalls and withdrawals. We may share batch, product and Customer contact information with regulators and with Customers in our supply chain so that affected stock can be located and removed. Customers are responsible for notifying and dealing with their own consumers and must cooperate with us promptly and provide traceability information when we ask.

Minimisation. When we pass reports to regulators or other Customers, we remove or limit personal data where we can.

Customers should remove unnecessary consumer personal data from any complaint or report before sending it to us and send only what is needed for us to act.

9. How long we keep personal data

We keep personal data only as long as we need it for the purpose it was collected, to meet legal obligations, or to protect against claims. Because our products can give rise to claims many years after supply, some records are kept for longer periods.

Category	Retention
Trade account and contact records	Duration of the relationship plus [6] years
Orders, invoices, payment and tax records	[6] years from the end of the financial year
Credit and due diligence files	[6] years after the relationship ends
Batch, traceability and manufacturing records containing named contacts	Shelf life of the product plus [1] year, and up to [10] years where needed for product liability and regulatory purposes
Complaints, adverse event and recall records	[10] years, as the limitation period for product liability claims can be long
Contracts and correspondence	[6] years after the contract ends or expires
Marketing contact and suppression data	Until you opt out or we conclude the contact is out of date (generally [24] months without engagement); suppression records kept as long as necessary to honour your opt-out
Website and trade portal logs	[12-26] months
CCTV	[30] days unless needed for an incident
Visitor and sign-in records	[12] months
Unsuccessful distributor, agent and supplier vetting records	[12] months after the decision
Compliance monitoring and audit records	[6] years after the contract ends, or longer where needed for claims or regulators
Visitors' dietary and accessibility information	Deleted within [30] days after the visit or event

When a retention period ends we securely delete or anonymise the data, subject to our backup cycle. If a legal dispute, investigation or regulatory inquiry is under way, we may keep relevant data for longer.

10. Security

We use technical and organisational measures appropriate to the risk, including encrypted connections, role-based access, multi-factor authentication on key systems, patching, endpoint protection, tested backups, supplier due diligence, confidentiality obligations for staff and contractors, controlled access to premises, and regular staff training.

No system is completely secure. You are responsible for keeping your trade portal credentials confidential, for the actions of any users you authorise, and for telling us promptly when a user leaves or credentials may be compromised.

Email and the internet are not secure. Messages you send us may pass through several networks, may be intercepted or misdirected, and may not arrive. Please use our trade portal or an encrypted channel for sensitive material. We are responsible for the security of personal data once it is in our systems. To the extent the law allows, we cannot accept responsibility for interception or loss that happens outside them.

11. Your rights

In the circumstances set out in the law you have the right to:

be informed about how we use your data;

access the personal data we hold about you;

have inaccurate data corrected or incomplete data completed;

have data erased;

restrict our processing;

object to processing based on legitimate interests, and to object at any time to direct marketing;

receive certain data in a portable format, where we process it by automated means under consent or contract;

withdraw consent at any time; and

not be subject to solely automated decisions with legal or similarly significant effects, without safeguards.

How to use them. Contact [privacy@apisupplements.co.uk]. We may ask for information to verify your identity and, where needed, to clarify your request.

Timing. We will respond without undue delay and within one month of receiving your request (or of receiving the information we need to verify your identity or clarify the request). We may extend this by up to two further months for complex or numerous requests and will tell you why.

Search and scope. When responding to an access request we carry out a reasonable and proportionate search. We may withhold information where the law allows, including data relating to other people, legally privileged material, confidential commercial information, and information we need to withhold to prevent crime or to protect regulatory or legal proceedings.

Fees and refusals. There is normally no charge. We may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive, and we will explain our decision and your right to complain.

Rights concerning consumer data. If you are a consumer whose data was passed to us by a retailer or distributor, we will help you exercise your rights over the data we hold as controller, and you may also contact the business that sold you the product.

12. What we expect from our customers

Customers who give us personal data about their staff, contacts or anyone else must:

make sure the data is accurate, up to date and limited to what we need;

have a lawful basis to share it with us and tell the individuals concerned that their details have been shared with us, including by giving them a link to this policy;

not send us consumer, special category or children's personal data except as Section 8 requires, or as otherwise agreed in writing;

tell us promptly, and no later than 24 hours after becoming aware, of any personal data breach or unauthorised access affecting information we supplied, or accounts or credentials for our systems;

keep us informed of changes to named contacts and authorised users;

use any personal data we supply (such as contact or traceability information) only for the purpose for which it was provided; and

comply with their own data protection obligations, including for their consumers and staff, and with the data protection terms in our Trade Terms and any data processing agreement.

To the fullest extent permitted by law, API Supplements is not responsible for a customer’s compliance with data protection law in its own business, for personal data a customer sends to us without authority, or for loss arising from a customer’s failure to meet its obligations to us. Nothing in this policy limits rights or remedies that cannot lawfully be limited, including your statutory rights as an individual.

13. Data breaches

We have a breach response procedure. Where a breach is likely to result in a risk to individuals, we will notify the ICO within 72 hours of becoming aware of it, and we will notify affected individuals without undue delay where the risk is high. Where a breach affects a customer’s data or involves personal data we hold on its behalf under a written agreement, we will notify that Customer in line with the agreement.

14. Website, trade portal and cookies

Our website and trade portal use cookies and similar technologies.

Strictly necessary cookies (log-in, security, load balancing) are always used.

Analytics and statistical cookies are [used only within the exemptions in PECR as amended / set only with your consent] [confirm which applies].

Marketing and advertising cookies are set only with your consent.

You can manage your preferences through [the cookie settings link] and your browser. Our Cookie Policy lists each cookie, its purpose and its duration. Our website may contain links to other websites; we are not responsible for their privacy practices.

15. Automated decisions and profiling

We may use credit scoring and risk tools supplied by credit reference agencies and insurers to help decide credit terms. Decisions are reviewed by a person. We do not make solely automated decisions that significantly affect you without appropriate safeguards, including the ability to contest the decision and obtain human review.

16. Complaints

If you have a concern about how we use your data, please contact us at [privacy@apisupplements.co.uk] or [postal address]. We will acknowledge your complaint within 30 days, investigate without undue delay, and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office (or its successor, the Information Commission, following the restructure under the Data (Use and Access) Act 2025) at ico.org.uk or on 0303 123 1113, or by post to First Contact Team, Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF. We would appreciate the chance to resolve your concern first, but you do not have to complain to us before contacting the regulator.

17. Changes to this policy

We may update this policy from time to time to reflect changes in the law, regulator guidance or our business. The current version is always on our website with its effective date. Where changes are significant, we will notify our trade contacts by email or through the trade portal.

This policy is governed by the laws of England and Wales, without affecting any mandatory rights you may have elsewhere.

18. Contact us

API Supplements “Algae Products International Ltd, Email: Hello@apisupplements.com