Privacy policy
Last updated: 31/08/2026
The short version
- We hold your order and contact details: name, address, email, what you bought.
- We never hold your DNA sample, your genetic data, or your test results. Those go to Lifecode Gx, the lab that does the testing.
- Lifecode Gx destroy your physical sample after 3 months and delete your genetic data after 6 months.
- We don't sell your personal information to anyone.
- Want a copy of your data, or want it deleted? Email care@gettolerance.com.
The full policy below is what legally applies.
Who we are
Tolerance Limited ("we", "us", "our") is registered in England and Wales. We're the data controller for everything below, meaning we decide what's collected and why. The one exception is genetic data.
| Company number | 15043347 |
| Registered office | 1 Canon Street, London, N1 7DB, United Kingdom |
| Postal address | Unit 440, 275 New North Road, London, N1 7AA, United Kingdom |
| ICO registration | ZB708831 |
| Data protection contact | care@gettolerance.com |
Your supplement orders
Most orders are for Aperitif. We take your name, contact details, addresses, what you ordered and confirmation your payment worked. We use it to take payment, get your order to you, handle returns and keep the accounting records we're legally required to keep.
No health information. We don't ask why you're buying and we don't infer anything about your health from the fact that you did.
What we collect
| What | When |
|---|---|
| Contact details: name, email, phone | When you order, sign up, or contact us |
| Order information: billing and shipping address, items, value, order history | When you buy |
| Payment confirmation: that it succeeded, card type, last four digits | At checkout. Your full card number goes to our payment provider, never to us |
| Account information: username, encrypted password, saved addresses | If you create an account |
| Customer care emails: whatever you write to us | When you contact us |
| Marketing preferences: whether you've opted in, and whether you open or click | When you subscribe |
| Reviews: anything you post publicly | When you submit one |
We also collect usage data through cookies: IP address, device and browser, pages viewed, how you arrived. Details in our Cookie Policy.
We don't want your medical history or health records. Please don't send them. If you do, we'll use it to answer your question and then delete it.
What your order says about you. Buying a histamine product may suggest something about your health. We don't build health profiles, don't assume anything about a medical condition from your purchases, don't segment marketing or ad audiences on health, and don't share your purchase history with advertisers as a health signal.
Why we use it, and our legal basis
| What for | Legal basis |
|---|---|
| Orders, payment, delivery, returns, your account, service emails, and passing your name, email and shipping address to Lifecode Gx | Contract (Art 6(1)(b)) |
| Customer care, fraud prevention, site security, defending legal claims | Legitimate interests (Art 6(1)(f)) |
| Marketing emails, advertising, analytics | Consent (Art 6(1)(a)), plus PECR. Opt out any time. |
| Accounting and tax records | Legal obligation (Art 6(1)(c)) |
Where we rely on legitimate interests, we've assessed that our interest doesn't override your rights. You can object.
We don't process genetic or health data at all. And marketing consent is separate from genetic consent. Neither is a condition of the other.
Who we share it with
We don't sell your personal information.
| Who | What they get |
|---|---|
| Shopify and Shopify Payments | Order, contact, account and payment data. Never your full card details. |
| PayPal | Payment and billing data, under their own privacy policy |
| Lifecode Gx | Your name, email and shipping address only, so they can send your kit |
| Norsk European Wholesale | Name, shipping address, order contents. Supplement orders only. |
| Delivery carriers | Name, shipping address, contact details for delivery notifications |
| Brevo | Name, email, engagement data, for our emails |
| Google and Meta | Usage data, device data, IP address, advertising identifiers |
| Cloudflare | Transient browser signals, for bot protection |
We may also disclose information where we're legally required to, or in a business sale or merger, in which case it transfers to the buyer under the same protections.
Outside the UK
Some of these companies are based abroad. Where your information is transferred out of the UK, it's protected by a UK adequacy decision, the UK International Data Transfer Agreement or Addendum, or the UK Extension to the EU-US Data Privacy Framework.
Brevo (France) and Lifecode Gx (UK and EU) rely on adequacy. Shopify, PayPal, Google, Meta and Cloudflare transfer to the US and elsewhere under the Data Privacy Framework or an IDTA. Norsk is UK only, so nothing leaves.
Email us for more detail on any of these.
How long we keep it
| Information | How long |
|---|---|
| Order and transaction records | 7 years from the end of the financial year you ordered in |
| Customer account | While it's open, then 12 months |
| Marketing contacts | Until you unsubscribe, or 24 months with no engagement |
| Customer care emails | 24 months from the last message |
| Website analytics | 14 months |
| Cookie choices | 12 months, then we ask again |
| Product reviews | Until you ask us to remove them |
Your genetic information isn't on this list, because we never hold it.
Genetic test kits
If you buy a test kit, Lifecode Gx do the testing, not us.
We pass them your name, email and shipping address so they can register your kit, post it, and email you your booking link. That's all. There's no health information in it, because we don't hold any.
Everything after that is theirs. You return your swab to their lab and complete their consent form, which is where you agree to your genetic data being processed. They're the independent controller for your sample, your genetic data, your report and your consultation, and we never see any of it.
They destroy your physical sample after 3 months and delete your genetic data after 6 months. Their terms are worth reading before you swab: https://support.lifecodegx.com/article/192-data-privacy
Genetic data is special category data, so it needs your explicit consent. You give that to Lifecode Gx, not to us. You can withdraw it with them at any time, though that won't cancel your order or trigger a refund.
For anything to do with your sample, genetic data or report, contact Lifecode Gx. We can't access, correct or delete it for you.
Kits are sold to adults aged 18 or over only.
Your rights
- Access: a copy of what we hold
- Correction: fix anything wrong
- Erasure: delete it, where we've no ongoing reason to keep it
- Restriction: pause our use of it while a concern is resolved
- Portability: a machine-readable copy of what you gave us
- Objection: object to processing based on legitimate interests. Object to direct marketing any time and we'll always stop
- Withdraw consent: any time, without affecting what we did before
Email care@gettolerance.com. We respond within one month, or tell you if a complex request needs longer. It's free. We may need to verify your identity first.
To unsubscribe from marketing, click unsubscribe on any email. We'll still send service messages about your orders.
Security
Encrypted connections, strong authentication internally, access limited to the few people who need it, and suppliers contractually required to protect your data.
Our forms use Cloudflare Turnstile, invisible bot detection that reads browser signals to tell humans from bots. The check is transient and we can't access what it collects.
No system is perfect, so please don't send us sensitive information by unsecured email. If a breach puts your rights at risk, we'll report it to the ICO within 72 hours and tell you without undue delay where required.
Children
Not intended for children. We don't knowingly collect information from anyone under 16, and test kits are sold only to over-18s. If you're a parent and think your child has given us their information, email us and we'll delete it.
Automated decisions
We don't make automated decisions with legal or similarly significant effects. We do personalise your marketing and advertising based on browsing and purchase history, and you can opt out through the cookie banner or by unsubscribing.
Complaints
Tell us first at care@gettolerance.com.
You can also complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline 0303 123 1113, ico.org.uk. Outside the UK, complain to your own country's data protection authority.
Changes
We'll update the date at the top and post the new version here. If a change materially affects how we use your information, we'll email you.
Contact us
Email: care@gettolerance.com
Post: Tolerance Limited, Unit 440, 275 New North Road, London N1 7AA, United Kingdom. Please write here rather than our registered office.
We link to other sites, including Lifecode Gx's. We're not responsible for their privacy practices, so read their policies before giving them your information.
Tolerance Limited, company number 15043347. Registered office: 1 Canon Street, London, N1 7DB. Correspondence: Unit 440, 275 New North Road, London, N1 7AA. ICO registration ZB708831.