Last updated: 4 August 2026
HS LABS Ltd (“Holy Spore”, “we”, “us” or “our”) operates the Holy Spore website and online shop. We are the data controller responsible for deciding how personal information collected through our website is used.
This Privacy Policy explains what information we collect, why we collect it, who we may share it with and the rights available to you under UK data-protection law.
You can contact us through the Contact page on our website or at:
Email: holysplabs@gmail.com
Registered office: 71-75 Shelton Street, London, Greater London, WC2H 9JQ, United Kingdom
Company number: 16568918
When you visit our website, contact us, create an account or place an order, we may collect:
Your name, billing address, delivery address, email address and telephone number.
Account information, login details and saved preferences.
Order details, including products purchased, order value, delivery method and correspondence relating to the order.
Payment-related information, such as payment status, transaction reference and limited card information supplied by our payment provider. Full card details are processed through Stripe and are not intended to be stored directly on our website.
Messages sent through our contact forms, email or customer-support channels.
Technical information such as your IP address, browser, device type, operating system, referring website, pages visited and approximate location.
Cookie choices, marketing preferences and, where applicable, information about how you interact with our emails or website.
We do not intentionally request special-category information such as medical information, religious beliefs, political opinions or biometric data. Please avoid including unnecessary sensitive information in messages to us.
We use personal information only where we have a lawful reason to do so.
We use your contact, delivery, payment and order information to:
Take and verify payment.
Confirm, prepare and dispatch your order.
Send transactional emails and delivery updates.
Manage cancellations, refunds, returns, complaints or payment disputes.
Provide customer support.
This processing is necessary to perform our contract with you or to take steps at your request before entering into a contract.
We may use information to maintain our website, prevent fraud, investigate suspicious transactions, secure customer accounts, enforce our terms and defend legal claims.
We rely on our legitimate interests in operating a secure and reliable business, provided those interests do not override your rights. Payment providers may also conduct automated fraud and security checks under their own privacy policies. Where applicable, you may contact us to request a manual review of a decision.
We may retain or disclose information where necessary for accounting, taxation, consumer protection, product safety, regulatory compliance, court proceedings or lawful requests from public authorities.
We use your contact details to answer questions, resolve problems and provide important information about an existing order or account.
We may send promotional emails only where you have consented or where another lawful marketing exemption applies. You can unsubscribe at any time through the link in an email or by contacting us.
Unsubscribing from marketing will not prevent us from sending essential messages about an order, payment, account or legal matter.
Where permitted by your cookie choices, we may use analytics to understand website traffic, identify errors and improve the shop. Analytics and advertising technologies that are not strictly necessary will not be activated until the required consent has been given.
Payments are processed through Stripe. Information entered into Stripe’s payment interface may be collected and processed directly by Stripe in accordance with its own privacy policy.
We may receive limited information from Stripe, such as your payment status, transaction identifier, card type, expiry date or final digits of the payment card. We use this information to confirm payments, process refunds, prevent fraud and resolve disputes.
We do not sell your payment or order information and do not disclose the contents of your order for unrelated advertising purposes.
We disclose personal information only where reasonably necessary. Recipients may include:
Stripe and other payment, fraud-prevention or banking providers.
Our website host and technical providers, including Hostinger, WordPress and WooCommerce-related services.
Royal Mail, couriers and other delivery providers.
Email, customer-support, website security, backup and analytics providers.
Accountants, insurers, legal advisers and professional consultants.
A purchaser, investor or professional adviser involved in a genuine sale, restructuring or transfer of the business.
Service providers are permitted to use information only for the relevant service, their legal obligations or other purposes explained in their own privacy notices.
We do not sell or rent customer information to data brokers.
Some technology, payment or hosting providers may process information outside the United Kingdom.
Where personal information is transferred internationally, we take reasonable steps to ensure that an appropriate legal safeguard is used. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses or another lawful transfer mechanism.
We retain information only for as long as reasonably necessary for the purpose for which it was collected.
Our normal retention periods are:
Completed orders, refunds and financial records: normally up to six years after the end of the relevant financial year, or longer where required by law, an investigation or a continuing dispute.
Failed, cancelled or abandoned orders: normally up to 30 days unless required for fraud prevention, support or legal purposes.
Customer accounts: while the account remains active and normally for up to 24 months after inactivity, although legally required order records may be preserved separately.
Customer enquiries and support correspondence: normally up to 24 months after the matter is resolved.
Marketing information: until you unsubscribe or withdraw consent. We may retain a minimal suppression record so that we do not contact you again.
Security logs and technical records: normally up to 12 months, unless an incident requires longer investigation.
Cookie and analytics information: for the period stated in our cookie banner or cookie settings.
Information may be anonymised rather than deleted where it can no longer identify you. Our website retention settings should be configured to reflect these periods.
Our website uses cookies and similar technologies.
Strictly necessary cookies may be used without optional consent where they are required for functions such as keeping products in your basket, processing checkout, maintaining security or remembering privacy choices.
Analytics, advertising and other non-essential technologies will be used only where the required consent has been obtained. You can accept, reject or change your choices through our cookie banner or cookie settings.
Blocking essential cookies through your browser may prevent parts of the shop from working correctly.
We use reasonable organisational and technical safeguards designed to protect personal information against unauthorised access, alteration, disclosure, loss or misuse. These may include encrypted connections, restricted administrative access, security updates, backups and trusted payment processing.
No internet service can guarantee complete security. Customers are responsible for protecting their account password and should contact us promptly if they believe their account or personal information has been compromised.
Depending on the circumstances and our lawful basis for processing, you may have the right to:
Request a copy of the personal information we hold about you.
Ask us to correct inaccurate or incomplete information.
Ask us to delete information where we no longer have a lawful reason to retain it.
Ask us to restrict how information is used.
Object to processing based on legitimate interests or direct marketing.
Receive certain information in a portable format.
Withdraw consent at any time where processing is based on consent.
Request human review of certain significant automated decisions.
Complain to a data-protection regulator.
Some rights are subject to legal exemptions. For example, we may need to retain order information for tax, accounting, fraud-prevention or legal-claims purposes even after an erasure request.
To exercise a right, contact us using the details above. We may need to verify your identity before responding.
Please contact us first at holysplabs@gmail.com if you have concerns about how we use your information so that we can investigate the matter.
You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection. Information about making a complaint is available on the ICO website.
Our website and products are intended for adults aged 18 or over. We do not knowingly collect personal information from children. If you believe a child has provided information to us, please contact us so that it can be reviewed and, where appropriate, deleted.
Our website may contain links to websites operated by other organisations. We are not responsible for the privacy practices or content of external websites, and you should review their privacy policies before providing personal information.
We may update this Privacy Policy when our services, suppliers or legal responsibilities change. The latest version will be published on this page with a revised “last updated” date. Significant changes may also be communicated through the website or by email where appropriate.