Privacy policy

Updated: October 2026

This policy explains how Muscle Labs Limited, trading as Muscle Labs (“we”, “us”, “our”), collects, uses and protects personal data when you use our website, www.musclelabs.co.uk, place an order, or contact us. We are the data controller for this website, registered in England and Wales under company number 17434043; registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. You can reach us at any time at support@musclelabs.co.uk.

We collect the minimum personal data needed to take your order, deliver items and support you afterwards, and we delete it when it is no longer needed. Full deletion timescales are published in our Data Retention Policy.

1. What we collect

• Identity and contact details: your name, email address, delivery and billing address, and phone number, provided when you place an order.
• Order details: the products you buy, order value, delivery method and order history.
• Payment status: confirmation from our payment provider that a payment succeeded or failed, and its payment reference. We never see or store your bank login or card number.
• Correspondence: emails you send to support@musclelabs.co.uk and our replies.
• Technical data: IP address, browser type and pages visited, recorded in our hosting provider’s security and access logs, and the essential cookies described in section 7.

We do not collect any special-category (sensitive) data, and we ask you not to include any in correspondence with us.

2. How we use it, and our lawful basis

• Processing and delivering your order, including payment, order confirmation and delivery updates (performance of a contract).
• Replying when you contact us and resolving delivery or payment issues (legitimate interests: running a responsive business).
• Keeping accounting and tax records (legal obligation).
• Preventing fraud and keeping the site secure (legitimate interests).
• Sending marketing emails (consent, or the “soft opt-in” where you are an existing customer). Every marketing email contains an unsubscribe link, and unsubscribing takes effect immediately.

3. Who we share it with

We never sell personal data. We share it only with service providers who need it to perform a service for us, under terms that prohibit them from using it for their own purposes:

• Payment provider: our open banking (“Pay by Bank”) provider, to take and refund payments. You approve the payment in your own banking app, and your bank login never touches our servers.
• Delivery carriers: Royal Mail receives your name, address and contact details to deliver your order.
• Email providers: to send order confirmations, delivery updates and (where subscribed) marketing emails.
• Hosting and security providers: to run and protect the website.
• Drafting tools: we use software, including AI-based tools, to help our team draft replies to customer emails. Every reply is reviewed by a member of staff before it is sent, and these providers may not use your data for their own purposes.

We may also disclose personal data where the law requires it, or where necessary to establish, exercise or defend legal claims.

4. International transfers

Some of our service providers process data outside the UK, for example in the European Economic Area or the United States. Where they do, the transfer is protected by a UK adequacy decision (including the UK-US Data Bridge) or by the UK International Data Transfer Agreement or Addendum in place with the provider.

5. How long we keep it

Customer-service emails are deleted within 12 months, typically after 6. Order and transaction records are kept for 6 years, as UK tax law requires. Marketing details are kept only until you unsubscribe. The full schedule, including backups, is published in our Data Retention Policy.

6. Security

The whole site runs over HTTPS (TLS). Payments are approved on our payment provider’s secure platform and in your own banking app, so no card numbers or bank credentials are collected, stored or seen by us. Access to customer data is limited to staff who need it, and the website sits behind an up-to-date firewall.

7. Cookies

We use a small number of essential cookies and browser storage:

• Essential cookies: the session cookies that operate your basket and checkout, and security cookies. The site cannot function without these.
• Your choices: your age confirmation and your cookie choice are remembered in your browser so we do not ask again on every page.

We do not currently use analytics or advertising cookies. If we add analytics in future, we will update this policy first. You can change your choice at any time with Cookie preferences at the bottom of every page, and you can block or delete cookies in your browser settings; blocking essential cookies will prevent checkout from working.

8. Your rights

We adhere to UK data protection law and are registered with the Information Commissioner’s Office (registration number ZC246045). You have the right to:

• access a copy of the personal data we hold about you, free of charge;
• correct inaccurate or incomplete data;
• erasure, meaning you can ask us to delete your data. We will, except where the law requires us to keep it (for example, tax records);
• restrict or object to processing, including objecting to direct marketing at any time;
• portability, meaning you can receive the data you provided to us in a machine-readable format;
• withdraw consent at any time, where processing is based on consent.

Email support@musclelabs.co.uk to exercise any of these rights. We respond within 4 weeks and never charge a fee unless a request is manifestly unfounded or excessive. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk. Please contact us in the first instance so we can resolve any concern.

9. Age

You must be at least 18 years old to use this website and order. We do not knowingly collect personal data relating to anyone under 18.

10. Changes to this policy

Any changes will be published on this page with an updated date at the top.