Legal

Privacy Policy

Last updated: 28 July 2026

This Privacy Policy explains how Norwell Media Ltd ("we", "us", "our"), trading as The Norwell Review, collects, uses, stores and protects your personal data when you visit https://enerbackliving.world/ (the "Website") or place an order for Wellaray Coffee.

We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are (Data Controller)

The data controller responsible for your personal data is:

2. What Personal Data We Collect

We collect the following categories of personal data:

• Identity data: your full name.
• Contact data: telephone number; email address (when submitted via contact form).
• Transaction data: order details, product quantity, price, SKU.
• Technical data: IP address, browser type and version, operating system, referring URL, pages visited, time and date of visit, cookie identifiers.
• Marketing & communications data: your preferences regarding receiving communications from us and your communication preferences.
• UTM / advertising parameters: utm_source, utm_medium, utm_campaign, utm_content, utm_term, gclid - captured automatically from the URL when you arrive via an advertising link.

We do not collect special category data (health, race, religion, biometric data, etc.) through this Website.

3. How We Collect Your Personal Data

• Directly from you: when you complete the order form, contact form, or lifestyle quiz.
• Automatically: via cookies, server logs and analytics tools when you browse the Website.
• From third parties: analytics providers (Google Analytics) and advertising platforms (Google Ads) where you have consented to their use.

4. How We Use Your Personal Data

Purpose	Data used	Lawful basis (UK GDPR)
Processing and fulfilling your order	Identity, contact, transaction	Art. 6(1)(b) - performance of a contract
Responding to enquiries and contact form submissions	Identity, contact	Art. 6(1)(b) - pre-contractual steps; Art. 6(1)(f) - legitimate interests
Website analytics and performance monitoring	Technical data	Art. 6(1)(a) - consent (where analytics cookies accepted)
Personalised advertising and remarketing	Technical, UTM data	Art. 6(1)(a) - consent (where marketing cookies accepted)
Legal compliance and record-keeping	All categories as required	Art. 6(1)(c) - legal obligation
Fraud prevention and security	Technical, identity	Art. 6(1)(f) - legitimate interests

5. Cookies and Consent Mode v2

We use Google Consent Mode v2. When you first visit the Website, all non-essential cookies are denied by default. Cookies for advertising (ad_storage, ad_user_data, ad_personalization) and analytics (analytics_storage) are only activated if you click Accept All or enable them in Manage Preferences.

For full details of the cookies we use, please see our Cookie Policy.

6. Data Sharing and Third Parties

We share your personal data only in the following circumstances:

• Google LLC - analytics (Google Analytics 4) and advertising (Google Ads), subject to your consent. Google acts as a data processor under our instructions. Data may be transferred to the USA under Standard Contractual Clauses.
• Delivery and logistics partners - your name and delivery address are shared with our courier for order fulfilment.
• Payment processors - where payment is taken electronically, your payment data is processed by the relevant payment processor; we do not store card details.
• Legal and regulatory authorities - where required by applicable law, regulation or court order.

We do not sell your personal data to third parties.

7. International Transfers

Where personal data is transferred outside the UK (e.g. to Google's servers in the USA), we ensure that appropriate safeguards are in place, including Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO) or equivalent adequacy mechanisms under UK GDPR.

8. Data Retention

• Order and transaction data: retained for 7 years from the date of transaction for tax and accounting purposes (Companies Act 2006; HMRC requirements).
• Contact form enquiries: retained for 2 years from the date of last contact.
• Analytics data: retained in Google Analytics for 14 months (our default configuration), then anonymised or deleted.
• Cookie consent records: retained for 1 year from the date consent was given or withdrawn.

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access - to obtain a copy of the personal data we hold about you.
• Right to rectification - to have inaccurate personal data corrected.
• Right to erasure ("right to be forgotten") - to request deletion of your data, subject to legal retention obligations.
• Right to restriction of processing - to request that we limit how we use your data.
• Right to data portability - to receive your data in a structured, commonly used, machine-readable format.
• Right to object - to object to processing based on legitimate interests or for direct marketing.
• Rights related to automated decision-making - we do not carry out solely automated decision-making or profiling that produces legal or similarly significant effects.
• Right to withdraw consent - where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at info@enerbackliving.world or write to us at our postal address above. We will respond within one calendar month of receiving your request.

10. Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with UK GDPR, you have the right to lodge a complaint with the UK supervisory authority:

We would, however, appreciate the opportunity to address your concerns before you contact the ICO - please reach out to us first.

11. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. These include TLS/HTTPS encryption for all data in transit, restricted access to personal data on a need-to-know basis, and regular review of our data processing practices.

12. Links to Third-Party Websites

Our Website may contain links to external websites (e.g. published research journals). We are not responsible for the privacy practices of those sites and encourage you to read their privacy notices.

13. Children

Our Website and products are intended for adults aged 18 and over. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us immediately and we will delete it.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. We encourage you to review this page periodically. Continued use of the Website after changes constitutes acceptance of the updated policy.