Privacy Policy

Last updated: 15 June 2026

This Privacy Policy explains how Lorenzo Ballicu ("I", "me", "my"), trading as HL Fit Hub via the website hlfithub.com (the "Site"), collects, uses, stores and protects your personal data when you visit the Site, place an order or contact me. I act as the data controller. This policy is written to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the EU General Data Protection Regulation (EU) 2016/679 (EU GDPR).

1. Who I am

Lorenzo Ballicu — Herbalife Independent Member.
Address: Calle Bernardo de la Torre 37, 35007, Las Palmas, Spain.
Email: info@hlfithub.com
Phone: +34 685 540 641

2. Data I collect

Identity and contact data: name, email address, phone number, billing and delivery address.
Order data: products purchased, order value, payment status (I do not store full card details — payments are processed by Shopify and its providers).
Communications: messages you send me by email, WhatsApp, contact form or social media.
Technical data: IP address, browser type, device, pages viewed, referring URL, and cookies (see Cookie Policy).

3. Why I process your data and legal basis

To fulfil your order (Art. 6(1)(b) GDPR — contract): processing orders, arranging delivery, handling returns and customer support.
To comply with the law (Art. 6(1)(c) GDPR): tax, accounting and consumer law obligations.
Legitimate interests (Art. 6(1)(f) GDPR): securing the Site, preventing fraud, basic analytics, and answering enquiries.
Consent (Art. 6(1)(a) GDPR): non-essential cookies, marketing emails and personalised offers. You can withdraw consent at any time.

4. Who I share data with

I only share what is necessary, with trusted processors bound by contracts:

Shopify Inc. — e-commerce platform and payment processing.
Couriers — to deliver your order.
Email/hosting providers — to operate the Site and contact you.
Tax authorities and regulators — where legally required.

5. International transfers

Some providers (e.g. Shopify) may process data outside the UK/EEA. Where that happens, I rely on adequacy decisions, the UK International Data Transfer Addendum or the EU Standard Contractual Clauses to ensure your data remains protected.

6. How long I keep your data

Order and accounting records: 6–10 years to meet tax obligations.
Marketing data: until you unsubscribe or 24 months of inactivity.
Support enquiries: up to 24 months after resolution.

7. Your rights

Under UK and EU GDPR you have the right to:

Access the personal data I hold about you.
Have inaccurate data corrected.
Have your data erased ("right to be forgotten").
Restrict or object to processing.
Receive your data in a portable format.
Withdraw consent at any time.
Lodge a complaint with a supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk); in the EU, your national data protection authority.

To exercise any right, email me at info@hlfithub.com. I respond within 30 days.

8. Security

The Site uses HTTPS encryption. Payments are processed via PCI-DSS compliant providers. I review access controls regularly and limit data access to what is strictly needed.

9. Children

The Site is not intended for children under 16. I do not knowingly collect their data.

10. Changes

I may update this policy from time to time. The "Last updated" date above will reflect any changes.