Privacy Notice (UK GDPR & PECR)

Last updated: 25/09/2026

This privacy notice explains how Crestwel UK Limited (“we”, “us”, “our”) collects, uses and protects your personal data when you use our website , buy our products or services, or contact us. It also explains your rights and how to exercise them.

1. Who we are

Crestwel UK Limited is the controller of your personal data. This means we decide how and why it is used.

If you have any questions about this notice or how we handle your data, contact us using the details above.

2. The personal data we collect

We collect only the data we need for the purposes set out in section 3.

Where we get it from

• You directly — when you fill in a form, create an account, buy from us, contact us or subscribe to updates.
• Automatically — through cookies and similar technologies when you use our website (see section 5).
• Third parties — payment providers, delivery partners, analytics providers, publicly available sources such as Companies House.

If you do not provide data we need to fulfil a contract or meet a legal requirement, we may not be able to provide our services to you. We will tell you when this is the case.

3. How we use your data and our lawful bases

UK data protection law requires us to have a lawful basis for each use of your personal data. Here is what we do and why.

Legitimate interests. Where we rely on legitimate interests, we have weighed our interests against your rights and concluded they are not overridden. You can ask us for details of this assessment, and you have the right to object (section 8).

Consent. Where we rely on consent, you can withdraw it at any time. This does not affect processing already carried out.

Special category data. We process health data only with your explicit consent, and we have an appropriate policy document in place. O

New purposes. If we want to use your data for a purpose not listed here, we will check it is compatible with the original purpose or ask for your consent, and update this notice.

4. Direct marketing

We will only send you marketing emails or texts if you have agreed to receive them, or if the “soft opt-in” applies.

• Consent. If you tick a box or otherwise actively agree to hear from us, we will send you newsletters / offers / event news by email  and/or SMS.
• Soft opt-in. If you have bought from us, or started to buy, we may email and/or SMS you about our similar products and services. We will always give you a chance to opt out when we collect your details and in every message we send.
• Phone calls and post. We may call you about similar products unless you tell us not to, and we screen numbers against the Telephone Preference Service. We do not use post for marketing.

Opting out. You can stop marketing at any time, free of charge, by clicking “unsubscribe” in any email, replying STOP to a text, or contacting us at [privacy email]. We will keep a record of your opt-out so we don’t contact you again.

We do not sell your data, and we do not share it with other organisations for their own marketing unless you have specifically consented.

5. Cookies and similar technologies

We use cookies, pixels and similar technologies on our website. Some are needed for the site to work or are exempt from consent; others we only use if you agree.

You can change your choices or object to exempt cookies at any time through Cookie Policy, or by blocking cookies in your browser.

Where a cookie collects personal data (for example, an online identifier), we process that data on the lawful basis shown in section 3.

6. Who we share your data with

We share personal data only where necessary, and our service providers may use it only on our instructions under a written contract.

Call tracking. When you phone us from our website or our Google Business Profile, your call may be connected through a tracking number provided by CallRail. This records the date, time and length of the call, the number you called from, and how you found us (for example, a Google search). Calls are not recorded. On our website, call tracking only runs if you accept statistics cookies. We rely on our legitimate interests to understand how patients find us. CallRail processes this data on our behalf under a data processing agreement, and transfers to the USA are protected as described below.

International transfers. Some of our providers are based, or store data, outside the UK e.g. in the EU and the United States or India. When we transfer data abroad we make sure it is protected by one of the following: the destination is recognised by the UK as providing adequate protection (including the EU, and US companies certified under the UK Extension to the EU-US Data Privacy Framework); or we use the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Contact us for a copy of the relevant safeguards.

7. How long we keep your data and how we protect it

We keep personal data only as long as we need it for the purpose we collected it, then delete or anonymise it.

Security. We use appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, access controls, multi-factor authentication, staff training and regular reviews. If a personal data breach is likely to result in a high risk to you, we will tell you without undue delay.

8. Your rights

You have the following rights over your personal data. Exercising them is free in most cases.

• Access — ask for a copy of the data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your data in certain circumstances.
• Restriction — ask us to limit how we use your data.
• Portability — ask us to send data you gave us to you or another organisation in a machine-readable format, where we rely on consent or contract.
• Object — object to processing based on legitimate interests, and to direct marketing at any time (we will always stop marketing).
• Withdraw consent — at any time, where we rely on consent.
• Automated decisions — We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

To exercise a right, contact [privacy email]. We may need to verify your identity. We will respond within one month, which may be extended by up to two months for complex requests; we will tell you if so. We will make reasonable and proportionate searches when responding to access requests.

9. How to complain

If you are unhappy with how we have handled your data, please complain to us first so we can put it right.

• Email office.crestwelmedical@gmail.com  or write to Crestwel UK Limited, 12 New Road, Hanworth, TW13 6TQ, marked “Data protection complaint”.
• We will acknowledge your complaint within 30 days and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

10. Children

Our services are not aimed at children under 13 and we do not knowingly collect their data.

11. Changes to this notice

We review this notice regularly. If we make significant changes, we will tell you with a notice on our website before they take effect. The date at the top shows when it was last updated.