Last updated: 28 October 2026
This policy explains what personal data is processed when you visit aloevera-shop.co.uk, why, on what legal basis and for how long, who receives it and what rights you have. It is our privacy notice under Articles 13 and 14 of the UK General Data Protection Regulation (UK GDPR), read together with the Data Protection Act 2018. Where we store or read information on your device, the Privacy and Electronic Communications Regulations 2003 (PECR) also apply.
In short: this is an information site. You cannot create an account, leave comments, sign up to a newsletter or buy anything here. We collect as little as we can, Google Analytics only runs if you switch it on, and if you send us a message through our contact form, we use it only to reply to you.
1. Who is responsible for your data
The controller for the processing described in this policy is:
Matsanov Grup OOD
limited liability company under Bulgarian law (OOD)
24 Belitsa Street
4001 Plovdiv
Bulgaria
Managing director: Angel Macanov
Registered in the Commercial Register and Register of Non-Profit Legal Entities of the Republic of Bulgaria (Registry Agency), UIC (ЕИК): 204607569
VAT number: BG204607569
Email: office@aloevera-shop.co.uk
The site is written and run by Angel Matsanov and Nikoleta Genova, independent partners of LR Health & Beauty. We are not LR Health & Beauty and this is not the official LR shop.
We have not appointed a data protection officer, as we are not required to: we do not monitor people on a large scale and we do not process special category data. For any question about your data, please write to the email address above.
2. Overview
| Processing | Purpose | Legal basis (UK GDPR) |
|---|---|---|
| Hosting and server log files | Delivering the site, finding faults, security | Article 6(1)(f), legitimate interests |
| Cloudflare | Fast delivery, DNS, protection against attacks | Article 6(1)(f), legitimate interests |
| Cookie banner and consent record | Recording and proving your cookie choice | Article 6(1)(c) with Article 7(1), and Article 6(1)(f) |
| Google Analytics 4 | Usage statistics, including clicks to LR | Article 6(1)(a), consent; PECR regulation 6 |
| Our own click counter | Seeing which pages help readers | Article 6(1)(f), legitimate interests |
| Contact form and emails you send us | Answering your enquiry | Article 6(1)(b) or (f) |
| Spam protection for the contact form (IP hash, 60 seconds) | Preventing automated and repeated submissions | Article 6(1)(f), legitimate interests |
3. Data processed when you visit the site
3.1 Hosting
The site is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (telephone +49 (0)9831 505-0), on servers in Falkenstein, Germany. Hetzner acts as our processor under a data processing agreement in line with Article 28 UK GDPR and processes data only on our instructions and only so that the site can be delivered to you.
3.2 Server log files
Each time a page is requested, the server records technical information: your IP address, the date and time, the page requested, your browser and the referring page. We need this to run the site and keep it secure, for example to find faults and to detect and fend off attacks. Log files are deleted after six weeks at the latest, unless a specific entry is needed to investigate a security incident.
Legal basis: Article 6(1)(f) UK GDPR. Our legitimate interest is the secure and reliable operation of the site.
3.3 Cloudflare
We use Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, as a content delivery network, DNS provider and security proxy. Your requests to our site pass through Cloudflare, which processes your IP address and technical request data in order to deliver the site and protect it against attacks. Cloudflare acts as our processor under a data processing agreement. This may involve a transfer of data to the USA (see section 7).
Legal basis: Article 6(1)(f) UK GDPR. Our legitimate interest is a fast, stable and secure website.
3.4 Fonts
All fonts are loaded from our own server. Your browser does not connect to Google Fonts or any other font service when you visit us.
4. Cookie banner and consent record
We use the cookie banner CookieAdmin to ask for your choice before any optional cookie is set. Your decision is stored in the cookie cookieadmin_consent for up to 12 months, so that we do not ask you again on every page and can show that you gave or refused consent, as Article 7(1) UK GDPR requires us to be able to do. This cookie is strictly necessary and therefore does not need consent under PECR.
Legal basis: Article 6(1)(c) UK GDPR together with Article 7(1), and Article 6(1)(f), our legitimate interest being to manage consent properly.
5. Google Analytics 4 (only with your consent)
If, and only if, you agree to “analytics” in our cookie banner, we load Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may also be processed by Google LLC in the USA. Before you consent, the Analytics code is not loaded at all: your browser makes no connection to Google and no data is sent to Google.
Once you have consented, Analytics tells us how the site is used, for example which pages are read and how visitors move between them. In particular, we measure clicks on the buttons that lead to the LR shop (an event called lr_outbound_click, recorded with the product name and the page). The cookies _ga and _ga_[ID] are set, each for up to two years; details are in our cookie policy.
Our settings:
- According to Google, Google Analytics 4 does not log or store IP addresses.
- Event data is kept in Analytics for the retention period set in our property, at most 14 months, and is then deleted automatically.
- Google Signals is switched off, and Analytics is not linked to any advertising product, so the data is not used for advertising to you.
Legal basis: your consent under Article 6(1)(a) UK GDPR and, for storing and reading information on your device, regulation 6 PECR. You can withdraw your consent at any time through the cookie settings link or icon shown on every page. Withdrawing does not affect the lawfulness of processing carried out before you withdrew.
6. Clicks on the buttons to LR
6.1 Our own click counter
When you click a button that takes you to the LR shop, our site records the time, the product, which of our two partner codes was used and the page on our site where the click happened. We do not record your IP address or any identifier, and nothing is stored on your device for this. We keep these records for 365 days and use them to see which pages are helpful to readers. Because the records cannot be linked to you, we do not expect them to be personal data; to the extent they are, we rely on Article 6(1)(f) UK GDPR, our legitimate interest being to improve our content.
6.2 Which partner code is used
We are two LR partners, Angel Matsanov and Nikoleta Genova, each with our own partner code. The buy buttons alternate between the two codes: each click simply uses the next one in turn. No cookie or other information is stored on your device for this, and the choice does not depend on anything we know about you.
6.3 Once you are in the LR shop
When you follow a button, you leave our site. From that point the LR Health & Beauty company that operates the LR shop for Great Britain processes your data as an independent controller under its own privacy policy, which you can find in the LR shop (“privacy policy in the LR shop”). That covers everything to do with an order or a registration: your contact details, payment, delivery and customer service. We do not receive your order data and have no access to your LR customer account. What LR tells us as partners about orders placed through our codes is governed by LR’s own privacy policy.
7. Who receives data, and transfers outside the UK
We share data only as described above:
- Hetzner Online GmbH (Germany), our hosting provider, as processor;
- Cloudflare, Inc. (USA), our CDN and security provider, as processor;
- our email hosting provider in Bulgaria, which hosts our mailbox, including messages sent through the contact form, as processor;
- Google Ireland Limited and Google LLC, for analytics, and only if you have consented.
Our company is based in Bulgaria and our servers are in Germany, both in the European Economic Area. UK data protection law allows personal data to flow from the UK to the EEA under the UK’s adequacy regulations. Transfers to the USA may take place through Cloudflare and Google. Both are certified under the EU-US Data Privacy Framework and its UK Extension (the “UK-US data bridge”), which is the safeguard we rely on for those transfers.
We do not sell personal data and we do not share it for advertising.
8. Contacting us
8.1 Contact form
What we process. When you send a message through the form on our contact page, we receive your name, your email address, the text of your message and the date and time of sending.
Spam protection. At the moment you send the form, our server calculates a one-way hash of your IP address, that is, a non-reversible code derived from it. The hash is kept in temporary storage for 60 seconds and then deleted automatically. Its only purpose is to limit repeated sending from the same connection. Your IP address is not saved together with your message.
Purpose. We use your details solely to answer your enquiry. They are not used for marketing, you are not added to any newsletter or mailing list, and we do not disclose your message to LR Health & Beauty or to any other third party, except where we are legally required to.
Where it is stored. Your message is saved in our website database on our servers at Hetzner in Germany (section 3.1) and forwarded by email to our mailbox, which is hosted by our email hosting provider in Bulgaria. Both providers act as our processors under Article 28 UK GDPR.
How long. Messages are deleted automatically from the website database at the latest 12 months after receipt, and we remove them from our mailbox within the same period. If you ask us to, we delete them earlier, unless a longer retention period is required by law or the message is needed to establish, exercise or defend legal claims.
Legal basis: Article 6(1)(b) UK GDPR where your enquiry relates to a contract or to steps taken at your request before entering into a contract; in all other cases Article 6(1)(f) UK GDPR, our legitimate interest being to respond to the enquiries we receive. The temporary IP hash is based on Article 6(1)(f) UK GDPR, our legitimate interest being to protect the form against spam and misuse. You have the right to object to processing based on legitimate interests (Article 21 UK GDPR).
Is it required? No. Using the form is entirely voluntary and you are under no statutory or contractual obligation to provide your details. We do, however, need your name, email address and message in order to reply.
8.2 Email
If you write to us by email, we process your email address, your name if you give it, and the content of your message, solely to deal with your enquiry. We delete the correspondence once it is no longer needed, unless we must keep it to meet a legal obligation or to establish or defend legal claims.
Legal basis: Article 6(1)(b) UK GDPR where your enquiry relates to a contract or steps before one, otherwise Article 6(1)(f), our legitimate interest being to answer the messages we receive.
9. How long we keep data
| Data | Retention |
|---|---|
| Server log files | At most six weeks |
| Cookie choice (cookieadmin_consent) | Up to 12 months |
| Google Analytics cookies (_ga, _ga_[ID]) | Up to two years, only with consent |
| Google Analytics event data | At most 14 months, only with consent |
| Click counter records | 365 days |
| Contact form messages | Deleted automatically at the latest 12 months after receipt, earlier on request, unless the law requires us to keep them longer |
| IP hash used for contact form spam protection | 60 seconds |
| Emails | Until your enquiry has been dealt with, unless the law requires us to keep them longer |
10. What we do not do
- There are no user accounts, comments, newsletter, shop or payments on this site. Messages sent through our contact form are used only to reply to you.
- We do not make decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you (Article 22 UK GDPR).
- WordPress may set cookies (wordpress_*, wp-settings-*) only for site administrators who are logged in, never for visitors.
You are not under any legal or contractual obligation to give us personal data. If you choose to contact us, we need your name, email address and message to reply. If you block our servers from receiving your IP address, however, the site cannot be delivered to you.
11. Your rights
Under the UK GDPR you have the right to:
- access the personal data we hold about you (Article 15);
- have inaccurate data corrected (Article 16);
- have your data erased (Article 17);
- restrict processing (Article 18);
- receive data you gave us in a portable format (Article 20);
- object at any time to processing based on our legitimate interests, on grounds relating to your particular situation (Article 21);
- withdraw your consent at any time, with effect for the future (Article 7(3)).
To exercise any of these rights, email us using the details in section 1. We will respond within one month, as the UK GDPR requires, and may ask you to confirm your identity first.
Complaints
If you think we have handled your data unlawfully, you have the right to complain to the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, www.ico.org.uk. As our company is based in Bulgaria, you can also contact the Bulgarian Commission for Personal Data Protection (Komisia za zashtita na lichnite danni), 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia. We would welcome the chance to put things right first, so please feel free to contact us before you complain.
12. Children
This site is not directed at children. In the UK, children under 13 cannot themselves give consent to online services such as our analytics; we do not knowingly process personal data of children under 13.
13. Changes to this policy
We will update this policy whenever the site, our providers or the law changes. The date at the top shows the current version.
See also: Cookie policy · Terms of use · How this site is funded