Last updated: 21 August 2026
1. Who we are
Elixir Garden Supplies Ltd (“Elixir”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal information.
Elixir Garden Supplies Ltd is a company registered in England and Wales under company number 08113994 and is part of the Origin Enterprises plc group of companies (“Origin Group”).
For the personal information covered by this Privacy Notice, Elixir Garden Supplies Ltd is the data controller, unless we tell you otherwise.
Registered office:
1–3 Freeman Court
Jarman Way
Orchard Road
Royston
Hertfordshire
SG8 5HW
United Kingdom
Trading address:
Unit 1 Middlegate
White Lund Industrial Estate
Morecambe
Lancashire
LA3 3BN
United Kingdom
Data protection enquiries:
[email protected]
This Privacy Notice explains how we collect, use, store and share personal information when you:
- visit or use our website
- place an order with us
- create or use a customer account
- contact our customer service team
- subscribe to or interact with our marketing
- provide a review or feedback
- interact with us through another sales channel or platform where your information is subsequently provided to Elixir
- otherwise deal with us as a customer, prospective customer, supplier or business contact
This notice should be read alongside our Cookie Policy and any other privacy information we provide at the point we collect personal information.
2. What personal information we collect
Depending on how you interact with us, we may collect and process the following categories of personal information.
Identity and contact information
This may include your:
- name
- billing and delivery address
- email address
- telephone number
- account username or other account identifier.
Order and transaction information
This may include:
- products you have purchased or enquired about
- order numbers
- order values
- delivery details
- returns, refunds and cancellations
- correspondence relating to orders
- records of previous transactions with us
Payment information
Payments are handled by third-party payment service providers.
Elixir does not receive or store your full payment card details.
We may receive limited payment-related information such as:
- the payment method used
- payment status
- transaction references
- information relating to refunds
Account and customer information
Where applicable, this may include:
- your account details
- order history
- saved preferences
- enquiries and customer service history
- feedback
- reviews
- preferences relating to communications from us
Technical and usage information
When you use our website, we may collect information such as:
- IP address
- browser type and version
- device type
- operating system
- website navigation and interactions
- pages viewed
- referral source
- date and time of visits
- information collected through cookies and similar technologies.
Please see our Cookie Policy for further information.
Marketing and communications information
This may include:
- whether you have agreed to receive marketing from us
- your communication preferences
- whether you have unsubscribed or objected to marketing
- information about your interaction with marketing communications, where legally permitted
Business contact information
If you deal with us on behalf of another organisation, we may process information including your:
- name
- business email address
- business telephone number
- job title
- employer or organisation
Special category information
We do not ordinarily need to collect special category personal information, such as information about your health, ethnicity, religion, political opinions or sexual orientation, and we do not ask customers to provide it to us. If we need to process special category personal information in an exceptional situation, we will only do so where there is an appropriate lawful basis and an additional legal condition permitting that processing.
3. How we collect your personal information
We may collect personal information in the following ways.
Directly from you
For example, when you:
- place an order
- create an account
- contact us
- complete a website form
- request information
- subscribe to marketing
- enter a promotion or competition
- provide feedback or a review
Automatically
When you use our website, certain technical and usage information may be collected automatically through cookies and similar technologies. Non-essential cookies and tracking technologies are used in accordance with applicable consent requirements. Please see our Cookie Policy and cookie preference controls for more information.
From third parties
Depending on the services you use and how you interact with us, we may receive information from:
- payment service providers
- delivery and logistics providers
- ecommerce and technology providers
- online sales platforms
- analytics providers
- advertising platforms
- email and customer communication providers
- customer review platforms
- fraud prevention or security providers
- companies within the Origin Group
Where appropriate, we may also obtain business contact information from publicly available sources such as Companies House. We will only use information obtained from third parties where we have a lawful basis to do so.
4. How and why we use your personal information
Under UK data protection law, we must have a lawful basis for processing your personal information. The lawful basis will depend on why we are using your information.
Processing orders and providing our services
We use personal information to:
- process and fulfil orders
- take and administer payments
- arrange delivery
- provide order updates
- process returns and refunds
- administer warranties
- respond to questions about your order
Lawful basis: performance of our contract with you and, where relevant, compliance with legal obligations.
Customer service
We use personal information to:
- respond to enquiries
- resolve complaints
- investigate missing or damaged deliveries
- manage product or service issues
- maintain appropriate records of our communications
Lawful basis: performance of our contract with you and/or our legitimate interests in providing effective customer service and managing our business.
Operating and securing our website and systems
We may use personal information to:
- operate our website
- maintain system security
- prevent unauthorised access
- detect fraud or misuse
- diagnose technical problems
- protect our business, customers and systems
Lawful basis: our legitimate interests in operating a secure and effective business and, where applicable, compliance with legal obligations.
Understanding and improving our business
We may analyse information to:
- understand how customers use our website
- understand product and customer trends
- assess the effectiveness of our services
- improve our website, products and customer experience
- support business planning
Where this involves non-essential cookies or similar tracking technologies, we will obtain consent where required.
Lawful basis: consent where required and/or our legitimate interests in understanding and improving our business where such processing is permitted without consent.
Reviews and feedback
We may contact customers to request feedback or reviews and may use third-party review platforms to help us manage this process.
Lawful basis: our legitimate interests in understanding customer experience and improving our products and services, subject to applicable electronic marketing and communications rules.
Marketing
We may use your information to tell you about Elixir products, promotions, offers and other information we think may be relevant to you.
Please see section 5 below.
Legal, regulatory and business administration
We may process information where necessary to:
- comply with legal, tax, accounting or regulatory obligations
- establish, exercise or defend legal claims
- respond to regulators, courts or law enforcement bodies
- maintain business and financial records
- prevent or investigate fraud
- obtain professional advice
- support corporate administration, restructuring, acquisition or sale activity
Lawful basis: compliance with legal obligations and/or our legitimate interests in properly administering and protecting our business.
Origin Group administration
As a member of the Origin Group, we may process and share personal information within the Group where reasonably necessary for matters such as:
- finance
- audit
- legal and compliance
- information technology
- information security
- management reporting
- business administration
- other legitimate Group operational requirements
Lawful basis: our legitimate interests and those of the Origin Group in operating, administering and protecting the Group, and compliance with legal obligations where applicable. We will only share personal information within the Group where there is an appropriate purpose and lawful basis for doing so.
5. Marketing communications
We may send you direct marketing about our products and services where the law allows us to do so. For electronic marketing such as email, we will normally do this where:
- you have given us consent
- you are an existing customer and the applicable “soft opt-in” rules allow us to contact you about our own similar products or services
Where we rely on the soft opt-in, you will have been given an opportunity to opt out when your contact information was collected and will be given an easy way to opt out in every subsequent marketing communication. We may also send marketing communications to corporate business contacts where permitted by law. You can unsubscribe from marketing at any time by:
- using the unsubscribe link in our marketing communications; or
- contacting us at [email protected].
Opting out of marketing will not prevent us from sending communications that are necessary for an order, account, customer service matter or other transaction.
Marketing analytics and tracking
Our marketing communications may use technologies that allow us to understand whether and how communications have been interacted with, for example whether an email has been opened or a link selected. We will only use such technologies where permitted by applicable data protection and electronic communications law and, where consent is required, after appropriate consent has been obtained. We will not share your personal information with an unrelated third party for that third party’s own direct marketing purposes unless you have specifically agreed to this.
6. Cookies and similar technologies
Our website uses cookies and similar technologies for purposes including:
- providing essential website functionality
- maintaining security
- remembering preferences
- measuring website use and performance
- where you agree, analytics, advertising and marketing purposes
Where consent is legally required, non-essential cookies and similar technologies will not be used unless you have made the appropriate choice through our consent controls. You can accept, reject or change your preferences using the cookie controls available on our website. Further information about the technologies we use, their purposes and relevant providers is available in our Cookie Policy.
7. Who we share personal information with
We may share personal information where necessary with the following categories of recipient:
- companies within the Origin Group
- payment service providers and banks
- ecommerce, website hosting, cloud and IT service providers
- delivery, courier, warehouse and logistics providers
- customer service and communications providers
- marketing and email service providers
- analytics and advertising providers, subject to applicable consent requirements
- review and feedback platforms
- fraud prevention, cybersecurity and verification providers
- professional advisers including lawyers, auditors, accountants, insurers and bankers
- regulators, public authorities, law enforcement agencies or courts where required by law
- prospective purchasers, sellers, investors or advisers in connection with a sale, purchase, restructuring or transfer of all or part of our business
Where another organisation processes personal information on our behalf, we require appropriate contractual and security protections. Some organisations, such as payment providers, marketplaces or social media platforms, may process personal information as independent data controllers for their own purposes. Their use of your information will also be governed by their own privacy information.
8. International transfers
Some of the organisations that provide services to Elixir or the Origin Group may store or process personal information outside the United Kingdom. Where this results in a restricted transfer of personal information under UK data protection law, we will ensure that an appropriate legal mechanism and safeguards are in place. Depending on the circumstances, these may include:
- transferring information to a country covered by UK adequacy regulations
- using an approved International Data Transfer Agreement
- using the UK Addendum to approved EU Standard Contractual Clauses
- where applicable, transferring information to an eligible US organisation participating in the UK Extension to the EU-US Data Privacy Framework
- relying on another legally permitted safeguard or exception
Where required, we will also carry out an appropriate assessment of the protections applying to the transfer. You can contact us if you would like further information about the safeguards used for international transfers relevant to your personal information.
9. Data security
We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful:
- loss
- destruction
- alteration
- unauthorised disclosure
- unauthorised access
Access to personal information is restricted to employees, contractors and service providers who have an appropriate business need to access it. People handling personal information on our behalf are required to treat it confidentially and securely. We maintain procedures for identifying, investigating and responding to suspected personal data breaches and will notify affected individuals and the relevant regulator where the law requires us to do so.
10. How long we keep your information
We do not keep personal information for longer than is reasonably necessary for the purpose for which it was collected. The appropriate retention period depends on factors including:
- why we collected the information
- the nature and sensitivity of the information
- applicable legal, regulatory, tax and accounting requirements
- whether the information may be needed to establish, exercise or defend legal claims
- the requirements of the Origin Group’s applicable record-retention policies
For example, records relating to orders and financial transactions will generally be retained for the period necessary to comply with tax, accounting and legal record-keeping obligations, which will commonly include a period of approximately six years. We may retain limited information about marketing preferences for longer where necessary to ensure that we continue to respect an opt-out or objection. Where appropriate, information may be securely deleted or anonymised so that it can no longer identify an individual.
11. Your data protection rights
Depending on the circumstances, UK data protection law gives you a number of rights in relation to your personal information.
Access your personal information
You can ask us for a copy of personal information we hold about you and information about how we use it.
Correct inaccurate information
You can ask us to correct personal information that is inaccurate or complete information that is incomplete.
Request deletion
In certain circumstances, you can ask us to delete your personal information.
Restrict processing
In certain circumstances, you can ask us to restrict how we use your personal information.
Object to processing
You may have the right to object where we process your personal information on the basis of legitimate interests.
You also have the right to object at any time to the use of your personal information for direct marketing.
Data portability
In certain circumstances, you can ask us to provide personal information you supplied to us in a structured, commonly used and machine-readable format or to transfer it to another organisation.
Withdraw consent
Where we rely on your consent, you can withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing that took place before consent was withdrawn.
Rights relating to automated decision-making
You have certain rights where decisions with legal or similarly significant effects are made about you solely through automated processing. We do not currently carry out solely automated decision-making about customers that produces legal or similarly significant effects.
Exercising your rights
You can exercise your rights by contacting us at: [email protected]
We may need to ask for information to confirm your identity before fulfilling a request. This helps us prevent personal information being disclosed to someone who is not entitled to receive it. You will not normally have to pay a fee to exercise your rights. In circumstances permitted by law, we may charge a reasonable fee or decline to act on a request that is manifestly unfounded or excessive.
12. Data protection complaints
If you have a concern about how we have collected or used your personal information, you can make a data protection complaint to us by contacting: [email protected]
We will:
- provide a clear way for you to submit your complaint
- acknowledge your complaint within 30 days
- take appropriate steps to investigate it without undue delay
- keep you appropriately informed about its progress
- tell you the outcome of our investigation
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator. Making a complaint to us first does not affect your right to complain to the ICO.
13. Third-party websites and social media
Our website may contain links to websites, services or social media platforms operated by other organisations. Those organisations may collect and use personal information independently of Elixir. We do not control their privacy practices and recommend that you read their privacy information before providing personal information to them. Where you interact with Elixir through a third-party social media platform, that platform may also process information about you in accordance with its own privacy terms.
14. Changes to this Privacy Notice
We keep this Privacy Notice under review and may update it where our processing activities, systems, suppliers, corporate arrangements or legal obligations change. The date at the beginning of this notice shows when it was most recently updated. Where a change materially affects how we use personal information, we will take reasonable steps to bring the change to the attention of affected individuals where appropriate.
15. Contact us
If you have any questions about this Privacy Notice, how we use your personal information, or wish to exercise any of your data protection rights, please contact:
Elixir Garden Supplies Ltd
Unit 1, Middlegate
White Lund Industrial Estate
Morecambe
Lancashire
LA3 3BN
United Kingdom
Email: [email protected]
