1.1 This Privacy Policy explains how Salamander Limited, trading as Soluna, collects, uses, and protects your personal data when you use our website.

1.2 We are committed to protecting your privacy and handling your personal data in accordance with applicable data protection laws, including the UK GDPR, the EU General Data Protection Regulation (GDPR) where applicable, and the Gibraltar Data Protection Act 2004.

1.3 This policy explains what personal data we collect, how we use it, who we share it with, how long we retain it, and your rights regarding your personal data.

1.4 If you have any questions about this policy or how we handle your data, you may contact us using the details provided below.

2.1 The data controller responsible for your personal data is:

Salamander Limited

5 City Mill Lane
GX11 1AA
Gibraltar

Email: privacy@thehealthstores.com
Website: www.mysoluna.com

3.1 When you use our website or place an order with us, we may collect the following information:

3.2 Information you provide directly

• Full name
• Billing address
• Shipping address
• Email address
• Phone number
• Account login information (if you create an account)

3.3 Order and transaction information

When you make a purchase we collect information necessary to process your order including:

• Products purchased
• Order history
• Delivery information

Payment card details are not stored by Salamander Limited. Payments are securely processed by our payment provider.

3.4 Technical data

When you visit our website we may automatically collect certain technical information including:

• IP address
• Browser type
• Device information
• Website usage information
• Cookies and similar technologies

This information helps us operate and improve our website.

4.1 We process personal data for the following purposes:

Order fulfilment

To process and deliver orders placed through our website.

Customer account management

To create and manage customer accounts where users choose to register.

Customer service

To respond to enquiries and provide support related to your orders or account.

Website operation and improvement

To maintain and improve the functionality and security of our website.

Legal compliance

To comply with accounting, tax, and other legal obligations.

Marketing communications

Where you have opted in, we may send you marketing communications about our products or promotions. You may unsubscribe at any time.

5.1 Under the GDPR, we rely on the following legal bases when processing personal data:

Contractual necessity

Processing is necessary in order to fulfil orders and provide services requested by you.

Legal obligations

Processing is required to comply with legal or regulatory obligations.

Legitimate interests

Processing may be necessary to operate and improve our website and services.

Consent

Where required by law, we rely on your consent, particularly for marketing communications and certain cookies.

6.1 Payments made on our website are processed securely by our payment provider:

myPOS

6.2 Payment information is transmitted directly to the payment provider and is not stored by Salamander Limited.

6.3 Please refer to the payment provider’s privacy policy for further information on how they process payment data.

7.1 To deliver your orders, we may share necessary delivery information with courier or delivery services.

7.2 Currently orders may be delivered directly by us or we may use third-party courier services such as:

• DHL

7.3 Only information required to complete delivery (such as name, delivery address, and contact details) will be shared.

8.1 Our website is hosted by Hostinger.

8.2 Hosting providers may process technical data such as IP addresses and server logs in order to maintain website performance and security.

9.1 Our website uses cookies and similar technologies to ensure proper website functionality and improve the user experience.

9.2 Cookies may be used for:

• Essential website functionality
• Shopping cart and checkout operations
• Website security
• Performance monitoring and analytics

9.3 Where required by law, we will obtain your consent before placing non-essential cookies.

9.4 You can manage cookie preferences through your browser settings or through our website’s cookie consent tool.

10.1 We retain personal data only for as long as necessary for the purposes outlined in this policy.

10.2 Typical retention periods include:

Order records: up to 6 years for accounting and tax purposes.

Customer accounts: retained until the account is deleted.

Marketing communications: retained until you unsubscribe or withdraw consent.

Technical website data: retained for short periods necessary for security and operational purposes.

11.1 We take appropriate technical and organisational measures to protect personal data from unauthorised access, misuse, loss, or disclosure.

11.2 These measures include:

• Secure HTTPS encryption
• Restricted access to customer information
• Secure payment processing through trusted third-party providers

11.3 While we take reasonable precautions, no system can guarantee absolute security of data transmitted via the internet.

12.1 Some service providers used to operate our website may process personal data outside Gibraltar, the UK, or the European Economic Area.

12.2 Where such transfers occur, appropriate safeguards are implemented to ensure personal data remains protected in accordance with applicable data protection laws.

13.1 Our website and services are not intended for individuals under the age of 18.

13.2 While we may sell products intended for children, purchases must be made by adults.

13.3 We do not knowingly collect personal data from children.

14.1 Under applicable data protection laws, you may have the following rights:

• The right to access your personal data
• The right to correct inaccurate information
• The right to request deletion of your data
• The right to restrict processing
• The right to object to processing
• The right to data portability
• The right to withdraw consent where processing is based on consent

14.2 Requests relating to your personal data can be made by contacting:

privacy@thehealthstores.com

15.1 If you believe your personal data has been processed unlawfully, you have the right to lodge a complaint with the relevant supervisory authority.

15.2 In Gibraltar, the supervisory authority is:

Gibraltar Regulatory Authority (GRA)

https://www.gra.gi

16.1 We may update this Privacy Policy from time to time to reflect changes in legal requirements or our services.

16.2 Updated versions will be published on this page and the “Last updated” date will be revised accordingly.