Food supplement. Not a medicine. Sold by Graltov Health Ltd, Cardiff, UK. · Disclaimer
Editorial health information. Not a substitute for professional medical advice. | Graltov · Cardiff, United Kingdom
029 2194 6111
Privacy · updated 9 September 2026

Privacy Policy

This policy explains how Graltov Health Ltd handles information connected with graltov.info.

1. Scope

This policy applies to visitors, newsletter subscribers and people who contact Graltov. It covers information collected through the website, forms, email and ordinary server logs. It does not govern third-party sites linked from our pages. The data controller is Graltov Health Ltd, 22 St Mary Street, Cardiff CF10 1AA.

2. Information collected

We may receive an email address when a visitor joins the newsletter and a name, email address and message when someone uses the contact form. Basic technical information such as browser type, approximate location, requested page and timestamp may appear in server logs. We do not ask readers to submit sensitive personal information.

3. Lawful basis

We use consent for optional newsletter messages and non-essential cookies. We use legitimate interests for site security, basic administration and responding to enquiries. We use contractual necessity only where it is relevant to a direct request for a service. Consent can be withdrawn by contacting [email protected].

4. Retention

Newsletter details are retained until unsubscribe or twelve months after the last meaningful engagement, whichever comes first. Contact correspondence is normally retained for twenty-four months after closure. Security logs are generally retained for up to ninety days. Records needed for legal obligations may be held for the relevant statutory period.

5. Sharing

Information may be handled by hosting, email delivery, form processing and security providers acting under written instructions. We do not sell personal information. Providers receive only the information required for their task and are expected to maintain suitable safeguards.

6. International transfers

Some technology providers may process information outside the United Kingdom. Where that occurs, Graltov relies on an adequacy decision, approved contractual safeguards or another lawful transfer mechanism. Details can be requested from the contact address.

7. Your rights

Subject to legal limits, you may request access, correction, deletion, restriction, portability or objection. You may also withdraw consent for optional processing. Requests should include enough information for us to identify the relevant record and will normally receive a response within one month.

8. Cookies

Session cookies may last until a browser closes, analytics cookies may last up to thirteen months where enabled, and preference cookies may last up to twelve months. The cookie banner records a consent choice for up to twelve months. Further detail is available in the Cookie Policy.

9. Security

We use access controls, encrypted connections and limited retention to reduce avoidable exposure. No internet service can promise absolute security. If we become aware of a qualifying incident, we will follow applicable reporting and communication duties.

10. Complaints

Please contact [email protected] first so the desk can review the concern. You may also contact the Information Commissioner’s Office in the United Kingdom if you remain dissatisfied. The ICO website provides current complaint routes and guidance.

11. Children

Graltov is written for adults and does not knowingly collect information from children. If a parent or guardian believes a child has submitted information, contact the desk so it can be assessed and removed where appropriate.

12. Changes

Revision history: 1 January 2026, policy published; 9 September 2026, retention wording and contact procedure reviewed. Material changes will be shown on this page with a new date. Continued use after an update means the revised notice is available to read.

8. International transfers

Some service providers supporting hosting, email delivery, security or embedded content may process information outside the United Kingdom. Where that occurs, Graltov expects the relevant provider to use a lawful transfer mechanism recognised under UK data protection law. This may include UK adequacy regulations, approved contractual protections or another permitted safeguard. Information is shared only to the extent needed for the stated service.

9. Rights and requests

Subject to legal limits, a person may ask for access to their personal information, correction of inaccurate information, deletion, restriction of processing or a portable copy. A person may also object to processing based on legitimate interests and may withdraw consent for optional messages. Requests should be sent to [email protected] with the page or service involved and enough information to verify identity. Graltov aims to acknowledge a request within five working days and normally responds within one calendar month.

Additional time may be needed where a request is complex or multiple requests are made, and the requester will be told if an extension is required. We may ask for proportionate identity information to prevent disclosure to the wrong person. If a request is refused, the reason and available complaint route will be explained. A complaint can be made to the Information Commissioner’s Office at ico.org.uk.

10. Data protection reviews and changes

Graltov considers privacy risks when introducing a new form, analytics setting or third-party service. A Data Protection Impact Assessment may be completed where processing is likely to create a high risk to individuals. The assessment considers purpose, necessity, proportionality, safeguards and the practical effect on readers. It is reviewed when the relevant processing changes materially.

This policy was reviewed on 9 September 2026. A future change log may record the date, the affected section and a plain-language description of the amendment. Material changes will be presented on this page before they take effect where that is reasonably practicable. The current version should be used when assessing how graltov.info handles information.

11. Data incidents

If Graltov becomes aware of a personal data incident, the team will assess its nature, scope and likely effect. Where required by law, a report will be made to the Information Commissioner’s Office without undue delay and, where feasible, within seventy-two hours of becoming aware of a reportable breach. Affected people may be contacted where the law requires or where communication is appropriate to reduce potential harm. The response will include containment, investigation and steps intended to prevent recurrence.

Concerns about an incident can be sent to [email protected] or by post to 22 St Mary Street, Cardiff CF10 1AA. Please do not send passwords or unnecessary sensitive information in an initial message. The team aims to acknowledge incident-related correspondence within one working day where practical.

8. International transfers

Some providers supporting hosting, email delivery, security, maps or form handling may process information outside the United Kingdom. Where this occurs, Graltov expects the provider to use a lawful transfer mechanism recognised under UK data protection law. This may include UK adequacy regulations, the UK International Data Transfer Addendum or another permitted safeguard. Information is shared only to the extent necessary for the relevant service.

9. Individual rights

Subject to legal limits, a person may request access to personal information, correction of inaccurate information, deletion, restriction of processing or a portable copy. A person may also object to processing based on legitimate interests and may withdraw consent for optional messages. Requests should be sent to [email protected] with the relevant page or service and enough detail to verify identity. Graltov aims to acknowledge a request within five working days and normally responds within one calendar month.

Additional time may be required where a request is complex or multiple requests are made, and the requester will be told if an extension applies. Proportionate identity information may be requested to prevent disclosure to the wrong person. If a request cannot be fulfilled, the reason and available complaint route will be explained. A concern may be raised with the Information Commissioner’s Office through ico.org.uk.

10. Sub-processors and privacy reviews

Service providers may act as sub-processors for hosting, email delivery, form routing, security monitoring, analytics or embedded maps. Examples may include a hosting provider, a transactional email provider, a form service and Google Maps when the contact map is loaded. The exact provider may change when Graltov improves reliability, security or cost, and any replacement will be assessed before use. Providers are expected to process information only for documented purposes and to maintain suitable confidentiality and security measures.

Graltov considers privacy risks when introducing a new form, analytics setting or third-party service. A Data Protection Impact Assessment may be completed where processing is likely to create a high risk to individuals. The assessment considers purpose, necessity, proportionality, retention, access controls and the practical effect on readers. It is reviewed when the relevant processing changes materially.

11. Data incidents and notification

If Graltov becomes aware of a personal data incident, the team will assess its nature, scope and likely effect. Where required by law, a report will be made to the Information Commissioner’s Office without undue delay and, where feasible, within seventy-two hours of becoming aware of a reportable breach. Affected people may be contacted where the law requires or where communication is appropriate to reduce potential harm. The response will include containment, investigation and steps intended to prevent recurrence.

Concerns about an incident can be sent to [email protected] or by post to 22 St Mary Street, Cardiff CF10 1AA. Please do not send passwords or unnecessary sensitive information in an initial message. The team aims to acknowledge incident-related correspondence within one working day where practical and will keep a written record of material decisions.

12. Automated decisions and policy history

Graltov does not use this website to make solely automated decisions that produce legal or similarly significant effects on readers. Newsletter delivery and basic site administration may involve routine software rules, but those functions do not assess a person’s eligibility, character or entitlement. If a future service changes this position, the relevant explanation and rights information will be added before that processing begins. Readers can contact [email protected] with questions about a particular automated process.

This policy was reviewed on 9 September 2026. Future revisions may record the date, affected section and a plain-language description of the change. Material changes will be presented on this page before they take effect where reasonably practicable. The current version should be used when assessing how graltov.info handles information.

Retention schedule by category

Newsletter details are kept while a subscription remains active and for up to twenty-four months after an unsubscribe request, where needed to record the request and prevent an accidental re-subscription. Contact form messages are normally retained for up to twenty-four months after the enquiry is closed. Server security logs are generally retained for up to twelve months, while consent records may be retained for up to twenty-four months after the relevant choice.

Aggregated, non-identifying statistics may be retained for up to fourteen months because they do not ordinarily identify a reader. Records needed for a legal obligation, complaint, dispute or accounting purpose may be held for the applicable statutory period. At the end of each period, information is deleted, anonymised or securely restricted. A person can ask which period applies to their information by contacting [email protected].

We use cookies to improve your experience. Cookie Policy