Privacy Policy

PRIVACY POLICY

Last updated: August 2026

At GHABITS (“GHABITS”, “we”, “us” or “our”), we respect your privacy and are committed to protecting your personal data.

This Privacy Policy explains how we collect, use, disclose, store and protect your personal information when you visit or use ghabits.com (the “Website”), purchase our products, create an account, subscribe to our communications, contact us, or otherwise interact with our services (collectively, the “Services”).

For the purposes of this Privacy Policy, “you” and “your” means any individual who visits the Website, purchases or considers purchasing our products, creates an account, subscribes to our communications, contacts us, or otherwise interacts with GHABITS.

GHABITS acts as the data controller for the personal data processed in connection with the Website and our Services, except where another party determines the purposes and means of processing its own data in accordance with its own privacy policy.

Where applicable, we process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and other applicable data protection and privacy laws.

Please read this Privacy Policy carefully so that you understand how we handle your personal data and the rights you have in relation to it.

1. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes to our business, Website, Services, technologies, legal requirements or data-processing practices.

When we make changes, we will publish the updated version on the Website and revise the “Last updated” date at the top of this Privacy Policy.

Where required by applicable law, we will provide additional notice or obtain your consent before implementing material changes that affect your rights or the way we process your personal data.

2. HOW WE COLLECT YOUR PERSONAL DATA

We may collect personal data through several sources, depending on how you interact with GHABITS.

2.1 Information you provide directly

We may collect information that you voluntarily provide when you:

  • create or manage an account;
  • place an order;
  • subscribe to our newsletter or marketing communications;
  • contact our customer service team;
  • submit an enquiry or request;
  • participate in promotions, competitions, surveys or other activities;
  • submit a product review or other content;
  • communicate with us through email, social media or other channels; or
  • otherwise interact with our Services.

This information may include:

  • name;
  • email address;
  • billing and delivery address;
  • telephone number, where provided;
  • account login information;
  • order and purchase history;
  • products viewed, added to cart, purchased or saved;
  • customer-service communications;
  • marketing and communication preferences; and
  • any other information you voluntarily choose to provide.

You are not generally required to provide all of this information. However, certain information is necessary for us to process an order, provide particular Services or respond to your requests.

3. INFORMATION COLLECTED AUTOMATICALLY

When you visit our Website, certain information may be collected automatically through cookies and similar technologies.

Depending on the technologies enabled on the Website and your choices, this may include:

  • IP address;
  • browser type and version;
  • device type;
  • operating system;
  • language and regional settings;
  • referring website;
  • pages viewed and links clicked;
  • products viewed or added to cart;
  • date and time of visits;
  • approximate location derived from technical information;
  • information about how you interact with our Website; and
  • other technical or usage information.

We use this information to operate, secure, maintain and improve our Website, understand how visitors use our Services, and, where permitted and based on your choices, support analytics and marketing activities.

4. INFORMATION WE RECEIVE FROM THIRD PARTIES

We may receive personal data from third parties that provide services to GHABITS or support our Website and business operations.

These may include:

  • Shopify and Shopify-related services;
  • payment service providers;
  • shipping and fulfilment providers;
  • customer-support providers;
  • analytics providers;
  • marketing and email service providers;
  • advertising and social-media platforms; and
  • other technology or service providers used to operate our business.

Where we receive personal data from third parties, we process it in accordance with applicable law and this Privacy Policy.

Third parties may also process personal data independently under their own privacy policies where they act as separate data controllers.

5. HOW WE USE YOUR PERSONAL DATA

We use personal data for the following purposes.

5.1 Processing and fulfilling orders

We use your information to:

  • process and confirm purchases;
  • process payments;
  • arrange delivery;
  • provide order confirmations and updates;
  • manage returns, refunds and exchanges;
  • provide customer support;
  • maintain transaction records; and
  • administer your account, where applicable.

The legal basis for this processing is generally the performance of a contract with you and, where applicable, compliance with our legal obligations.

5.2 Providing customer support

We use information you provide to respond to questions, requests, complaints and other communications.

The legal basis may be performance of a contract, legitimate interests in providing effective customer service and managing our business relationship, or another legal basis where required.

5.3 Website operation and improvement

We use technical and usage information to:

  • operate and maintain the Website;
  • improve functionality and user experience;
  • understand how visitors interact with our Website;
  • identify technical problems;
  • monitor Website performance; and
  • maintain the security and integrity of our Services.

Depending on the nature of the data and technology involved, the legal basis may be legitimate interests or, where required, your consent.

5.4 Marketing and communications

Where permitted by law and, where required, with your consent, we may use your contact information to send you:

  • newsletters;
  • product information;
  • promotional communications;
  • offers and campaigns;
  • information about GHABITS;
  • updates about new products or services; and
  • other marketing communications.

You can unsubscribe from marketing emails at any time by using the unsubscribe link included in our communications or by contacting us at info@ghabits.com.

Withdrawing consent will not affect the lawfulness of processing carried out before your withdrawal.

Transactional communications, such as order confirmations, delivery updates, account notices and other essential service communications, may still be sent when necessary to provide the Services or fulfil our contractual or legal obligations.

5.5 Personalisation and advertising

Where permitted by applicable law and subject to your cookie and privacy choices, we may use information about your interaction with our Website to personalise content, understand advertising performance and present more relevant GHABITS products or communications.

Where consent is required for these activities, we will request it through our cookie or privacy controls.

5.6 Security and fraud prevention

We may process personal data to:

  • detect and prevent fraudulent activity;
  • protect our Website and systems;
  • investigate security incidents;
  • prevent misuse of our Services; and
  • protect the rights, property and safety of GHABITS, our customers and others.

This processing may be based on our legitimate interests and, where applicable, our legal obligations.

5.7 Legal and regulatory compliance

We may process and retain personal data where necessary to:

  • comply with applicable laws and regulations;
  • maintain appropriate business and financial records;
  • respond to lawful requests from public authorities;
  • establish, exercise or defend legal claims; and
  • enforce our contractual terms and policies.

The legal basis for this processing may be compliance with a legal obligation or our legitimate interests, as applicable.

6. LEGAL BASES FOR PROCESSING

Where the GDPR applies, we rely on one or more of the following legal bases:

Performance of a contract

Where processing is necessary to provide products or Services you have requested, including processing and fulfilling your orders.

Legal obligation

Where processing is necessary for us to comply with a legal or regulatory requirement.

Legitimate interests

Where processing is necessary for our legitimate business interests, provided that those interests do not override your fundamental rights and freedoms. This may include maintaining Website security, preventing fraud, improving our Services and managing our customer relationships.

Consent

Where we ask for your consent to process personal data, such as for certain marketing, cookies or other optional activities. You may withdraw your consent at any time.

We will not use your personal data for purposes that are incompatible with the purposes described in this Privacy Policy unless we have a lawful basis to do so.

7. COOKIES AND SIMILAR TECHNOLOGIES

GHABITS uses cookies and similar technologies on the Website.

Cookies are small files or pieces of information stored on your device that help websites operate and remember information about your visit.

We may use different categories of cookies, including:

Strictly necessary cookies

These cookies are necessary for the Website to function and cannot generally be disabled through our cookie-management tools. They may be used for functions such as shopping-cart functionality, checkout, security and session management.

Functional cookies

These cookies help remember choices and preferences and improve your experience on the Website.

Analytics cookies

Where enabled and permitted, these cookies help us understand how visitors use the Website and measure Website performance.

Advertising and marketing cookies

Where enabled and where required, these technologies may be used to measure advertising effectiveness, build audiences and deliver or personalise advertising.

The specific cookies and technologies used on our Website may change as we add, remove or update services and applications.

Where legally required, non-essential cookies will only be activated after you provide the appropriate consent.

You can manage your cookie preferences through the cookie banner or cookie settings available on our Website. You may also control cookies through your browser settings, although disabling certain cookies may affect the functionality of the Website.

Because GHABITS operates through Shopify, certain cookies and technologies may also be used by Shopify to provide and secure the online store. Shopify publishes information about its own use of cookies in its current Cookie Policy. (Shopify)

8. HOW WE SHARE PERSONAL DATA

We may share personal data with trusted third parties where necessary to operate our business and provide our Services.

These may include:

Shopify

Our online store is powered by Shopify. Shopify provides the technology and infrastructure that enables us to operate our Website, process orders and provide related ecommerce functionality.

Shopify may process personal data in accordance with its own privacy documentation and our applicable contractual arrangements with Shopify.

Payment providers

We may share information necessary to process payments with payment service providers. Payment details may be processed directly by the relevant payment provider and may be subject to that provider’s own privacy policy.

GHABITS does not generally store complete payment-card details on its own systems.

Shipping and fulfilment providers

We may share information such as your name, delivery address, email address and order information with logistics, delivery and fulfilment providers to enable us to deliver products to you.

Technology and service providers

We may use third-party providers for services such as:

  • website hosting and infrastructure;
  • IT and security;
  • customer support;
  • email and communications;
  • analytics;
  • marketing;
  • fraud prevention;
  • cloud storage; and
  • business administration.

These providers may process personal data only as necessary to provide their services to us and, where applicable, under appropriate contractual arrangements.

Professional advisers and authorities

We may disclose information to professional advisers, insurers, auditors, regulators, law-enforcement authorities or other public bodies where necessary to comply with legal obligations or establish, exercise or defend legal rights.

Business transactions

If GHABITS is involved in a merger, acquisition, restructuring, sale of assets or similar transaction, personal data may be transferred as part of that transaction, subject to applicable law and appropriate safeguards.

We do not sell your personal data.

9. INTERNATIONAL DATA TRANSFERS

Some of our service providers and business partners may process personal data outside the European Economic Area (“EEA”).

Where personal data is transferred outside the EEA, we will take appropriate measures to ensure that the transfer is lawful and that your personal data continues to receive an appropriate level of protection.

Depending on the circumstances, this may include:

  • transferring data to a country recognised by the European Commission as providing an adequate level of protection;
  • using the European Commission’s Standard Contractual Clauses;
  • relying on another lawful transfer mechanism recognised under applicable data protection law; or
  • implementing other appropriate safeguards required by law.

Shopify also maintains contractual and technical mechanisms governing international transfers of customer data. (Shopify)

10. DATA RETENTION

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including to:

  • provide our Services;
  • fulfil contractual obligations;
  • maintain business and transaction records;
  • comply with legal, accounting and tax obligations;
  • resolve disputes;
  • establish or defend legal claims; and
  • enforce our agreements.

The specific retention period depends on the type of information and the purpose for which it is processed.

When personal data is no longer required, we will delete it, anonymise it, or securely restrict its use where appropriate.

11. DATA SECURITY

We take reasonable technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction.

These measures may include access controls, secure systems, encryption or other appropriate safeguards depending on the nature of the information and the risks involved.

However, no method of transmission or electronic storage can be guaranteed to be completely secure. We therefore cannot guarantee absolute security of personal data.

If you believe that your interaction with us or your account has been compromised, please contact us promptly at info@ghabits.com.

12. YOUR PRIVACY RIGHTS

Depending on applicable law and the circumstances of the processing, you may have the following rights regarding your personal data:

Right of access

You may request confirmation as to whether we process your personal data and request a copy of the information we hold about you.

Right to rectification

You may ask us to correct inaccurate or incomplete personal data.

Right to erasure

In certain circumstances, you may request that we delete your personal data.

Right to restriction

In certain circumstances, you may request that we restrict the processing of your personal data.

Right to data portability

Where applicable, you may request to receive personal data that you have provided to us in a structured, commonly used and machine-readable format, or request that it be transferred to another controller.

Right to object

You may object to certain processing activities based on our legitimate interests. You may also object at any time to the processing of your personal data for direct marketing purposes.

Right to withdraw consent

Where we process your personal data based on consent, you may withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

Rights relating to automated decision-making

Where applicable, you may have rights relating to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.

GHABITS does not intend to make decisions about customers based solely on automated processing that produce legal or similarly significant effects.

13. HOW TO EXERCISE YOUR RIGHTS

You may exercise your privacy rights by contacting us at: info@ghabits.com

Please clearly describe your request and, where necessary, provide sufficient information for us to verify your identity and locate the relevant personal data.

We may request additional information where reasonably necessary to verify your identity and protect your personal data from unauthorised disclosure.

We will respond to valid requests within the time period required by applicable law. Under the GDPR, this is generally within one month, although this period may be extended in certain circumstances permitted by law. (European Commission)

14. MARKETING COMMUNICATIONS

If you subscribe to GHABITS marketing communications, you may receive information about products, launches, promotions, wellness content and other GHABITS updates.

You can unsubscribe at any time by:

  • clicking the unsubscribe link included in our marketing emails; or
  • contacting us at info@ghabits.com.

Unsubscribing from marketing communications does not prevent us from sending necessary transactional or service-related communications, such as information relating to an order you have placed.

15. USER-GENERATED CONTENT AND PRODUCT REVIEWS

Our Website may allow you to submit product reviews, comments, photographs or other content.

If you choose to submit content to a public area of the Website, that content may be visible to other Website visitors and potentially accessible through search engines or other third-party services.

Please do not include personal or sensitive information in content that you intend to make publicly available.

16. THIRD-PARTY WEBSITES AND SERVICES

Our Website may contain links to websites, applications, social-media platforms or other services operated by third parties.

These third parties have their own privacy policies and terms. GHABITS is not responsible for the privacy practices, security or content of third-party services that we do not control.

We recommend reviewing the privacy policies of any third-party website or service before providing personal data.

17. CHILDREN’S PRIVACY

Our Website and Services are intended for adults and are not directed at children.

We do not knowingly collect personal data from children where such collection is prohibited by applicable law.

If you believe that a child has provided personal data to us, please contact us at info@ghabits.com so that we can assess the situation and take appropriate action.

18. HEALTH-RELATED INFORMATION

GHABITS sells wellness and food-supplement products. Our Website is not intended to collect medical records or provide medical diagnosis or treatment.

Please do not provide sensitive medical or health information through general Website forms, product reviews, customer-service messages or other channels unless specifically requested and where an appropriate lawful basis for processing exists.

Where you voluntarily provide health-related information, such information may constitute special category data under the GDPR. We will only process such information where a lawful basis and, where required, an additional condition for processing special category data under applicable law exists.

Nothing on the GHABITS Website should be understood as a substitute for professional medical advice, diagnosis or treatment.

19. DATA PROTECTION COMPLAINTS

If you have concerns about how GHABITS processes your personal data, please contact us first at: info@ghabits.com

You also have the right to lodge a complaint with the relevant data protection supervisory authority in your country of residence, place of work or the place where you believe an infringement occurred.

For individuals in the European Union, information about national supervisory authorities is available through the European Data Protection Board and the European Commission.

20. CONTACT US

If you have any questions about this Privacy Policy, our privacy practices, or your personal data, or if you wish to exercise any of your privacy rights, please contact us:

GHABITS

Email: info@ghabits.com

Website: ghabits.com