Data Protection

Identity and Contact Details of the Controller

Controller: John Stromberg, trading as BMPHARMACY.COM: Your Trusted Source for Pharmaceuticals

Postal address: 300 Roger Barta Way
Smith Center, KS 66967

Email: [email protected]

Jurisdiction: United Kingdom (UK GDPR and Data Protection Act 2018)

Scope and Applicability

This notice explains how we collect, use, disclose, and protect personal data when you access or use bmpharmacy.su and related services (the “Site”). It applies to all visitors, registered users, and individuals who contact us. By using the Site, you acknowledge the practices described herein, without prejudice to your rights under UK data protection law.

Data Protection Principles

We process personal data in accordance with the principles of lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.

Categories of Personal Data We Process

• Identification and contact data: name, email address, phone number (if provided), postal address (if provided).
• Account and preference data: username, password, communication preferences, saved content or settings.
• Communications data: enquiries, feedback, support requests, and related correspondence.
• Usage and technical data: IP address, device identifiers, browser type, operating system, pages viewed, time spent, referring URLs, and cookie identifiers.
• Marketing data: your consent choices, opt-in/opt-out records, and engagement with our communications.
• Special category data (if voluntarily provided): information relating to health or medical conditions included in free-text forms or messages.

Sources of Personal Data

• Directly from you when you register, subscribe, contact us, or use interactive features.
• Automatically through cookies and similar technologies when you browse the Site.
• From service providers processing data on our behalf (e.g., hosting, analytics, email delivery).

Purposes of Processing and Legal Bases

• Providing and maintaining the Site and user accounts: performance of a contract or steps prior to entering into a contract; legitimate interests in operating an efficient online service.
• Responding to enquiries and providing customer support: legitimate interests in addressing requests and improving our services; performance of a contract where applicable.
• Sending newsletters and educational content: consent (you may withdraw at any time).
• Analytics and service improvement (non-essential cookies): consent.
• Security, fraud prevention, and diagnostics (including server logs and essential cookies): legitimate interests in ensuring network and information security; legal obligations where applicable.
• Compliance with legal and regulatory requirements, and the establishment, exercise, or defence of legal claims: legal obligation; legitimate interests.
• Surveys and voluntary feedback: consent.

Special Category Data (Health Information)

Our Site is an informational resource and is not a substitute for professional medical advice. We do not require special category data. If you voluntarily provide health-related information (e.g., within free-text messages), we will process it only with your explicit consent or where necessary for the establishment, exercise, or defence of legal claims. You may withdraw your consent at any time.

Children’s Data

Our services are not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided personal data, please contact us so we can take appropriate steps.

Cookies and Similar Technologies

We use cookies and similar technologies to operate the Site, remember your preferences, and, subject to your consent, to measure performance and improve content. Essential cookies are necessary for core functionality and do not require consent. Non-essential cookies (such as analytics) are used only with your consent. You can manage cookie preferences through available on-site controls and your browser settings.

Recipients and Categories of Data Sharing

• Service providers acting as processors: hosting, infrastructure, maintenance, security, analytics, email delivery, and customer support tools.
• Professional advisors: legal, compliance, and accounting services where necessary.
• Public authorities and regulators: where required by law or in response to valid requests.
• Corporate transactions: in connection with a merger, acquisition, restructuring, or asset transfer, subject to appropriate safeguards.

International Data Transfers

Where personal data are transferred outside the UK, we ensure appropriate safeguards are in place, such as adequacy regulations, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, and implement supplementary measures where necessary. You may request further details of these safeguards by contacting us.

Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or damage. Measures include access controls, encryption in transit where feasible, secure configurations, logging and monitoring, least-privilege access, and staff confidentiality obligations. No system is completely secure; we maintain and test controls commensurate with the risks.

Data Retention

• Account data: retained for the life of the account and for up to 24 months after the last activity, unless a longer period is required by law or necessary to establish, exercise, or defend legal claims.
• Communications and support records: typically retained for up to 36 months after resolution.
• Marketing data and consent records: retained while you remain opted-in and for a reasonable period thereafter to maintain compliance records.
• Usage and technical logs: typically retained for 12 months for security and diagnostics.

We may retain data longer where required by law or to resolve disputes. Data are deleted or anonymised when no longer needed.

Your Rights Under UK GDPR

• Right of access: obtain confirmation and a copy of your personal data.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure: request deletion of your data in certain circumstances.
• Right to restriction: request restriction of processing in certain cases.
• Right to data portability: receive data in a structured, commonly used, machine-readable format and transmit it to another controller where processing is based on consent or contract and carried out by automated means.
• Right to object: object to processing based on legitimate interests, including profiling; object at any time to direct marketing.
• Right to withdraw consent: where processing relies on consent, you can withdraw at any time without affecting prior lawful processing.
• Rights related to automated decision-making: you have rights where decisions are made solely by automated means producing legal or similarly significant effects. We do not conduct such processing.

How to Exercise Your Rights

To exercise your rights or raise a privacy query, contact us at [email protected]. We may request information to verify your identity and will respond without undue delay and within the statutory timeframes. Exercising your rights is generally free of charge unless requests are manifestly unfounded or excessive.

Supervisory Authority and Complaints

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) in the United Kingdom. We encourage you to contact us first so we can address your concerns promptly.

Provision of Personal Data

Providing certain data may be necessary to access specific functionalities (e.g., an email address to create an account or receive newsletters). If you choose not to provide required information, you may be unable to use those features. Non-essential data are optional.

Automated Decision-Making and Profiling

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

Updates to This Notice

We may update this notice from time to time to reflect changes in law or our practices. Material changes will be highlighted on the Site. The effective date of this notice is the date shown below.

Contact Information

Controller: John Stromberg, trading as BMPHARMACY.COM: Your Trusted Source for Pharmaceuticals

Postal address: 300 Roger Barta Way
Smith Center, KS 66967

Email: [email protected]

Effective date: 20 August 2025

James Wright

I'm John Stromberg, a pharmacist passionate about the latest developments in pharmaceuticals. I'm always looking for opportunities to stay up to date with the latest research and technologies in the field. I'm excited to be a part of a growing industry that plays an important role in healthcare. In my free time, I enjoy writing about medication, diseases, and supplements to share my knowledge and insights with others.