Privacy Policy
Last updated:
1. Introduction
This Privacy Policy explains how we collect, use, store, share and protect personal data when you visit the Capsules.com website, apply for a trade account, use our customer portal, or otherwise deal with us.
Capsules.com is a business-to-business supplier of empty two-piece HPMC and gelatin capsules to trade customers such as manufacturers, contract packers and brand owners. We do not sell to consumers, and our website and portal are not directed at the general public.
We handle personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR). This policy should be read together with our Cookie Policy and our Terms of Service.
Customers and visitors in the United States are supplied and served by CAPSULES DIRECT LTD from the United Kingdom. Personal data you provide through the US site is transferred to and processed in the United Kingdom under this policy.
2. Who we are
CAPSULES DIRECT LTD is the data controller for the personal data described in this policy. This means we decide how and why that data is processed.
- Controller: CAPSULES DIRECT LTD
- Company number: 17362490 (England and Wales)
- VAT number: GB530725510
- Registered office: Rowood House, 26 Murdock Road, Bicester, Oxfordshire, OX26 4PP, United Kingdom
- Data protection contact: privacy@capsules.com
- ICO registration: application C2059582, registration number to follow
We have not appointed a statutory Data Protection Officer, as one is not required for a business of our size and activities. Our Chief Executive Officer is responsible for data protection and can be reached at privacy@capsules.com.
3. Who this policy covers
This policy applies to personal data about people who deal with us in a business context: trade account applicants and their named contacts, authorized users of our customer portal, ordering, billing, quality and technical contacts at customer companies, contacts at suppliers and professional advisers, and visitors to our website.
Because we deal with companies rather than consumers, most of the data we hold is about individuals acting for a business, such as a buyer or a quality contact at a manufacturer. That information is still personal data where it identifies an individual, and it is protected by this policy.
4. Personal data we collect
We collect only what we need for the purposes set out in this policy. We do not intentionally collect special category data (such as health or biometric data) and we ask that you do not send it to us.
| Category | Examples | Source |
|---|---|---|
| Identity and contact data | Full name, job title or role, business email address, business telephone number, the company you represent | Provided by you when you apply for a trade account, are added as a portal contact, submit a form or contact us |
| Trade account application data | Company name, trading address, company registration and VAT details, business sector, intended use, indicative volumes, references or trade information you supply | Provided by you in the application form |
| Country of inquiry | The country derived from your IP address at the time you submit a form, recorded against the inquiry or account | Derived automatically when you submit a form |
| Account and portal data | User identifier, sign-in records, authentication tokens, roles and permissions, contacts linked to your company account | Generated when an account is created and used |
| Order and transaction data | Order requests, purchase order references, dispatch and tracking details, pricing applicable to your account, delivery contacts | Generated through your use of the portal and our order processes |
| Billing contact data | Billing contact name and email, invoice references, payment status | Provided by you and generated through invoicing. Card payments are made through a hosted payment page; we do not capture or store card details |
| Documents and correspondence | Emails, support requests, inquiries, artwork and specifications you provide, supplier qualification information, and records of access to documents such as certificates of analysis and specifications | Provided by you and generated through your dealings with us |
| Resource requests and newsletter choices | Name, business email, role, selected answers, resource requested, signup source, and the wording and time of your consent or withdrawal | Provided by you on the relevant form |
| Consented attribution | Campaign information, first and last touch, recent document-download identifiers, and a Google Analytics browser identifier; advertising click identifiers only with separate advertising permission | Browser storage after the relevant choice (see our Cookie Policy) |
| Form-security and delivery records | CAPTCHA results, request references, technical security signals and temporary copies of submissions and attachments used for reliable delivery to our business management platform | Generated when you submit a form |
| Website usage and technical data | IP address, device and browser type, pages viewed, referring pages, region preference and detected country used to route UK and US visitors | Collected automatically when you use the website (see our Cookie Policy) |
5. How we collect personal data
- Directly from you, when you apply for a trade account through the customer portal, submit a form, request a resource, join our newsletter, place or request an order, contact our sales or support team, complete supplier qualification information, or correspond with us.
- Automatically, when you use our website, through service and preference cookies, optional analytics and attribution where you have consented, and server logs. When you submit a public form without optional tracking permission, we may record the current page and campaign information already sent in that HTTP request; we do not reconstruct an earlier browsing history. Country captured from the connection is country-level only, not a US state.
- From your colleagues, where an administrator or authorized contact at your company adds you as a portal user or as an ordering, billing, quality or technical contact.
- From public sources, such as company registers and sanctions lists, where relevant to assessing or administering a trade account.
6. Purposes and lawful bases
UK GDPR requires a lawful basis for each use of personal data. Where we rely on legitimate interests, we have weighed those interests against your rights and freedoms.
| Purpose | Lawful basis |
|---|---|
| Assessing and approving trade account applications, including identity, business, credit and sanctions checks | Steps prior to a contract (Art 6(1)(b)); legitimate interests (Art 6(1)(f)) in dealing only with suitable trade customers |
| Creating and administering company accounts and portal user access | Performance of a contract (Art 6(1)(b)); legitimate interests in secure company-level access |
| Authenticating users and securing the portal | Legitimate interests in keeping accounts and data secure; performance of a contract |
| Routing inquiries to the right regional team, applying the right currency and price book, and checking that we can supply your territory (using the country derived from your IP address and the details you give us) | Legitimate interests in handling inquiries efficiently and lawfully |
| Processing order requests and providing order, dispatch and tracking information | Performance of a contract |
| Providing customer-specific pricing and documents (certificates of analysis, specifications, regulatory and batch traceability documents) | Performance of a contract; legal obligation (Art 6(1)(c)) for traceability records |
| Invoicing and facilitating payment | Performance of a contract; legal obligation for accounting and tax records |
| Responding to inquiries and providing customer support | Legitimate interests; performance of a contract where related to an existing account |
| Sending service and transactional communications (sign-in emails, order and account notifications) | Performance of a contract; legitimate interests in administering the service |
| Operating, securing and improving the website and portal | Legitimate interests in providing a secure, functional service; strictly necessary cookies are exempt from consent under PECR |
| Google Analytics, optional campaign and document attribution, and advertising click identifiers | Consent (Art 6(1)(a)) and PECR; advertising attribution has a separate choice |
| Handling a requested article resource and recording the permission given | Your consent on the resource form; any newsletter subscription is a separate, optional choice |
| Sending the newsletter you requested | Consent; you can withdraw it and every marketing message includes an opt-out |
| Sending business-to-business marketing about our products and services to relevant business contacts | Legitimate interests, subject to PECR; consent where required. Every marketing message carries an opt-out |
| Assessing supplier qualification information and maintaining supplier records | Legitimate interests in selecting and managing suitable suppliers; legal obligations where applicable |
| Complying with legal, regulatory, tax and accounting obligations | Legal obligation |
| Establishing, exercising or defending legal claims, and preventing fraud | Legitimate interests; legal obligation where applicable |
You can object to processing based on legitimate interests and you can withdraw consent at any time. Withdrawal does not affect processing carried out before it.
7. Automated assistants and artificial intelligence
We may introduce automated assistants to help with product information, accounts and support. Where you interact with an automated assistant, we will identify it as automated and explain how information in the conversation is used before you provide it.
Before using a provider for customer conversations, we will put in place appropriate data-processing terms, including a prohibition on using your data to train the provider's own models. We may review conversations to check quality and resolve issues, and use de-identified, aggregated information to improve our systems. We do not use identifiable customer conversations to train our own models. Any new use requiring consent will start only after that consent is obtained.
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. Decisions on trade account applications are made by a member of our team.
8. Who we share personal data with
We do not sell personal data. We share it only where necessary for the purposes in this policy, and our processors act only on our instructions under written contracts that meet the requirements of Article 28 of the UK GDPR. Recipients fall into these categories:
- Our business management platform, which runs our customer records, orders, invoicing, payment links and transactional email.
- Our website hosting, private submission-storage, operational-alert email and infrastructure providers, including the services that queue a request until our business management platform receives it.
- Our form-security and rate-limiting providers, which help prevent automated abuse.
- Our portal hosting and authentication services.
- Our email and productivity provider.
- Our website analytics provider (Google Analytics), where you have consented to analytics cookies.
- AI service providers where a feature described in section 7 is introduced, subject to the safeguards explained there.
- Logistics, courier and freight providers, to deliver orders and provide tracking.
- Professional advisers, including lawyers, accountants, auditors and insurers, where reasonably necessary.
- Regulators, law enforcement and other authorities, where required by law or to protect our rights.
- Any group company that supplies or supports our customers, where relevant to providing services to you.
- A buyer or successor in the event of a sale, merger or reorganization of our business, subject to confidentiality and data protection safeguards.
9. International transfers
We are based in the United Kingdom and personal data you provide is processed there and by our providers in the United Kingdom, the United States and other countries. The United Kingdom's data protection law gives you the rights described in section 11 regardless of where you are located. You can contact us for information about the safeguards used for a particular transfer.
10. How long we keep personal data
We determine retention from the purpose of each record: whether a request is open, whether follow-up or an ongoing business relationship needs it, whether a complaint or legal claim needs it, and whether a legal, accounting or quality obligation applies. A retention or deletion review takes account of these criteria, the relevant obligations and any hold.
| Record | How retention is determined |
|---|---|
| Enquiries, quotes, samples and trade account applications, including declined applications | While needed to handle the request, carry out relevant follow-up, evidence the application decision or deal with a complaint or claim. A declined application may need to remain auditable and inform a later reapplication. |
| Customer account, order and portal records | While needed for the account relationship, outstanding orders or balances, support, audit and applicable record-keeping obligations. Closing portal access does not erase the related business records. |
| Quality and traceability records, including certificates of analysis and batch records | According to applicable quality, traceability and regulatory requirements, customer agreements and the need to investigate product issues. |
| Invoices, accounting and tax records | According to applicable tax and accounting record-keeping obligations and any unresolved transaction, audit or claim. |
| Correspondence, support records and supplier qualification information | While needed for the request, relationship, qualification, quality issue, complaint or claim to which they relate. |
| Resource requests and newsletter records | For the requested resource and related permission evidence; newsletter records while subscribed, with a limited suppression and consent record where needed after withdrawal to respect that choice. |
| Temporary website submission and attachment copies | Used to deliver and recover requests reliably. Copies whose delivery has not been confirmed, or which need investigation, are retained for resolution. Confirmed delivered copies are eligible for the website's guarded cleanup after 30 days; this does not delete the business record received by our business management platform. |
| Hosting, security and service logs | According to the provider's configured service retention and the need to diagnose faults, detect abuse or investigate an incident; longer where a legal duty or unresolved incident requires it. |
| Google Analytics information | According to the property's configured retention settings. Aggregate reports may remain after individual event data expires. Contact us for the current setting or to request review of information associated with your browser identifier. |
| Cookies and browser storage | The specific lifetimes and controls in our Cookie Policy. Browser storage lifetimes are separate from the retention of submitted business records. |
Contact privacy@capsules.com if you want us to review a particular record or explain the period that applies to it.
11. Your rights
Under UK GDPR you have the right to be informed; to access a copy of your personal data; to have inaccurate data corrected; to have data erased in certain circumstances; to restrict processing in certain circumstances; to data portability for certain data; to object, including to direct marketing and to processing based on legitimate interests; and rights relating to automated decision-making.
To exercise any of these rights, contact privacy@capsules.com. We may need to verify your identity. We will respond within one month, and will tell you if a complex or numerous request needs up to two further months. Exercising your rights is free of charge in almost all cases.
If you are a resident of a US state with its own privacy law, you may have additional rights under that law, including rights to know, delete and correct personal data and to opt out of its sale or sharing. We do not sell or share personal data for advertising purposes. You can exercise any applicable right by contacting privacy@capsules.com.
12. Complaints
If you have a concern about how we handle your personal data, contact us first at privacy@capsules.com and we will do our best to resolve it. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority: ico.org.uk, helpline 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
13. Security
We use appropriate technical and organizational measures to protect personal data against unauthorized or unlawful processing and against accidental loss, destruction or damage. These include access controls and role-based permissions, encryption in transit, secure authentication, and reputable hosting and infrastructure providers. Access to the customer portal is restricted to authorized users, and each user sees the data for their company that their role allows.
If we suffer a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO and, where required, the affected individuals, in line with our legal obligations.
14. Children
Our website, products and portal are for business customers and the professionals who work for them. They are not directed at children and we do not knowingly collect personal data about children. If you believe a child has provided personal data to us, contact privacy@capsules.com and we will delete it.
15. Cookies
We use service cookies to keep the portal secure and remember your privacy choices and regional preferences. You can turn automatic regional suggestions off. Google Analytics and optional attribution use your consent, with a separate choice for advertising click identifiers. We honor Global Privacy Control signals, and do not use the discontinued basic page-counting service. Our Cookie Policy describes the cookies and similar browser storage in use and how to control them.
16. Changes to this policy
We may update this policy to reflect changes in our practices, technology, legal requirements or business. When we make a material change we will update the date at the top of this page and, where appropriate, notify account administrators.
17. Contact
- CAPSULES DIRECT LTD
- Rowood House, 26 Murdock Road, Bicester, Oxfordshire, OX26 4PP, United Kingdom
- Company number 17362490
- VAT number GB530725510
- Data protection: privacy@capsules.com
- General inquiries: sales@capsules.com
- Telephone: (816) 445-0042
This policy and any dispute relating to it are governed by the laws of England and Wales and subject to the exclusive jurisdiction of its courts.