Privacy Policy

Introduction

ActiveHealth Ltd is the data controller for that processing. There is no separate platform operator or third-party seller: we run the Site and we sell the products.

ActiveHealth Ltd
Nikou Pattichi 26, 3071 Limassol, Cyprus
Registration number: HE 490253 (Registrar of Companies, Republic of Cyprus)
Email: support-arvyon@vantiqnutrition.com

We handle personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Cyprus Law 125(I)/2018 on the protection of natural persons with regard to the processing of personal data, and the national data protection laws that apply where you live. Our Terms of Sale and Website Use also apply to your use of the Site; please read both documents before you order.

1. The data we collect

"Personal data" is any information that identifies you or can reasonably be linked to you. Depending on how you use the Services, we process the following:

1.1 Identity and contact details – your name, delivery and billing addresses, email address and telephone number.

1.2 Payment data – the information needed to take and reconcile payment, such as the payment method used, the last four digits of a card, transaction references and billing records. Full card numbers are handled by our payment service providers and are not stored by us.

1.3 Order and activity data – what you have looked at, bought, returned or exchanged, and any discount codes you have used.

1.4 Correspondence – emails, chat messages, phone notes, reviews and feedback you exchange with our customer care team.

1.5 Device and connection data – IP address, browser type and version, operating system, device identifiers and similar technical details.

1.6 Usage data – how you move through the Site, which pages you open, how long you stay and which features you use.

We obtain this data directly from you when you order or contact us, automatically through cookies and comparable technologies while you browse (see Section 6), and from service providers that help us run the business, such as payment, fraud-prevention and logistics partners.

2. Why we use your data, and on what basis

Each purpose below is tied to a legal basis under Article 6 GDPR and a retention period.

2.1 Fulfilling your order. We use your identity, contact, payment and order data to process payment, prepare and ship your parcel, and handle returns and refunds. Basis: performance of a contract (Art. 6(1)(b)). Transaction records are kept for 7 years to satisfy Cypriot bookkeeping and tax obligations.

2.2 Running and improving the Site. We use device, connection and usage data to keep the Site working, remember your preferences, tailor what you see and suggest products that may interest you. Basis: our legitimate interest in operating and improving the Services (Art. 6(1)(f)). This data is kept for 1 month after your last visit, unless it is needed for a longer period under 2.3.

2.3 Security and fraud prevention. We use identity, contact, payment, device and usage data to verify transactions, spot suspicious or unlawful activity and keep payments safe. Basis: our legitimate interest in protecting the Site, our customers and ourselves (Art. 6(1)(f)). Routine security data is kept for 1 month after your last visit; records of a specific incident may be kept for up to 10 years.

2.4 Marketing. With your consent (Art. 6(1)(a)) we send offers, product news and reminders by email or SMS, using your contact and order data. Where the law allows, we may also email existing customers about products similar to those they have bought, based on our legitimate interest in maintaining the relationship (Art. 6(1)(f)) – you can object at any time. On our legitimate interest we may also show you advertising on the Site and on third-party platforms that reflects your purchase history and browsing, using order, device and usage data. Marketing data is kept for 5 years from your last interaction with us or until you withdraw consent or object, whichever comes first.

2.5 Customer care. We use your identity, contact, correspondence and order data to answer questions, resolve problems and keep you informed about your orders. Basis: performance of a contract (Art. 6(1)(b)) for anything relating to an order, and your consent (Art. 6(1)(a)) for general enquiries you initiate. Customer care records are kept for 7 years from your last message.

2.6 Legal obligations and legal claims. We may process any of the data described above to meet legal requirements (for example food-safety traceability, tax law or a lawful request from an authority), to enforce our Terms or to establish, exercise or defend legal claims. Basis: legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)). Data is kept for as long as the relevant law requires or, in the case of a dispute, until it is resolved plus the applicable limitation period.

3. Who we share your data with

We share personal data only where necessary and only with parties bound by contract to protect it:

3.1 Fulfilment and delivery partners – the warehouse that packs your order and the carriers that deliver it receive your name, address, telephone number and email so that they can ship the parcel and notify you.

3.2 Payment service providers – receive the transaction details required to authorise and settle your payment and to handle refunds and chargebacks.

3.3 Service providers working on our behalf – hosting, e-commerce platform, CRM, email and SMS delivery, analytics, customer-service software, fraud screening and marketing tools. Each receives only the data it needs for its task.

3.4 Group companies and successors – we may share data within our corporate group, and if ActiveHealth is involved in a merger, acquisition or sale of assets, personal data may be transferred to the acquiring party under the same protections.

3.5 Authorities and advisers – where required by law, to comply with a court order or regulatory request, to enforce our Terms, or to protect the rights, property or safety of ActiveHealth, our customers or others.

We follow the principle of data minimisation in every disclosure and have data processing agreements in place with all processors, as required by Article 28 GDPR.

4. International transfers

Some of our service providers are established outside the European Economic Area. Where personal data leaves the EEA, we rely on an adequacy decision of the European Commission or on the EU Standard Contractual Clauses, supplemented where necessary by additional safeguards. You can request a copy of the relevant safeguards by contacting us.

5. Your rights

Under the GDPR you may, at any time:

5.1 Access – ask for a copy of the personal data we hold about you and information about how we use it.

5.2 Rectification – ask us to correct data that is inaccurate or complete data that is incomplete.

5.3 Erasure – ask us to delete your data where it is no longer needed, where you withdraw consent and no other basis applies, or where the processing is unlawful.

5.4 Restriction – ask us to pause processing while its accuracy or lawfulness is being checked; we will store the data but not use it further.

5.5 Portability – receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another provider.

5.6 Objection – object to processing based on our legitimate interests; we will stop unless we can show compelling grounds that override your interests or the processing is needed for legal claims. You can object to direct marketing at any time, and we will always stop.

5.7 Withdraw consent – where processing rests on consent, withdraw it at any time without affecting what was done before.

To exercise any right, contact us via Section 12. We may ask you to confirm your identity first. We respond within one month; in complex cases we may extend this by a further two months and will tell you if so.

Every marketing email contains an unsubscribe link, and you can reply STOP to any marketing SMS.

6. Cookies and similar technologies

The Site uses cookies, pixels and comparable technologies. A cookie is a small file stored on your device that lets our systems recognise your browser on later visits.

Strictly necessary – required for the Site to function: session handling, basket, checkout, security. These are set without consent, as permitted by law.

Analytics and performance – help us understand how visitors use the Site so we can improve it. Set only with your consent.

Marketing and advertising – used by us and our advertising partners (for example Meta and Google) to measure campaigns and show you relevant ads on and off the Site. Set only with your consent.

When you first visit, our consent banner lets you accept or reject non-essential cookies; you can change your choice at any time via the "Cookie settings" link in the footer. Non-essential cookies and pixels are not activated until you have agreed. You can also delete or block cookies through your browser settings, although some parts of the Site may then not work properly. Full details of each cookie are in our Cookie Policy.

7. Security and retention

We apply appropriate technical and organisational measures – including encryption in transit, access controls, staff confidentiality obligations and regular review of our providers – to protect your data against loss, misuse, unauthorised access and alteration. No online system is entirely risk-free, but we work to keep those risks as low as reasonably possible and will notify you and the supervisory authority where the law requires if a breach affects you.

We keep personal data only for as long as the purposes in Section 2 require, including the periods needed to meet legal, accounting and reporting obligations or to resolve disputes. When data is no longer needed it is deleted or anonymised.

8. Children

The Site and our products are intended for adults. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with data, please contact us and we will delete it.

9. Links to other websites

The Site may link to websites we do not operate. Their privacy practices are their own; we do not endorse them and are not responsible for them. Please read their policies before sharing any data with them.

10. Complaints

If you are unhappy with how we handle your data, please contact us first so that we can put things right. You also have the right to lodge a complaint with a supervisory authority – in Cyprus the Commissioner for Personal Data Protection (www.dataprotection.gov.cy), or the authority in the EU country where you live or work.

11. Changes to this Policy

We may update this Policy to reflect changes in our practices or in the law. The current version, with its date, is always available on this page; where a change is significant we will draw your attention to it, for example by email or a notice on the Site.

12. Contact

For any question, request or concern about your personal data:

ActiveHealth Ltd – Arvyon Customer Care

Nikou Pattichi 26, 3071 Limassol, Cyprus

Email: support-arvyon@vantiqnutrition.com

© 2026 ActiveHealth Ltd. Arvyon is a brand of ActiveHealth Ltd. All rights reserved.