Last updated: 31 May 2026
This Privacy Policy explains how we collect, use, share and protect your personal information when you visit or buy from the BrainSmart website (the “Website”). We take your privacy seriously and handle your personal data in accordance with the UK GDPR and the Data Protection Act 2018.
Who we are
The Website is operated by Cognitive Bioscience UK Limited (“we”, “us”, “our”), trading as BrainSmart. We are the data controller responsible for your personal data.
- Company: Cognitive Bioscience UK Limited, registered in England & Wales, company number 14557197
- Registered office: 1 Coldbath Square, London EC1R 5HL, United Kingdom
- Contact for data protection matters: customerservice@brain-smart.net
Information we collect
We collect personal information in the following ways:
Information you give us — when you place an order, create an account, contact us, complete a form or sign up to marketing, including your name, billing and delivery address, email address, telephone number, order details and account login details.
Payment information — payments are processed securely by our payment service providers. We do not store full card details on our systems.
Information we collect automatically — when you use the Website we collect technical and usage data through cookies and similar technologies, such as your IP address, device and browser type, and the pages you visit. See our Cookie Policy for details.
We do not seek to collect special category (sensitive) personal data through the Website, and ask that you do not send it to us unless we specifically request it.
How we use your information and our lawful bases
Under data protection law we must have a lawful basis for processing your personal data. We rely on the following:
- To process and deliver your orders, manage your account and provide customer service — lawful basis: performance of a contract with you.
- To send you marketing emails or SMS about our products, where you have asked to receive them or are an existing customer who has not opted out — lawful basis: consent, or our legitimate interests together with your rights under PECR. You can opt out at any time.
- To understand how the Website is used and improve it, including analytics — lawful basis: consent (for non-essential cookies) and our legitimate interests in running an effective website.
- To prevent fraud, ensure security and keep proper business records — lawful basis: our legitimate interests and compliance with our legal obligations.
Who we share your information with
We do not sell your personal data. We share it only with the following categories of recipient, who process it on our behalf or as required:
- Our e-commerce and hosting platform (BigCommerce)
- Payment service providers, to process your payment
- Couriers and fulfilment partners, to deliver your order
- Our email and SMS marketing platform (Klaviyo)
- Analytics and advertising providers (such as Google and Meta/Facebook), where you have consented to the relevant cookies
- Professional advisers, and regulators or authorities where we are legally required to disclose information
International transfers
Some of our service providers are based outside the United Kingdom, including in the United States. Where your personal data is transferred outside the UK, we ensure an appropriate safeguard is in place — such as the transfer being to a country with UK ‘adequacy’ status, or the use of the UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses.
How long we keep your information
We keep your personal data only for as long as necessary for the purposes set out above. In practice this means: order and transaction records are kept for around six years to meet our accounting and legal obligations; marketing data is kept until you unsubscribe; and account data is kept while your account remains open. We then securely delete or anonymise it.
How we protect your information
We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or misuse, and we keep these measures under review.
Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you;
- ask us to correct inaccurate or incomplete data;
- ask us to erase your data in certain circumstances;
- restrict or object to our processing of your data;
- request the transfer (portability) of your data; and
- withdraw your consent at any time where we rely on consent.
To exercise any of these rights, contact us at customerservice@brain-smart.net. We will respond within one month.
Marketing
You can opt out of marketing at any time by clicking ‘unsubscribe’ in any marketing email, replying STOP to a marketing SMS, or contacting us. Opting out of marketing will not affect order-related messages we need to send you.
Complaints
If you have a concern about how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority, at ico.org.uk or on 0303 123 1113.
Children
Our products and Website are intended for adults. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.
Changes to this policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated ‘last updated’ date.
Contact us
For any questions about this policy or your personal data, contact us at customerservice@brain-smart.net or write to: Data Protection, Cognitive Bioscience UK Limited, 1 Coldbath Square, London EC1R 5HL.