Substance001 Ltd is committed to protecting your personal information, being transparent about what data we hold, and giving you control over how we use it. This policy applies within the UK, USA, Argentina and Singapore.

This privacy policy describes the personal data collected or processed when you use the Substance001 Ltd website, digital experiences, or interact with one of our other products or services, all of which are part of the Substance001 Ltd platform. It also explains how your personal data is used, shared and protected, what choices you have regarding your personal data, and how you can contact us.

We may collect, use, store and transfer your “personal data”. This can include:

• Identity Data such as name, address, usernames, marital status, job title, date of birth, and gender, dietary requirements
• Demographic Data such as preferences and interests
• Contact Data such as email address or telephone number
• Financial Data such as bank account or payment card details
• Technical Data such as IP address, login data, browser type, location, statistical or demographic data
• Usage Data such as information about how you use our website, products, and services
• Marketing and Communications Data including your preferences regarding receiving marketing materials from us

Please note: We may also collect and store personal data from competition entrants and winners, including name, contact details, and delivery address (where applicable), for the purposes of administering competitions, notifying winners, and fulfilling prizes.

The personal information recorded will be available to Substance001 Ltd, our affiliated companies, and trusted third-party service providers and contractors for the following purposes:

• To process enquiries received
• To conduct market research and business development
• To provide you with information about products and promotions that may be of interest to you
• In connection with surveys related to our products and websites
• To administer competitions, contact winners, and deliver prizes

Any other purpose indicated at the time you voluntarily provide your personal information

Where you have provided consent, we may send you marketing communications and news regarding Substance001 Ltd products, services, events, and promotions. You can opt out at any time after giving consent.

If you are an existing customer or employee of Substance001 Ltd, we may use the contact details you have provided to send you marketing communications about similar products or services, where permitted by applicable law (unless you have opted out).

We do not sell your personal data.

We may share your personal data with other organisations in the following circumstances:

• If the law or a public authority requires us to share the personal data
• If we need to share personal data in order to establish, exercise, or defend our legal rights (this includes providing personal data to others for the purposes of preventing fraud and reducing credit risk)

We use data processors – third parties who provide elements of services for us. We have Data Processor Agreements in place with these processors. This means they may not do anything with your personal information unless we have instructed them to do so. They will not share your personal information with any organisation apart from us or approved sub-processors, who must comply with the same agreement. They will hold your personal data securely and retain it only for the period we instruct.

This also applies to competition data, which may be shared with delivery partners or fulfilment services solely for the purpose of prize distribution or confirmation of eligibility.

Substance001 Ltd operates globally, with teams and operations in the United Kingdom, United States, Argentina, and Singapore. As such, your personal data may be accessed, transferred, or processed outside of the UK, including in countries that may not offer the same level of data protection as the UK.

Where this occurs, we ensure that appropriate safeguards are in place to protect your data, in accordance with UK data protection law. This may include:

• Entering into standard contractual clauses approved by the UK Information Commissioner’s Office (ICO)
• Ensuring third parties in other countries meet comparable data protection standards
• Limiting access to personal data and using secure transfer methods

Regardless of where your data is processed, we maintain the same high standards of security and privacy to protect your information.

To process your personal data, we rely on a number of lawful bases, depending on how you interact with our platforms.

These include:

• Consent – where we have obtained your clear permission to process your data
• Contractual necessity – where processing is required to fulfil a contract with you
• Compliance with law – where required by legal obligations
• Vital interests – where necessary to protect someone’s life

Legitimate interests – where processing is necessary for our business interests and is not overridden by your rights or interests

You have a number of rights under UK data protection law. These include:

• The right to be informed about the collection and use of your personal data
• The right to access your personal data (via a Subject Access Request)
• The right to correct inaccurate, incomplete, or outdated personal data
• The right to restrict or object to certain types of processing
• The right to request erasure of your personal data ("right to be forgotten") in specific circumstances
• The right to data portability, allowing you to move or copy your personal data

To exercise any of these rights, please contact us at operations@substanceglobal.com. We may require proof of identity to ensure we are releasing data to the correct person.

We take the security of your data seriously. Measures we use to protect your personal information include:

• Limiting access to buildings and systems using security passes or cards
• Access controls for digital systems and platforms
• Encryption, anonymisation, and secure archiving techniques
• Regular reviews of our data protection practices

We will never ask you to share your passwords.

We retain your personal information only for as long as necessary to provide a high-quality and consistent service, and in accordance with UK Data Protection Legislation.

For competition participants and winners, we only retain personal data for the period necessary to administer and fulfil the competition, verify eligibility, and deliver any prizes—unless we are required to retain it for longer by law.

If you have any questions about this policy or how we handle your data, you can contact us via the ‘Contact Us’ facility on our website or by emailing operations@substanceglobal.com.

The Information Commissioner’s Office (ICO) regulates data protection and privacy in the UK. You can find out more about your rights, or raise a complaint directly with them at: https://ico.org.uk/for-the-public. However, we always encourage you to contact us first — your satisfaction is extremely important to us, and we’ll do our very best to resolve any issues.