Privacy policy

1.Controller

This company, registered in England and Wales and publicly searchable in the Companies House register under the company number above, is the controller for all processing described in this privacy policy. Questions and requests concerning personal data reach us via the address above or the contact page.

2.What we process, and why

This shop processes only what selling and delivering research material requires:

• Order and delivery data, your name, email address, billing and delivery address, the products ordered and the amount paid, entered by you on Stripe’s checkout page and passed to us so that we can dispatch the parcel, issue the invoice and deal with withdrawal, complaints and defects;
• Payment data: card numbers and other payment credentials are entered on Stripe’s page and processed by Stripe. We receive the confirmation that the payment succeeded and the order reference, never the card number, as the payment page describes;
• Correspondence, emails to our inbox, including certificate requests, withdrawal notices and complaints, to answer them and to document what was agreed;
• Server access logs kept by our hosting provider, IP address, time and requested page, to keep the site available and secure.

The legal bases are performance of a contract for order and delivery data, our legal obligations for invoices and commercial records, and our legitimate interest in running a secure website and defending claims for logs and correspondence.

No decision about you is taken by automated means and no profiling takes place. The site itself is plain HTML without accounts or logins, so there is no password of yours for us to hold and no customer login that could be attacked; the only form you fill in during an order is Stripe’s hosted checkout page.

3.What happens in your browser

The site sets no cookies. The basket you fill lives in your browser’s localStorage, on your own device, and its contents are sent to our server only when you start checkout, to create the Stripe session. The fonts are loaded from Google Fonts, so Google receives the IP address of that request; Google states that the Fonts API does not use cookies. There are no analytics, advertising or social-media trackers here, and no accounts or logins. The cookie policy has the detail.

4.What we do not do

• No sale or rental of personal data to anyone, ever;
• No advertising profiles built from your orders;
• No processing of data categories the shop does not need, we do not ask why you order, and we do not record it;
• No transfers beyond what payment, delivery, hosting and legal obligations require.

5.Recipients

Data reaches third parties only where the order requires it. Stripe processes the payment and hosts the checkout page under Stripe’s privacy policy. The carrier receives the delivery details needed to bring the parcel to you, as described on the shipping page. The hosting provider processes the technical data of every page request, and Google receives the IP address when fonts are loaded. Authorities receive data only where the law compels it.

6.Retention

Order and invoice data are kept for as long as commercial and tax law require and are then deleted. Correspondence is kept while it is relevant to an order or to an open matter such as a complaint or a withdrawal, and removed afterwards. Server logs are the hosting provider’s standard logs; we neither extend nor copy them. Data with no remaining purpose is removed.

7.Your rights

Under the General Data Protection Regulation you may request access to your data, rectification, erasure, restriction of processing and a portable copy, and you may object to processing based on legitimate interest. One email to info@peptideonline24.com exercises any of these, and the answer comes in writing.

You may also complain to a supervisory authority, in the United Kingdom the Information Commissioner’s Office, or the data protection authority of your own EU member state. Nothing in this document limits that right or asks you to contact us first.