Privacy policy

1.Controller

This company is the controller for all processing described here. Questions and requests concerning personal data reach us via the address above or the contact page.

2.What we process, and why

We process only what operating a shop requires:

• Order data — name, delivery address, email, ordered products — to perform the contract, arrange delivery and issue invoices;
• Payment confirmation data from payment providers — never full card numbers, which are processed by the providers under their own regimes, as described on the payment page;
• Correspondence — emails to our inbox, including certificate requests and complaints, to answer them and to document commitments made;
• Technical data strictly needed to deliver the website securely, covered in the cookie policy.

The legal bases are performance of a contract, our legitimate interest in operating and defending the business, and legal obligations such as commercial record-keeping.

3.What we do not do

• No sale or rental of personal data to anyone, ever;
• No advertising profiles built from your orders;
• No processing of data categories the shop does not need — we do not ask why you order, and we do not record it;
• No transfers outside what delivery, payment and legal obligations require.

4.Recipients

Data reaches third parties only where fulfilment requires it: carriers receive delivery details, payment providers process payments, and hosting providers process technical data under processing agreements. Authorities receive data only where the law compels it.

5.Retention

Order and invoice data are kept for the statutory commercial retention periods and then deleted. Correspondence is kept while relevant to an order or open matter. Data with no remaining purpose is removed.

6.Your rights

You may request access to your data, rectification, erasure, restriction of processing, and a portable copy, and you may object to processing based on legitimate interest. One email to info@peptideonline24.com exercises any of these.

You may also complain to a supervisory authority — in the United Kingdom the Information Commissioner’s Office, or the data protection authority of your own EU member state.