Privacy & Cookie Policy
How we collect, use, and protect your data under UK GDPR, PECR, and US state privacy laws.
Who we are
PHQ LTD ("we"), trading as Peptide HQ, is the data controller for personal data collected through this site. PHQ LTD is registered in England and Wales, company no. 17260440. Registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Contact: customerservices@peptide-hq.com.
What we collect and why (UK GDPR Art. 6 lawful bases)
We collect: contact and account details, shipping address, order history, and the research-use/age confirmation you provide. We process this to fulfil your order (performance of a contract), to meet legal and record-keeping obligations (legal obligation), and — only where you have opted in — to send marketing (consent). We also process limited technical data for site security and analytics, where consented.
Cookies & tracking (PECR)
We use strictly necessary cookies to operate the site, which do not require consent. Analytics and marketing cookies (including any advertising pixels) are only set after you give consent via our cookie banner, in line with the Privacy and Electronic Communications Regulations. You can withdraw consent at any time.
Visitor analytics
Where you have accepted analytics cookies, we measure site usage to understand visitor numbers and conversion. We do this with a randomly generated, anonymous visitor identifier stored on your device — this visitor measurement does not record your IP address or precise location, and we do not use device fingerprinting. (Advertising measurement, described below, does use your IP address for a limited period where you have consented to marketing cookies.) This lets us count unique visitors, visits, and how many visitors go on to add to cart, reach checkout, and purchase. The lawful basis is your consent (PECR/UK GDPR); visitors who choose "essential only" are not tracked, and you can withdraw consent at any time. We keep the raw per-visitor session records for up to 30 days and thereafter retain only anonymised, aggregated daily totals (visitor and visit counts), which cannot identify you.
Session recording & heatmaps
Where you have accepted analytics cookies, we use Microsoft Clarity to record how pages are used — clicks, scrolling, mouse movement and the order in which you move through a form — so we can find and fix where our checkout is confusing. Microsoft acts as our processor and may process this data outside the UK/EEA under appropriate safeguards.
What you type is not recorded. Every field on our checkout — email, name, delivery address, phone number and discount code — is masked before the recording leaves your browser, so we see that a field was filled in, never its contents. We take no card details on this site at any point, as payment is completed on your own bank's pages. The lawful basis is your consent; choosing "essential only" means no recording takes place, and you can withdraw consent at any time.
Advertising measurement
Where you have accepted marketing cookies, we send purchase events to Meta so we can tell which adverts lead to orders. To match an order to an advert click, this includes your IP address, browser user-agent, Meta's own click identifiers, and a hashed (irreversibly scrambled) copy of your email, phone, name, town and postcode. We delete the IP address, user-agent and click identifiers after 90 days. The lawful basis is your consent; visitors who choose "essential only" are not included.
Checkout details & abandoned carts
When you enter details at checkout — your email, name, shipping address and phone number — we save them against your order, including where the order is not completed (an "abandoned" or incomplete checkout). We process this data to fulfil your order (performance of a contract) and, for incomplete checkouts, to recover the sale — for example to let you resume where you left off and to send a reminder. The lawful basis for processing the details of an incomplete checkout is our legitimate interest in recovering potential sales; any reminder email is additionally sent only where you have given marketing consent (PECR). We automatically delete the personal data from abandoned/incomplete checkouts (email, name, address, phone) after 30 days; anonymised, non-identifying basket contents may be retained for analytics. You can object to this processing or ask us to erase your data sooner at any time by contacting customerservices@peptide-hq.com.
Marketing & abandoned-cart emails
We send marketing and cart-reminder emails only to customers who have given consent (or, where applicable, under the PECR "soft opt-in" for existing customers regarding similar products). Every marketing email contains an unsubscribe link.
If you submit your email through our sign-up offer (for example the "10% off your first order" popup), we store your email address and the date with your consent as the lawful basis, in order to send you that discount code and subsequent marketing emails. You can unsubscribe at any time via the link in any email, or by contacting customerservices@peptide-hq.com, and we will stop and erase your details on request.
Your rights — UK/EU
You have the right to access, rectify, erase, restrict, or port your data, and to object to certain processing. You may lodge a complaint with the UK Information Commissioner's Office (ICO).
Your rights — US (CCPA/CPRA and other state laws)
Residents of California and other US states with comprehensive privacy laws have the right to know what personal information we collect, to access and delete it, to correct it, and to opt out of "sale" or "sharing" of personal information and of targeted advertising. We do not sell personal information for money. To exercise these rights, contact customerservices@peptide-hq.com.
Retention & security
We keep personal data only as long as necessary for the purposes above and to meet legal/accounting obligations, then delete or anonymise it. We use appropriate technical and organisational measures to protect it.