Privacy & Cookie Policy
How we collect, use, and protect your data under UK GDPR, PECR, and US state privacy laws. [REVIEW: a data-protection specialist must finalise this and confirm your lawful bases, retention periods, and processor list.]
Who we are
Peptide HQ Ltd ("we") is the data controller for personal data collected through this site. Registered in England & Wales. Contact: support@peptidehq.com. [REVIEW: add company registration number, registered address, and ICO registration number.]
What we collect and why (UK GDPR Art. 6 lawful bases)
We collect: contact and account details, shipping address, order history, and the research-use/age confirmation you provide. We process this to fulfil your order (performance of a contract), to meet legal and record-keeping obligations (legal obligation), and — only where you have opted in — to send marketing (consent). We also process limited technical data for site security and analytics, where consented.
Cookies & tracking (PECR)
We use strictly necessary cookies to operate the site, which do not require consent. Analytics and marketing cookies (including any advertising pixels) are only set after you give consent via our cookie banner, in line with the Privacy and Electronic Communications Regulations. You can withdraw consent at any time. [REVIEW: list each cookie/SDK, its provider, purpose, and duration in a cookie table.]
Checkout details & abandoned carts
When you enter details at checkout — your email, name, shipping address and phone number — we save them against your order, including where the order is not completed (an "abandoned" or incomplete checkout). We process this data to fulfil your order (performance of a contract) and, for incomplete checkouts, to recover the sale — for example to let you resume where you left off and to send a reminder. The lawful basis for processing the details of an incomplete checkout is our legitimate interest in recovering potential sales; any reminder email is additionally sent only where you have given marketing consent (PECR). We automatically delete the personal data from abandoned/incomplete checkouts (email, name, address, phone) after 30 days; anonymised, non-identifying basket contents may be retained for analytics. You can object to this processing or ask us to erase your data sooner at any time by contacting support@peptidehq.com. [REVIEW: confirm the legitimate-interest assessment (LIA), the 30-day retention period, and this wording with a data-protection specialist/solicitor.]
Marketing & abandoned-cart emails
We send marketing and cart-reminder emails only to customers who have given consent (or, where applicable, under the PECR "soft opt-in" for existing customers regarding similar products). Every marketing email contains an unsubscribe link.
Your rights — UK/EU
You have the right to access, rectify, erase, restrict, or port your data, and to object to certain processing. You may lodge a complaint with the UK Information Commissioner's Office (ICO).
Your rights — US (CCPA/CPRA and other state laws)
Residents of California and other US states with comprehensive privacy laws have the right to know what personal information we collect, to access and delete it, to correct it, and to opt out of "sale" or "sharing" of personal information and of targeted advertising. We do not sell personal information for money. To exercise these rights, contact support@peptidehq.com. [REVIEW: confirm which US state laws apply based on where you sell, and add the required "Do Not Sell or Share My Personal Information" link if targeted advertising is used.]
Retention & security
We keep personal data only as long as necessary for the purposes above and to meet legal/accounting obligations, then delete or anonymise it. We use appropriate technical and organisational measures to protect it. [REVIEW: specify retention periods and your data processors — payment provider, email provider, hosting, analytics.]