Privacy Policy

1. Information we collect

• Personal identification: Name, email address, phone number, and shipping or billing address when you place an order or create an account.
• Payment data: Payment information is processed securely by PCI-DSS compliant third-party payment providers. We do not store your full card or bank details on our servers.
• Technical data: IP address, browser type, device information, pages visited, time on site, and referring URL collected via essential cookies and, where consented, analytics tools.
• Order data: Purchase history, product preferences, and cart contents for the duration of your session and as needed to fulfil orders.
• Communication records: Support messages submitted through our Contact page, email correspondence, and customer service interactions.

2. How we use your information

• Order fulfilment (Art. 6(1)(b) GDPR): Processing and shipping your orders, managing your account, and providing customer support.
• Legitimate interest (Art. 6(1)(f) GDPR): Fraud prevention, website security, service improvement, and maintaining accurate order records.
• Consent (Art. 6(1)(a) GDPR): Non-essential analytics or marketing communications — only where you have given explicit opt-in.
• Legal obligation (Art. 6(1)(c) GDPR): Tax compliance, invoicing records, and regulatory documentation as required by applicable EU law.
• Anonymised analytics: Aggregated, non-identifying usage data to understand how our website is used and improve the experience.

3. Data sharing

• Shipping partners: Name and delivery address shared with EU-based logistics providers solely for order fulfilment and tracking.
• Payment processors: Payment data processed by certified third-party providers for secure transaction handling.
• Analytics (if consented): Anonymised or pseudonymised usage data only, without selling personal information for third-party marketing.
• Legal authorities: When required by applicable law, court order, or to prevent fraud and protect our rights.
• We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

4. Cookies

• Essential cookies: Required for cart functionality, session management, authentication, checkout, and security. These cannot be disabled while using the storefront.
• Analytics cookies: Help us understand how visitors use our site. Set only with your consent where required by law.
• Preference cookies: Remember settings such as language, region, or display preferences where supported.
• You can manage optional cookie preferences at any time using Cookie Settings in the site footer. Essential cookies cannot be disabled while using the storefront.

5. Your rights under GDPR

• Right of access (Art. 15): Request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): Correct inaccurate or incomplete personal data.
• Right to erasure (Art. 17): Request deletion of your personal data where applicable (“right to be forgotten”).
• Right to restrict processing (Art. 18): Limit how we use your data in certain circumstances.
• Right to data portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format where applicable.
• Right to object (Art. 21): Object to processing based on legitimate interests in certain cases.
• Right to withdraw consent (Art. 7(3)): Withdraw consent for optional processing at any time, without affecting prior lawful processing.
• To exercise any of these rights, email support@peptides-eu.net with “GDPR Request” in the subject line. We will respond within 30 days as required by GDPR.

6. Data retention

• Order and transaction data: Retained as required for tax, accounting, and legal compliance under applicable EU regulations.
• Account data: Retained while your account is active and deleted upon verified request where retention is no longer required by law.
• Marketing consent records: Maintained until you withdraw consent.
• Browsing and analytics data: Retained only as long as necessary for the stated purpose, then anonymised or deleted.
• Data is processed and stored using providers and infrastructure appropriate to EU-based commerce, with encryption in transit on all site pages.

7. Security

• Encryption: SSL/TLS encryption on all pages and data transmissions between your browser and our services.
• Payment security: Payments processed through PCI-DSS compliant third-party providers.
• Access controls: Personal data access restricted to authorised personnel on a need-to-know basis.
• We review our security practices regularly, but no online transmission or storage system is completely secure.

8. Contact

• Data controller: Peptides EU (peptides-eu.net), European Union.
• Email: support@peptides-eu.net — include “GDPR Request” in the subject line for data protection inquiries.
• Supervisory authority: If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local EU data protection authority.

9. Updates to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements.

Any changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically.