Privacy Notice

1. Who we are

The Peptide Company is the controller of the personal data described in this notice. We are a UK sole trader trading under the name The Peptide Company.

• Trading name: The Peptide Company
• Privacy contact: info@thepeptidecompanyuk.com

2. Personal data we collect

We collect the following categories of personal data:

• Order and delivery data. Name, email address, optional telephone number, delivery address, order contents, order value, order reference, order status and delivery/tracking reference.
• Research-use acknowledgements. A record that you confirmed you are aged 21 or over, that the products are for legitimate research purposes, and that you accepted the Research Use Policy and Terms, together with the date/time and policy version.
• Payment data. We do not collect or store your card details. Stripe processes card payments on our behalf and provides us with a payment reference, payment status and amount paid.
• Enquiry data. Name, email address, optional telephone number, subject, message content, your consent record and the submission time.
• Account data. If you create an account: email address, authentication identifiers held by our authentication provider, and your saved profile/address details.
• Technical data. Data processed to deliver and secure the site, including server request logs and error diagnostics held by our hosting and backend providers.

We do not ask for, and ask that you do not send us, health information or other special category data.

3. How we collect your data

Most of the personal data we hold is provided directly by you when you:

• place an order or create an account;
• complete the age-verification and research-use acknowledgement steps;
• submit an enquiry through the contact form;
• correspond with us by email.

We also receive technical data automatically as you use the website, and payment data from Stripe when you complete a transaction.

4. How and why we use your data

We use your personal data for the following purposes and on the following lawful bases:

• To fulfil your order — processing, payment, dispatch, delivery updates and order confirmations. Lawful basis: performance of a contract.
• To respond to your enquiries — Lawful basis: consent (given on the contact form) and our legitimate interests in answering customer questions.
• To verify age and research-use status, and to prevent misuse — Lawful basis: legal obligation and our legitimate interests in supplying research materials responsibly.
• To prevent fraud, maintain security and enforce rate limits — Lawful basis: legitimate interests in protecting the business and our customers.
• For accounting, tax and record keeping — Lawful basis: legal obligation.

We do not currently use analytics or marketing technologies that rely on consent. Any optional analytics or marketing we may introduce in the future will be used only with your consent.

5. Payment processing

Card payments are processed by Stripe. When you pay, your card details are collected inside Stripe's own secure payment form and are transmitted directly to Stripe. They do not pass through, and are not stored by, this website or our database.

Stripe acts as an independent controller for its own fraud-prevention and regulatory purposes. For details of how Stripe handles your data, see Stripe's privacy policy at stripe.com/gb/privacy.

6. Service providers

We work with trusted service providers who process personal data on our behalf. They are:

• Stripe — payment processing.
• Website hosting and infrastructure providers — provide website hosting, database, authentication and backend services required to operate this website.
• Transactional email provider — sends order confirmations, enquiry acknowledgements and internal notifications from our verified sending domain.
• Delivery carrier — given the minimum data needed to deliver your parcel.

We only share the personal data necessary for each provider to perform their service. We do not sell personal data, and we do not share it for third-party marketing.

7. International transfers

Some of our service providers may process data outside the UK. Where this happens, transfers are made under UK-approved safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or to a country covered by UK adequacy regulations.

8. Data security

We use appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. This includes secure hosting, encrypted data transmission, access controls and regular review of our processes.

No online service can be completely secure, and we cannot guarantee the absolute security of information transmitted over the internet. We will notify you and the relevant regulator of any serious personal data breach in accordance with our legal obligations.

9. How long we keep your data

We keep your personal data only for as long as is reasonably necessary for the purposes for which it was collected, including to comply with tax, accounting and legal obligations, to prevent fraud, to resolve disputes and to enforce our agreements.

When data is no longer needed for these purposes, we will delete or anonymise it securely.

10. Your rights

Under UK data protection law you have the right to:

• be informed about how your data is used;
• access a copy of your personal data;
• have inaccurate data corrected;
• request erasure, where the data is no longer needed and no legal obligation requires us to keep it;
• restrict or object to processing, including processing based on legitimate interests;
• data portability, for data you provided to us under contract or consent;
• withdraw consent at any time, without affecting processing carried out before withdrawal.

If you would like to exercise any of these rights, please contact us at info@thepeptidecompanyuk.com.

11. Cookies and browser storage

We use a small amount of strictly necessary browser storage for the basket, checkout, age acknowledgement and sign-in. We do not currently operate analytics or advertising technologies. Full details, and how to change your choices, are in our Cookie Policy.

12. Automated decision-making

We do not carry out automated decision-making that produces legal or similarly significant effects on individuals. Stripe may apply automated fraud checks to a payment as part of its processing.

13. Contact us and making a complaint

For any questions about this notice or how we handle your personal data, please email us at info@thepeptidecompanyuk.com with the subject "Data protection request".

If you are unhappy with how we have handled your personal data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority: ico.org.uk/make-a-complaint, or by telephone on 0303 123 1113.

14. Changes to this notice

We may update this notice from time to time. The version in force is the one published on this page. Last updated: 7 August 2026.