Privacy Policy

Effective date: 3 May 2026

BluePeak Peptides (“BluePeak”, “we”, “us”, “our”) respects your privacy. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and what rights you have.

This policy is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller: BluePeak Peptides

Contact: support@peptidesresearch.uk

Information We Collect

We collect the following categories of personal data:

Identity & contact data: name, email address, billing and shipping address, telephone number.
Order & transaction data: products ordered, order value, payment confirmation, dispatch and tracking records, refund history.
Account data: username, password (hashed), preferences.
Technical data: IP address, browser type and version, device identifier, operating system, time zone, referring URL, pages viewed.
Marketing & communications data: your preferences for marketing emails and your communication history with our support team.
Age confirmation: the fact that you have confirmed you are 18 or over.

We do not knowingly collect data from anyone under 18.

How We Collect Information

We collect personal data:

Directly from you when you register an account, place an order, or contact us.
Automatically through cookies and similar technologies when you use the Site.
From third parties such as payment processors, delivery carriers, and analytics providers.

How We Use Your Information

We use your data to:

Process, dispatch, and track your orders
Communicate with you about orders, deliveries, and support enquiries
Verify your age and prevent fraud
Maintain accounts and secure logins
Improve the Site, our products, and the customer experience
Send marketing or product updates only with your consent, which you can withdraw at any time
Comply with our legal, tax, and accounting obligations

Who We Share Your Data With

We share data only with the following categories of recipient:

Payment processors (e.g. Stripe, PayPal, or our card acquirer) to process your payment securely.
Shipping carriers (Royal Mail, DHL, FedEx, etc.) to deliver your order.
Hosting & infrastructure providers that host the Site and our database.
Email & marketing providers that send transactional and (with consent) marketing emails.
Analytics providers (anonymised or pseudonymised wherever possible).
Professional advisors (legal, accounting) bound by confidentiality.
Public authorities, where required by law (court order, tax authority, customs request, etc.).

We do not sell your personal data to anyone.

Legal Bases (UK GDPR)

We rely on the following lawful bases:

Contract: to fulfil your order and provide customer service.
Legitimate interest: to operate, improve, and secure the Site, prevent fraud, and keep records.
Legal obligation: to retain tax/accounting records and comply with consumer law.
Consent: for non-essential cookies and for marketing communications.

Cookies

We use essential cookies to operate the Site (cart, login, security) and optional cookies for analytics and marketing. You can manage your preferences via the cookie consent banner or your browser settings.

Children

The Site and our products are not directed to anyone under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us and we will delete it.

Security & Retention

We use industry-standard security measures: TLS/SSL encryption in transit, hashed passwords, restricted admin access, regular software updates, and monitored hosting. No transmission method is 100% secure; we cannot guarantee absolute security but we work to protect your data.

Retention periods:

Order, invoice, and tax records: 7 years from the date of the transaction (UK statutory requirement).
Account data: for as long as your account is active, plus 12 months thereafter.
Marketing data: until you opt out or unsubscribe, plus a short suppression period.
Support communications: 24 months.
Server logs / technical data: typically up to 12 months.

Your Rights

Under UK GDPR you have the right to:

Access the personal data we hold about you
Request correction of inaccurate data
Request erasure (“right to be forgotten”)
Restrict or object to processing
Data portability
Withdraw consent at any time (where processing is based on consent)

To exercise any right, email support@peptidesresearch.uk. We respond within one calendar month.

Complaints

If you have a concern about how we handle your data, please contact us first at support@peptidesresearch.uk and we will work to resolve it.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO):

Website: ico.org.uk
Helpline: 0303 123 1113

International Transfers

Some of our processors are located outside the UK/EEA (for example, in the United States). When we transfer your data outside the UK/EEA, we use appropriate safeguards such as the UK International Data Transfer Agreement (IDTA), the EU Standard Contractual Clauses (SCCs), or transfers to countries with an adequacy decision.

Changes to This Policy

We may update this policy from time to time. The most current version is the one published on this page, and the effective date at the top will reflect the latest update. Material changes will be communicated where required by law.

Contact

For any privacy enquiry or to exercise your rights:

BluePeak Peptides

Email: support@peptidesresearch.uk