Introduction
PeptiLux ("we", "us", "our") is committed to protecting the personal data of everyone who visits or purchases from our website at peptilux.eu. This Privacy Policy explains what data we collect, how we use it, and the rights you have under the General Data Protection Regulation (GDPR) and applicable European data protection law.
By using our website or placing an order, you acknowledge that you have read and understood this policy. If you have questions, contact us at support@peptilux.eu.
Data We Collect
We collect only the data necessary to operate our service. The table below summarises what we collect and why.
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email address | Account creation, order confirmation emails, customer support | Contract performance |
| Shipping address, phone number | Order fulfilment and delivery | Contract performance |
| Crypto payment reference (wallet address, invoice ID) | Payment processing and order verification | Contract performance |
| Order history, product selections | Account management, repeat purchase facilitation | Contract performance / Legitimate interest |
| Anonymous page views, click events | Website analytics to improve user experience (Umami) | Legitimate interest (no personal identifiers stored) |
| IP address (transient, server logs) | Security, fraud prevention, server error diagnosis | Legitimate interest |
We do not collect, store, or process payment card numbers. All cryptocurrency payment processing is handled by an authorised third-party payment processor. We receive only a confirmation status and a transaction reference, no private wallet keys or sensitive financial credentials are stored on our systems.
How We Use Your Data
Your personal data is used exclusively for the following purposes:
- Processing and fulfilling your research compound orders
- Sending order confirmation and shipping notification emails via a third-party transactional email service
- Providing customer support and responding to enquiries
- Complying with legal obligations (e.g., record-keeping for tax and regulatory purposes)
- Detecting and preventing fraud or abuse of our platform
- Improving our website through aggregated, anonymous analytics
We do not sell, rent, or trade your personal data to third parties for marketing purposes.
Third-Party Services
We use a small number of trusted third-party services to operate PeptiLux. Each processes data only to the extent necessary for their service:
- Payment processing provider, cryptocurrency payments are processed by an authorised third-party provider. Only a transaction reference and confirmation status are shared; no sensitive financial credentials are transmitted to or stored by us.
- Transactional email provider, your name and email address are passed to a trusted email delivery service solely to send order confirmations and shipping notifications.
- Analytics, we use privacy-respecting, cookie-free analytics hosted on our own infrastructure. No personal identifiers are collected, no cross-site tracking occurs, and no data is shared with third parties.
- Hosting infrastructure, our backend server and database are hosted on dedicated infrastructure within the European Economic Area (EEA).
No data is transferred outside the EEA except where a third-party service requires it, in which case adequate safeguards (Standard Contractual Clauses or equivalent) are in place.
Cookies
PeptiLux uses only essential cookies required for the website to function specifically, an authentication session token stored in your browser when you log in to your account. We do not use advertising cookies or third-party tracking cookies.
Our analytics operate in a cookie-free mode by default and do not track you across sites. For full details, see our Cookie Policy.
Data Retention
We retain your personal data for as long as necessary to fulfil the purposes described in this policy:
- Account data, retained for the lifetime of your account. You may request deletion at any time.
- Order records, retained for a minimum of 7 years to comply with tax and accounting obligations.
- Email communications, retained for up to 2 years for customer support continuity.
- Server logs, automatically purged after 30 days.
- Analytics data, anonymous and aggregated; no retention limit applies as no personal data is stored.
Your Rights Under GDPR
If you are located in the European Economic Area, you have the following rights regarding your personal data:
To exercise any of these rights, email us at support@peptilux.eu with the subject line "GDPR Request". We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.
Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted connections (TLS/HTTPS), password hashing, access controls, and regular security reviews. No method of transmission over the internet is 100% secure; if you have concerns about the security of your data, contact us immediately.
Children's Privacy
Our website and products are strictly intended for adults aged 18 and over. We do not knowingly collect personal data from individuals under 18. If we become aware that a minor has provided personal data, we will delete it promptly.
Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Where changes are material, we will notify registered customers by email.
Contact
For any privacy-related questions or requests, please contact us at support@peptilux.eu.