Privacy Policy

This policy explains how Peptides Pens ("we", "us", "our") handles personal information when you visit peptidespens.co.uk, place an order, create an account or contact us. We handle your information in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

1. Who we are

We are the controller of the personal information described in this policy, which means we decide how and why it is used.

2. Information we collect

Depending on how you use our website, we may collect:

• Identity and contact details: name, email address, phone number, delivery and billing addresses, and business or organisation name.
• Order and transaction details: products ordered, order value, delivery details, and records of payments made to us. We accept payment by bank transfer, so we see the payer name and payment reference shown on the transfer, but we do not store your full bank login details.
• Account details: your username, password (stored in encrypted form) and order history if you create an account.
• Communications: messages you send us by email, phone, contact form or social channels, and our replies.
• Marketing preferences: whether you have opted in or out of our emails.
• Technical and usage data: IP address, browser type and version, device information, pages visited, time spent on pages and referring site, collected through cookies and similar technologies.

We do not intentionally collect special category data (such as health information) and ask that you do not send it to us. If we need to verify an order or identity, we will tell you what we need and why.

3. How and why we use it

We only use personal information when the law allows us to. The main purposes and the legal bases we rely on are:

Where we rely on legitimate interests, we consider and balance any potential impact on you and your rights before we use your information. We do not make decisions about you using solely automated processing that has a legal or similarly significant effect.

4. Marketing

We may email you about our products, offers and news if you have given consent, or if you have bought from us before and we are marketing similar products (the "soft opt-in"). You can opt out at any time by using the unsubscribe link in any email or by contacting us. We never sell your personal information to third parties for their own marketing.

Opting out of marketing does not stop service messages about your orders, such as confirmations, dispatch and delivery updates.

5. Cookies

Cookies are small files placed on your device. We use:

• Strictly necessary cookies: needed for the website to work, for example to keep items in your basket, manage checkout and keep the site secure. These do not need consent.
• Analytics cookies: help us understand how visitors use the site so we can improve it.
• Marketing cookies (if used): help measure the effectiveness of our advertising.

Where the law requires it, we ask for your consent before setting non-essential cookies, and you can withdraw consent at any time through our cookie settings or your browser settings. Most browsers let you block or delete cookies, but parts of the site may not work properly if you do.

6. Who we share it with

We share personal information only where needed and only with:

• Delivery partners: couriers and postal services, so they can deliver your order.
• Service providers (processors): website hosting, e-commerce and email platforms, analytics providers, and IT support, who act on our instructions under contract.
• Banks and payment providers: to receive and reconcile payments.
• Professional advisers: accountants, lawyers and insurers where necessary.
• Authorities: HMRC, regulators, law enforcement or courts where we are legally required to, or to protect our rights.
• Business transfers: a buyer or investor if our business is sold or restructured, who would be bound to protect your information in line with this policy.

7. International transfers

Some of our service providers may process information outside the UK. Where this happens, we make sure the transfer is protected by an adequacy decision, the UK International Data Transfer Agreement or Addendum, or another safeguard permitted by UK law.

8. How long we keep it

We keep personal information only as long as needed for the purposes above. Our usual periods are:

• Order, invoice and payment records: 6 years from the end of the financial year, to meet tax and accounting requirements.
• Account details: until you ask us to close your account, or after a long period of inactivity.
• Enquiries and correspondence: up to 2 years after our last contact.
• Marketing details: until you unsubscribe or withdraw consent. We then keep a minimal suppression record so we do not email you again.
• Cookie and analytics data: in line with the lifespan stated in our cookie settings.

9. Security

We use appropriate technical and organisational measures to protect your information, including encrypted connections (HTTPS), access controls and trusted service providers. No online system is completely secure, so please use a strong, unique password and tell us straight away if you think your account has been compromised.

10. Your rights

Under UK data protection law you have the right to:

• Be informed about how we use your information, which is the purpose of this policy.
• Access a copy of the personal information we hold about you.
• Rectification: ask us to correct inaccurate or incomplete information.
• Erasure: ask us to delete your information in certain circumstances.
• Restriction: ask us to limit how we use your information in certain circumstances.
• Portability: ask for your information in a portable format where we process it by consent or contract using automated means.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent at any time where we rely on it, without affecting earlier processing.

To use any of these rights, contact us using the details in section 15. We may need to verify your identity first, and we will normally respond within one month. There is usually no fee, although we may charge a reasonable fee or refuse requests that are clearly unfounded or excessive. Some rights are subject to legal exceptions, for example we cannot delete records we are legally required to keep.

11. Complaints

We would like the chance to put things right first, so please contact us if you have a concern. You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk/make-a-complaint or by phone on 0303 123 1113.

12. Children

Our website and products are intended for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us their information, please contact us and we will delete it.

13. Third-party links

Our website may link to other websites, such as review platforms or social media. We do not control these sites and are not responsible for their privacy practices. Please read their privacy policies before sharing any personal information.

14. Changes to this policy

We may update this policy from time to time. The latest version is always on this page with the "last updated" date at the top. If we make significant changes, we will take reasonable steps to let you know.

15. Contact us