Privacy Policy — UK Peptides

In short

We collect only what we need to take payment, deliver your order and answer your questions. We never sell your data. Optional analytics run only if you accept them in the cookie banner. You can ask us for a copy of your data, or ask us to delete it, at any time by emailing admin@uk-peptides.org.

This summary is for orientation only. The numbered clauses below are the terms that actually apply.

1.Who we are and how to contact us

UK Peptides is a trading name of AURYXRESEARCH LTD, a private limited company, limited by shares registered in England and Wales under company number 17388727. We are the data controller for personal data collected through ukpeptides.org, which means we decide why and how it is processed.


Registered office	3 Goose Cross, Highfields Caldecote, CB23 7ZL, United Kingdom
Email for privacy matters	admin@uk-peptides.org
Response time	Within one month, as required by Article 12(3) UK GDPR
Support hours	Monday to Friday, 9am–4pm GMT

We are not required to appoint a Data Protection Officer under Article 37 UK GDPR, because we do not carry out large-scale monitoring or process special category data as a core activity. Privacy questions are handled directly by the company owner at the address above.

2.What this policy covers

This policy applies to personal data we process about visitors to ukpeptides.org, customers who place orders, people who contact us, and people who subscribe to our updates. It does not cover third-party websites we link to, such as journal publishers, Companies House or Trustpilot; those operators publish their own privacy notices.

3.The personal data we collect

We collect the following categories of personal data.

Category	Examples	Source
Identity and contact	Name, email address, delivery address, phone number if you give one	You, when ordering or contacting us
Order and transaction	Items ordered, order value, order reference, dispatch and tracking status, invoices	Generated when you order
Payment confirmation	Confirmation that a bank payment succeeded, the amount, and a payment reference	Our payment provider
Account	Email address, hashed password, sign-in timestamps (only if you create an account)	You
Correspondence	Enquiries you send us, and our replies	You
Technical	IP address, browser and device type, pages viewed, referring page	Automatically, when you browse
Analytics and interaction	Page interactions, scrolling, clicks and session replays via Microsoft Clarity, and advertising measurement via Google Ads — only with your consent	Automatically, if you accept analytics cookies

We never see your card or banking credentials. Payments are made by bank transfer through Fena's Open Banking flow. You authenticate directly with your own bank. We receive confirmation that a payment succeeded — never your card number, account credentials or security details.

We do not knowingly collect special category data (such as health data) and we ask you not to send it to us. Because our products are supplied strictly for laboratory research, we do not ask about, record, or want any information about anyone's health.

4.Why we use your data and our lawful basis

UK GDPR requires a lawful basis for each purpose. Ours are set out below. Where we rely on legitimate interests, we have carried out a balancing assessment and consider that our interest does not override your rights.

Purpose	Data used	Lawful basis (Article 6)
Take and fulfil your order, and provide the batch certificate	Identity, contact, order, payment confirmation	6(1)(b) performance of a contract
Send order confirmation, dispatch and tracking emails	Identity, contact, order	6(1)(b) performance of a contract
Answer enquiries you send us	Contact, correspondence, order reference	6(1)(b), or 6(1)(f) legitimate interests in responding to enquiries
Keep accounting and tax records	Identity, order, payment confirmation	6(1)(c) legal obligation
Confirm eligibility (18+, research use)	Identity, order, correspondence	6(1)(c) legal obligation and 6(1)(f) supplying restricted goods responsibly
Prevent and investigate fraud or misuse	Technical, order, correspondence	6(1)(f) legitimate interests in protecting the business
Keep the website secure and working	Technical	6(1)(f) legitimate interests in site security and availability
Understand how the site is used via Microsoft Clarity, and measure our advertising via Google Ads	Analytics and interaction, technical	6(1)(a) consent — you can withdraw it at any time
Send updates you asked for	Contact	6(1)(a) consent — unsubscribe in any message

We do not sell, rent, or trade your personal data, and we do not share it with third parties for their own marketing.

5.Cookies and similar technologies

Under the Privacy and Electronic Communications Regulations 2003 (PECR), we may only place non-essential cookies or similar storage with your consent. Strictly necessary cookies are exempt because the site cannot function without them.

Type	What it does	Consent needed
Strictly necessary	Remembers your basket, keeps you signed in, records your cookie choice, protects against cross-site request forgery	No — exempt under PECR reg 6(4)
Analytics (Microsoft Clarity)	Records page interactions and session replays so we can find usability problems. Sets _clck and _clsk cookies.	Yes — runs only after you choose Accept all
Advertising (Google Ads)	Measures which adverts lead to orders, and supports remarketing. Sets _gcl_* cookies.	Yes — runs only after you choose Accept all

If you choose Essential only, or you ignore the banner, neither Microsoft Clarity nor Google Ads is never loaded and its cookies are not set. If you accept and later change your mind, choose Essential only when the banner next appears, or clear this site's cookies and local storage in your browser; we then clear the Clarity cookies and stop loading it.

Microsoft Clarity may capture what you type into a page. We do not use Clarity on the checkout or account pages, and Clarity's own masking is designed to exclude input contents. Microsoft acts as an independent controller for the data it collects; see the Microsoft Privacy Statement for details.

We share personal data only with the service providers we need to run the business. Each acts on our documented instructions under a written contract that meets Article 28 UK GDPR, except where noted as an independent controller.

Provider	Purpose	Data shared
Supabase	Database, authentication and order storage	Identity, contact, order, account
Fena	Open Banking payment initiation (independent controller for payment data)	Order reference, amount, your bank authentication happens directly with your bank
Royal Mail	Delivery of your parcel (independent controller)	Name, delivery address
Microsoft Clarity	Product analytics and session replay, only with consent (independent controller)	Technical and interaction data
Cloudflare	Website hosting, delivery and security	Technical data in transit
Email delivery provider	Sending order confirmations, dispatch notices and certificates	Name, email, order details
Accountant and HMRC	Statutory accounting and tax reporting	Transaction records

We may also disclose personal data where we are legally required to — for example to a regulator, law enforcement, or a court — or where disclosure is necessary to establish, exercise or defend legal claims. If the business is ever sold or reorganised, customer records may transfer to the buyer, who would remain bound by this policy.

7.International transfers

Some providers process data outside the United Kingdom. Where that happens we rely on a transfer mechanism permitted by Chapter V UK GDPR — either UK adequacy regulations, or the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. You may request a copy of the safeguards applying to a specific transfer by emailing admin@uk-peptides.org.

8.How long we keep your data

We keep personal data only as long as we need it for the purpose it was collected, plus any period we are legally required to retain it.

Record	Retention period	Reason
Order and transaction records	6 full financial years after the end of the accounting period	Section 386 Companies Act 2006 and HMRC record-keeping requirements
Customer account	Until you close it, then deleted within 30 days except records we must keep for accounting	Contract, then legal obligation
Enquiries and correspondence	24 months from the last message	Legitimate interests — handling follow-ups and disputes
Marketing subscription	Until you unsubscribe, then a suppression record kept indefinitely	So we can honour your opt-out
Analytics data (Clarity)	Per Microsoft's retention schedule, currently up to 13 months	Consent
Server and security logs	Up to 12 months	Legitimate interests — security and diagnostics

When a retention period ends we delete the data or irreversibly anonymise it so it can no longer identify you.

9.How we protect your data

All traffic to and from the site is encrypted with HTTPS/TLS, enforced by HSTS.
Passwords are stored only as salted cryptographic hashes; nobody at the company can read them.
Database access is restricted by row-level security policies and limited to the accounts that need it.
We never store card numbers or banking credentials, because we never receive them.
Access to customer records is limited to those who need it to fulfil orders and answer enquiries.

No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and will tell you directly without undue delay where the risk is high, as required by Articles 33 and 34 UK GDPR.

You have the following rights, free of charge, in relation to your personal data.

Right	What it means
Access (Art. 15)	Get confirmation we hold your data and a copy of it
Rectification (Art. 16)	Have inaccurate data corrected or incomplete data completed
Erasure (Art. 17)	Have data deleted where we no longer need it, subject to records we must keep by law
Restriction (Art. 18)	Ask us to pause processing while a dispute about accuracy or legitimacy is resolved
Portability (Art. 20)	Receive data you gave us in a structured, machine-readable format, or have it sent to another controller
Object (Art. 21)	Object to processing based on legitimate interests, and to direct marketing at any time
Withdraw consent (Art. 7(3))	Withdraw consent for analytics or marketing at any time, without affecting processing already carried out

To exercise any right, email admin@uk-peptides.org. We will respond within one month. That period can be extended by a further two months for complex requests, in which case we will tell you within the first month and explain why. We may ask for information to verify your identity before disclosing data. We do not charge a fee unless a request is manifestly unfounded or excessive.

11.How to complain

If you are unhappy with how we have handled your personal data, please contact us first at admin@uk-peptides.org so we can try to put it right. You also have the right to complain to the UK supervisory authority at any time:


Authority	Information Commissioner's Office (ICO)
Website	ico.org.uk/make-a-complaint
Helpline	0303 123 1113
Post	Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

12.Children and age restrictions

Our products are supplied for laboratory research and are not offered to anyone under 18. We do not knowingly collect personal data from children. If you believe a person under 18 has provided us with personal data, contact us and we will delete it.

13.Automated decision-making

We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22 UK GDPR. We do not profile customers for marketing purposes. Orders are reviewed by a person before dispatch.

14.Changes to this policy

We review this policy at least annually and whenever our processing changes materially. The version number and review date at the top of this page always reflect the current version. If we make a change that materially affects how we use data you have already given us, we will tell you by email before it takes effect where we hold your address.

This policy explains our actual processing in plain terms and reflects UK data protection law as we understand it at the review date. It is not legal advice. If you are relying on it for your own compliance purposes, take independent advice.