Policy
Privacy policy
We collect the minimum needed to take an order, answer an enquiry and keep the site working. This page says exactly what that means.
What we collect
- Order details — name, email, phone, organisation, delivery address and what you ordered.
- Enquiry details — whatever you type into the contact form, plus the email address you give us so we can reply.
- Account details — if you create an account: your name, email, organisation and a hashed password. We never store your password in a readable form.
- Technical data — standard web server logs and aggregate request data generated by our hosting provider.
We do not collect payment card details on this site. No card data is entered, processed or stored here; invoices are sent separately with payment instructions.
How we use it
To fulfil orders, answer enquiries, issue invoices and documentation, keep the site secure, and meet record-keeping obligations that apply to supplying research reagents. We do not sell personal data, and we do not use it to build advertising profiles.
Legal basis
Where a data protection regime such as the GDPR or UK GDPR applies to you, we rely on: performance of a contract (fulfilling your order), legitimate interests (answering your enquiry, securing the site, preventing fraud), and legal obligation (records we are required to keep). Where we rely on consent, you can withdraw it at any time.
Who we share it with
- Carriers — the delivery address and contact details needed to complete a shipment.
- Infrastructure providers — this site runs on Cloudflare, which processes requests and stores site data on our behalf.
- Professional advisers and authorities — where we are legally required to disclose.
That is the complete list. We do not pass your details to marketing networks or data brokers.
Cookies & browser storage
This site sets no advertising or third-party tracking cookies. What it does use:
- A session cookie, set only when you sign in. It holds an opaque identifier, is HttpOnly, and can be revoked server-side.
- Local storage for your cart, so it survives a page refresh. It stays in your browser and is never transmitted to us until you place an order.
Retention
Order records are kept for as long as needed to support the transaction, honour documentation requests and meet record-keeping obligations. Enquiries are kept while the conversation is live and for a reasonable period afterwards. Account data is kept until you ask us to delete the account.
Your rights
Depending on where you live you may have the right to access the personal data we hold about you, correct it, delete it, restrict or object to processing, or receive it in a portable format. Email us and we will act on the request; we will not charge you for it, and we will not make you jump through hoops to exercise it.
Security
Traffic is served over HTTPS. Passwords are stored as PBKDF2-SHA256 hashes with a per-user random salt — we cannot read them, and neither can anyone who obtains the database. Sessions are stored server-side so they can be revoked. Administrative access is restricted and logged.
No system is perfectly secure. If you believe you have found a vulnerability in this site, please tell us before disclosing it publicly and we will work with you on a fix.
Contact
Privacy questions and data requests: info@peptide-medix.com. If you are not satisfied with our response, you may have the right to complain to your local data protection authority.