Last updated: 24th June 2026 Version: 1.0
1. Who We Are
Peptician (“we”, “us”, “our”) operates the website peptician.co.uk. We are the data controller responsible for your personal data collected through this website.
Business name: Peptician.co.uk Registered address: 61 Bridge Street, Kington, HR5 3DJ, United Kingdom Contact email: help@peptician.co.uk
If you have any questions about this privacy policy or how we handle your personal data, please contact us at the email address above.
2. What This Policy Covers
This policy explains:
- What personal data we collect about you
- Why we collect it and the legal basis for doing so
- How we use it
- Who we share it with
- How long we keep it
- Your rights under UK data protection law
- How to contact us or make a complaint
This policy applies to all personal data collected through peptician.co.uk, including data collected when you place an order, create an account, contact us, or browse our website.
3. The Data We Collect
Depending on how you interact with our website, we may collect the following categories of personal data:
Identity and contact data
- Full name
- Delivery and billing address
- Email address
- Telephone number
Transaction data
- Details of products you have purchased
- Order history
- Invoice and payment records (note: we do not store full payment card details — these are handled directly by our payment processor)
Technical data
- IP address
- Browser type and version
- Device type and operating system
- Pages visited and time spent on the website
- Referring website
- Cookie identifiers
Marketing and communications data
- Your preferences for receiving marketing communications from us
- Records of communications you have sent to us
Account data (if you create an account)
- Username and password (stored in encrypted form)
- Saved addresses
- Order history
We do not intentionally collect any special category data (such as health, biometric, or financial data beyond what is necessary to process a transaction). Our products are sold for research purposes, and we do not collect or store any information about the intended use of purchased products by individual customers.
4. How We Collect Your Data
We collect personal data through the following means:
- Direct interactions — when you place an order, create an account, subscribe to our mailing list, contact us via email or a contact form, or complete any form on our website
- Automated technologies — when you browse our website, we automatically collect technical and usage data via cookies and similar technologies (see Section 9 on Cookies below)
- Third parties — we may receive data from analytics providers (Google Analytics), payment processors, and email marketing platforms (Mailchimp) in connection with your interactions with our website
5. Legal Bases for Processing Your Data
Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following:
Performance of a contract (Article 6(1)(b)) Where processing is necessary to fulfil an order you have placed, manage your account, or handle a return or query directly related to a purchase.
Applies to: order processing, delivery, invoicing, customer service related to an order.
Legitimate interests (Article 6(1)(f)) Where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and interests. Our legitimate interests include operating and improving our website, preventing fraud, maintaining the security of our systems, and conducting basic analytics to understand how our website is used.
Applies to: website analytics, fraud prevention, security monitoring, basic business record-keeping.
Consent (Article 6(1)(a)) Where you have given us clear, specific consent to process your data for a particular purpose. You may withdraw this consent at any time.
Applies to: email marketing communications, non-essential cookies.
Legal obligation (Article 6(1)(c)) Where processing is necessary for us to comply with a legal obligation, such as maintaining financial records for tax purposes.
Applies to: VAT and financial record-keeping.
6. How We Use Your Data
We use the personal data we collect for the following purposes:
| Purpose | Data used | Legal basis |
|---|---|---|
| Processing and fulfilling your order | Identity, contact, transaction data | Contract |
| Managing your account | Identity, contact, account data | Contract |
| Processing payment and preventing fraud | Identity, contact, transaction data | Contract / Legitimate interests |
| Delivering your order and managing returns | Identity, contact, transaction data | Contract |
| Responding to customer service queries | Identity, contact, communications data | Contract / Legitimate interests |
| Sending you order confirmations and updates | Identity, contact, transaction data | Contract |
| Sending marketing emails (if opted in) | Identity, contact, marketing preferences | Consent |
| Improving our website and understanding usage | Technical, usage data | Legitimate interests |
| Complying with legal and regulatory obligations | Identity, contact, transaction data | Legal obligation |
We will only use your personal data for the purposes set out above. If we need to use your data for a materially different purpose, we will notify you and, where required, seek your consent.
7. Marketing Communications
We will only send you marketing emails if you have expressly opted in to receive them — for example, by subscribing via our website or checking an opt-in box at checkout.
You can unsubscribe from marketing emails at any time by:
- Clicking the unsubscribe link in any marketing email we send you
- Emailing us at help@peptician.co.uk
Opting out of marketing emails will not affect the transactional emails we send in connection with your orders (such as order confirmations and dispatch notifications).
We use Mailchimp (operated by The Rocket Science Group LLC, USA) to manage and send marketing emails. Mailchimp acts as a data processor on our behalf. Data transferred to Mailchimp may be processed in the United States — Mailchimp maintains appropriate safeguards for international data transfers. For details, see Mailchimp’s Privacy Policy at mailchimp.com/legal/privacy.
8. Who We Share Your Data With
We do not sell your personal data to third parties. We may share your data with the following categories of recipients, strictly for the purposes described in this policy:
Payment processors Your payment details are processed directly by our payment processor(s): Worldpay. We do not store your full card details. Please refer to your payment processor’s privacy policy for details of how they handle your financial data.
Delivery and logistics providers We share your name and delivery address with our courier or postal service provider to fulfil your order.
Email marketing platform We use Mailchimp to manage marketing communications. Your name and email address are shared with Mailchimp where you have subscribed to our mailing list.
Analytics providers We use Google Analytics (operated by Google LLC) to collect aggregated data about how visitors use our website. Google Analytics collects data such as IP address, browser type, pages visited, and time spent on the site. This data is used in aggregated, anonymised form to improve our website. For details, see Google’s Privacy Policy at policies.google.com/privacy.
Website hosting and platform providers Our website is hosted on WordPress infrastructure. Our hosting provider may process technical data as part of routine website operations.
Legal and regulatory authorities We may disclose your personal data to law enforcement, regulatory bodies, or other authorities where required by law, or where we believe disclosure is necessary to protect our legal rights or the safety of others.
All third parties who process data on our behalf are required to handle it securely and only for the purposes we specify.
9. Cookies
Our website uses cookies — small text files placed on your device when you visit — to make the site work properly, understand how it is used, and (where you have consented) support marketing activities.
Strictly necessary cookies These are required for the website to function and cannot be switched off. They include cookies that enable you to add items to your basket, log in to your account, and complete a purchase.
Analytics cookies We use Google Analytics to collect anonymised data about how visitors use our website. This helps us understand which pages are popular, how visitors navigate the site, and where we can make improvements. These cookies are only set with your consent.
For more information on cookies, visit the ICO’s guidance at ico.org.uk/cookies.
10. International Data Transfers
Some of the third parties we use (including Mailchimp and Google Analytics) are based outside the United Kingdom and may process your data in the United States or other countries. Where data is transferred outside the UK, we ensure that appropriate safeguards are in place, such as:
- Standard Contractual Clauses (SCCs) approved for use under UK data protection law
- Adequacy decisions recognising the destination country’s data protection standards
- The UK International Data Transfer Agreement (IDTA) or addendum where applicable
If you would like further information about the safeguards we rely on for any specific transfer, please contact us.
11. Data Retention
We retain your personal data only for as long as necessary for the purposes described in this policy, or as required by law.
| Data type | Retention period |
|---|---|
| Order and transaction records | 7 years (HMRC financial record-keeping requirement) |
| Account data (active accounts) | For the duration of your account, plus 2 years after last activity |
| Marketing preferences and email records | Until you unsubscribe, plus 1 year |
| Customer service communications | 3 years from the date of communication |
| Website analytics data | As per Google Analytics retention settings (typically 14–26 months) |
| Cookie consent records | 1 year from consent |
When data is no longer required, we securely delete or anonymise it.
12. Your Rights Under UK GDPR
Under the UK General Data Protection Regulation and the Data Protection Act 2018, you have the following rights regarding your personal data:
Right of access You have the right to request a copy of the personal data we hold about you (a Subject Access Request). We will respond within one month.
Right to rectification You have the right to ask us to correct inaccurate or incomplete personal data we hold about you.
Right to erasure (“right to be forgotten”) You have the right to ask us to delete your personal data in certain circumstances — for example, where the data is no longer needed for the purpose it was collected, or where you withdraw consent.
Right to restriction of processing You have the right to ask us to restrict how we use your data in certain circumstances — for example, while you contest its accuracy.
Right to data portability Where we process your data based on consent or contract, and processing is carried out by automated means, you have the right to receive your data in a structured, commonly used, machine-readable format, and to transmit it to another controller.
Right to object You have the right to object to processing based on legitimate interests, including profiling. You also have an absolute right to object to processing for direct marketing purposes.
Rights related to automated decision-making We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
How to exercise your rights To exercise any of these rights, please contact us at [INSERT EMAIL]. We will respond within one month. We may need to verify your identity before processing a request. There is no charge for exercising your rights in ordinary circumstances.
13. How We Protect Your Data
We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised access, loss, disclosure, or alteration. These include:
- SSL/TLS encryption for data transmitted between your browser and our website
- Encrypted storage of passwords and sensitive account information
- Access controls limiting which staff or systems can access personal data
- Regular review of our data handling and security practices
No method of transmission over the internet is completely secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security.
14. Children’s Privacy
Our website and products are not directed at children under the age of 18 and we do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.
15. Changes to This Policy
We may update this privacy policy from time to time to reflect changes in our practices, legal requirements, or the services we offer. When we make material changes, we will update the “Last updated” date at the top of this page. We encourage you to review this policy periodically.
16. How to Make a Complaint
If you are unhappy with how we have handled your personal data, please contact us in the first instance at [INSERT EMAIL] and we will do our best to resolve your concern.
If you remain dissatisfied, you have the right to lodge a complaint with the UK’s supervisory authority:
Information Commissioner’s Office (ICO) Website: ico.org.uk Helpline: 0303 123 1113 Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
This privacy policy was prepared as a draft template and must be reviewed by a qualified legal professional before publication. Peptician.co.uk accepts no liability for any reliance placed on this document prior to formal legal review.