Privacy notice

How to contact us

For privacy questions or to exercise your rights, email orders@northpeptidesuk.com or write to the controller at the address above.

Data we collect

• Identity and contact information, such as name, email, telephone number, billing and delivery address.
• Order, delivery, customer-service and transaction information. Payment is by bank transfer; we do not collect or store card details.
• Information you choose to enter in order notes and the checkout “dose/calculation reference” field. This free-text field may reveal sensitive information if you enter it; please provide only what is necessary for your order.
• Technical and consent information, such as IP address, device/browser data, pages and shopping events, analytics identifiers, and your stored analytics choice.
• Messages, reviews and other correspondence you send us.

Purposes and lawful bases

• Contract: to take payment, confirm, fulfil and deliver orders, handle returns, and answer order-related requests.
• Legal obligation: to keep tax/accounting records, protect consumer rights, respond to lawful requests and meet other applicable duties.
• Legitimate interests: to secure the website, prevent fraud, administer the business, maintain records and respond to general enquiries, where those interests are not overridden by your rights.
• Consent: to store or access non-essential analytics/advertising technologies and send associated events to TikTok or Google. You can withdraw consent at any time through Cookie settings.

If we need information to perform a contract or comply with law and you do not provide it, we may be unable to process the order or request.

Recipients and processors

We share only what is necessary with service providers including Resend (transactional email), Vercel (website hosting and serverless infrastructure), and delivery providers such as Royal Mail. With analytics consent, website and shopping-event data may be processed by TikTok and Google. We may also disclose data to professional advisers, regulators, courts, law enforcement, or a purchaser of the business where legally permitted.

International transfers

Some processors, including Resend, TikTok, Google and Vercel, may process data outside the UK. Where UK adequacy regulations do not cover the destination, the relevant provider or controller must use an approved safeguard such as the UK International Data Transfer Agreement, the UK Addendum to EU standard contractual clauses, or another lawful transfer mechanism. Contact us for information about the safeguard relevant to your data.

Retention

We retain order, payment and accounting records for up to six years after the end of the relevant financial year where needed for tax, contract and legal claims. Customer-service correspondence is normally retained for up to two years after the matter closes, unless linked to an order record or dispute. Analytics data is retained according to the configured provider settings; consent choice remains in your browser until you change it or clear site data. We delete or anonymise data when no longer needed, unless law or a dispute requires longer retention.

Your rights

Depending on the circumstances, you may ask for access, correction, erasure, restriction, portability, or to object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing. You also have rights concerning decisions made solely by automated means; we do not use website order data to make solely automated decisions with legal or similarly significant effects. We may need to verify your identity and normally respond within one month.

Complaints

Please contact us first so we can investigate. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

Cookies

See our Cookie Notice for the technologies used and how to change your choice.