Privacy Policy

1. Who we are

This Privacy Policy explains how Total Peptides Limited, a company incorporated in England and Wales with company number 17454125 (trading as Total Peptides, "we", "us", "our"), collects, uses, stores and protects personal data when you use our website at https://www.totalpeptides.uk (the "Site"), create an account, contact us or purchase our products.

This Privacy Policy should be read together with our Terms and Conditions and any other notices we provide to you at the point personal data is collected. Our Terms and Conditions govern the purchase and use of our products; this Privacy Policy explains how we process personal data.

Data Controller: for the purposes of applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Total Peptides Limited is the controller of the personal data described in this Privacy Policy.

Registered Office: 2 Virginia Gardens, Lofthouse, Wakefield, WF3 3TE.

ICO Registration: ICO registration number: pending.

Data Protection Contact: if you have any questions about this Privacy Policy, our use of personal data, or wish to exercise a data protection right, please contact us at legal@totalpeptides.uk.

2. Information we collect

We collect and process the following categories of personal data, depending on how you interact with us.

2.1 Information you provide to us

Identity and contact data: name, email address, phone number (optional), billing address, and shipping address, including the name on each delivery or billing address.

Account data: email address and password used to create an account on the Site. Passwords are handled by our authentication provider (Supabase) in a manner designed to protect them; we do not store passwords in plain text. If you create or sign in to an account using Google, we receive your name and email address from that provider rather than a password.

Order and transaction data: details of orders and transactions, including products purchased, quantities, prices, dates, order history, payment references and related records.

Payment information: for card payments, Stripe tells us the payment status, an amount, and a tokenised reference — we do not receive or store your card number. For Pay by bank payments (via Fena), we receive the name of your bank, a payment reference, the amount, the payment status, a transaction identifier, and the payer name and account details Fena shares with us to confirm the payment. We never see or store your online-banking login details — you enter them directly with your own bank, not with us or with Fena.

Research-use declaration: for each order, we record your research-use declaration together with your email address, IP address, device information (user-agent), a timestamp, and your order reference. We use this information to evidence the basis on which products were supplied and to maintain appropriate compliance, risk-management, and legal records.

Age confirmation: we record your confirmation that you are 18 years or older where this is required as part of checkout.

Newsletter and marketing data: your email address and, where provided, first name if you choose to receive our marketing communications.

Stock alert requests: your email address and the product size you asked us to notify you about.

Quote requests: if you submit a quote request through our Institutions page, we collect your organisation's name and type, your name, role (optional), work email address, telephone number (optional), the products and quantities you are asking about, your payment preference and any purchase order number, a delivery postcode, any notes you add, and your research-use confirmation.

Customer support communications: information you provide when contacting us by email, telephone or otherwise, including the content of correspondence and information needed to deal with your enquiry or complaint.

User-generated content: if you submit a product review, we collect your email address, chosen display name, and review text. We cross-match your email against order history to set a verified purchase flag.

2.2 Information collected automatically

Technical data: IP address, browser type and version, device information, operating system and other similar technical data.

Usage data: information about how you use the Site, including pages viewed, time spent and navigation paths, to the extent generated by essential functionality or otherwise lawfully collected.

Log data: server and security logs, including request timestamps, HTTP methods, response status codes and security events. These are generally retained for up to 12 months unless a longer period is reasonably necessary for security, investigation or legal purposes.

Cookie and local storage data: we currently use only essential cookies and similar technologies, including small amounts of browser local storage to remember functional preferences such as whether you have dismissed a popup, whether you have already subscribed to our newsletter, and whether you have already confirmed the research-use notice during your current visit. See Section 8 for further information.

2.3 Information from third parties

We may receive limited personal data from third parties where necessary to provide our services or protect our business. For example, Fena (Pay by bank) and, where offered, Stripe (cards) provide us with payment references, transaction information or other information needed to confirm a payment. Delivery providers may provide delivery status or related information. If you sign in using Google, that provider gives us the name and email address associated with your account. Where we obtain personal data from another source, we will provide any information required by applicable law.

2.4 Special-category data

We do not intentionally request or routinely process special-category personal data, including health or medical information, biometric data, genetic data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, or information concerning a person's sex life or sexual orientation. Customers should not provide health, medical or other sensitive information to us unless specifically requested for a lawful purpose. If such information is provided to us, we will handle it in accordance with applicable data protection law and delete it when it is no longer required, subject to any lawful retention requirement.

3. How we use your information

We use personal data only where we have a lawful basis to do so. The lawful basis we rely on depends on the purpose of the processing and may include performance of a contract, compliance with a legal obligation, legitimate interests, or consent.

3.1 To provide and manage the Site and your account — to create and manage your account, authenticate logins (including via Google sign-in), maintain your session and provide account functionality; to enable basket functionality, checkout and other requested Site features; to communicate with you about your account, orders and service-related matters. Legal basis: performance of a contract with you (Article 6(1)(b) UK GDPR); and, where appropriate, our legitimate interests (Article 6(1)(f) UK GDPR) in operating, maintaining and securing the Site, preventing unauthorised access and providing account services.

3.2 To process orders and deliver products — to process and confirm payments via Fena (Pay by bank) and, where offered, Stripe (cards); to arrange delivery with couriers and logistics providers and track parcels in transit; to maintain order, transaction, research-use and age-confirmation records for legal, compliance, risk-management, accounting and legal-claim purposes; to handle cancellations, returns, refunds, complaints and other post-order matters where applicable, including assessing claims made under our Delivery Guarantee (see our Shipping & Delivery page) for orders that do not arrive, and processing any photographic evidence you provide for a damaged-parcel or replacement claim. Legal basis: performance of a contract with you (Article 6(1)(b)); compliance with legal obligations (Article 6(1)(c)), including applicable tax, accounting and record-keeping requirements; and legitimate interests (Article 6(1)(f)) in maintaining appropriate business and compliance records, preventing misuse, enforcing our contractual rights and establishing, exercising or defending legal claims.

3.3 To communicate with you — to send order confirmations, shipping updates, service messages and other communications necessary to administer your account or order; after delivery, we may send one service email inviting you to review your purchase; to respond to enquiries and provide customer support; to maintain appropriate records of customer communications where reasonably necessary. Legal basis: performance of a contract (Article 6(1)(b)) and, where appropriate, legitimate interests (Article 6(1)(f)) in providing customer support, maintaining service quality and handling disputes or legal claims.

3.4 Newsletter and marketing (optional) — to send marketing emails where you have provided valid consent, keeping a record of when and how you subscribed; to measure email engagement — our marketing emails contain tracking pixels and instrumented links to measure open and click activity. Legal basis: consent (Article 6(1)(a) UK GDPR). You may withdraw consent at any time by contacting legal@totalpeptides.uk.

3.5 To improve, secure and defend the Site and our business — to monitor Site performance, availability and security; to detect and prevent fraud, abuse, malicious activity and technical attacks; to investigate suspected misuse, chargebacks, disputes and other incidents; to comply with legal, regulatory and law-enforcement requirements where applicable; to establish, exercise or defend legal claims. Legal basis: legitimate interests (Article 6(1)(f) UK GDPR) in operating and securing our systems, preventing fraud and misuse, protecting our customers and business, maintaining appropriate records, enforcing our rights and handling disputes and legal claims; and compliance with legal obligations (Article 6(1)(c)) where required. Our legitimate interests include maintaining and securing our website and systems; preventing fraud and misuse; maintaining appropriate business and compliance records; responding to customer enquiries; enforcing our contractual rights; and establishing, exercising or defending legal claims. Where we rely on legitimate interests, we consider whether the processing is necessary and balance our interests against your rights and freedoms.

3.6 Automated security and fraud-prevention measures — we may use automated security and fraud-prevention measures, including rate-limiting and analysis of IP addresses, login activity, transaction information and request patterns, to detect and prevent misuse, fraud, attacks and other suspicious activity. These measures may temporarily restrict access or require additional verification. They are designed to protect the Site and are not intended to make solely automated decisions that produce legal or similarly significant effects on you.

3.7 To manage and display customer reviews — to verify your purchase and publicly display your chosen display name, rating, and review text on our Site. Legal basis: legitimate interests (Article 6(1)(f) UK GDPR) in displaying customer feedback to improve our services and inform other users.

3.8 To send you a one-off email when a product size you asked about is back in stock. Legal basis: your request/consent (Article 6(1)(a)); you can withdraw it at any time by contacting us, and the alert is deleted once sent.

3.9 To respond to a quote request — to review your request, reply with a quote, issue a pro-forma invoice or accept a purchase order, and keep a record of the request and our reply. Legal basis: taking steps at your request before entering into a contract (Article 6(1)(b) UK GDPR); and legitimate interests (Article 6(1)(f)) in administering business enquiries.

4. Automated decision-making and profiling

We do not currently use solely automated decision-making or profiling that produces legal effects or similarly significant effects on customers. Where our service providers use automated systems for purposes such as payment fraud prevention, those systems may be operated by the provider as part of its own processing and may be governed by that provider's privacy notice and legal obligations.

If we introduce processing that involves solely automated decision-making producing legal or similarly significant effects, we will comply with the safeguards and information requirements applicable at that time and update this Privacy Policy where required.

5. Data sharing and disclosure

We do not sell your personal data. We may share personal data with the following recipients or categories of recipients where necessary for the purposes described in this Privacy Policy or where required or permitted by law:

Payment processors: Fena Labs Ltd, trading as Fena (Pay by bank), an FCA-authorised payment institution (FRN 934835). Fena may act as a processor for some processing and as an independent controller for other processing, including its regulated payment-initiation, fraud-prevention and compliance activities. Your own bank also processes the payment under its own terms when you approve it in your banking app.

Payment processors: Stripe Payments UK Ltd and relevant Stripe group companies or service providers, where card payments are offered, and for historic orders placed by card and any related refunds. Stripe may act as a processor for some processing and as an independent controller for other processing, including certain fraud-prevention, security and compliance activities.

Authentication and database hosting: Supabase, Inc. for user authentication (including Google sign-in), account management and secure storage of relevant Site data.

Sign-in providers: Google LLC, where you choose to create an account or sign in using its services — it acts as an independent controller of the data it provides to us and processes it under its own privacy policy.

Email and newsletter services: Resend and relevant infrastructure providers for transactional and marketing emails.

Website hosting and infrastructure: Vercel Inc. for hosting the Site and processing technical information necessary to provide, secure and maintain it.

Email hosting: Microsoft 365 / Microsoft Ireland Operations Limited and relevant Microsoft entities for business email and related services.

Delivery partners: courier, logistics and fulfilment providers to deliver orders and manage delivery issues.

Professional advisers: lawyers, accountants, insurers, auditors, consultants and other professional advisers where reasonably necessary.

Regulators, authorities and other third parties: where required by law, regulation, court order or lawful request, or where reasonably necessary to protect our rights, safety, property or the integrity of our business.

Domain and email reseller: GoDaddy, for domain administration and Microsoft 365 services.

6. International data transfers

Some of our service providers may process personal data outside the United Kingdom. Where a restricted transfer of personal data occurs, we will use a lawful transfer mechanism under UK data protection law, such as UK adequacy regulations, the UK Extension to the EU-U.S. Data Privacy Framework where applicable, the UK International Data Transfer Addendum, the International Data Transfer Agreement, or another mechanism permitted by law.

Fena: Fena Labs Ltd, trading as Fena, is a UK-regulated payment institution (FRN 934835). Fena states in its own privacy policy (https://www.fena.co/useful/privacy-policy) that personal data is stored on secure systems located in Europe, specifically the United Kingdom, and that its suppliers are only given incidental access from outside Europe (for example, to provide customer support or to troubleshoot its app), always under European data protection rules that those suppliers are contractually bound to follow.

Stripe: Stripe may process personal data in the United States and other jurisdictions. For relevant transfers from the UK, Stripe states that it relies on the UK Extension to the EU-U.S. Data Privacy Framework and, where applicable, the UK International Data Transfer Addendum or other contractual mechanisms. Further information is available in Stripe's privacy and data-transfer documentation at stripe.com/legal/privacy and stripe.com/gb/legal/dta.

Resend: Resend may process personal data in the United States or other jurisdictions in connection with email delivery. Where a restricted transfer occurs, the transfer will be made using an appropriate lawful transfer mechanism under UK data protection law, as applicable to the relevant processing arrangement.

Supabase: our Supabase project is hosted in London. Where processing occurs outside the UK, including through subprocessors, backups or support access, the relevant transfer will be subject to the safeguards and transfer mechanisms contained in Supabase's applicable Data Processing Agreement and related documentation.

Vercel: Vercel may process technical data such as IP addresses and request logs in the United States and other jurisdictions as part of hosting and delivering the Site. Where a restricted transfer occurs, Vercel's applicable Data Processing Agreement and an appropriate UK transfer mechanism will apply.

Google: if you sign in using Google, that provider may process personal data outside the UK as part of its own services, under its own privacy policy and transfer safeguards.

Microsoft 365: Microsoft 365 may process business email and related personal data outside the UK, including through global infrastructure used for support, maintenance and security. Microsoft's applicable data protection terms and UK transfer safeguards will apply to relevant restricted transfers.

General: we review material changes to our service providers, subprocessors and international transfer arrangements and will update this Privacy Policy where necessary. Where appropriate, information about relevant transfer safeguards may be obtained from us at legal@totalpeptides.uk.

7. Data retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including any legal, regulatory, tax, accounting, security or legal-claim requirements. Where we do not specify a fixed period below, we use criteria such as the nature of the data, the purpose of processing, the sensitivity of the information, the risk of harm from unauthorised use or disclosure, applicable legal requirements, and whether a dispute or investigation is ongoing.

Account data: retained while your account remains active. Following closure, we will delete or anonymise account data when no longer reasonably required, subject to any lawful retention requirement or need to establish, exercise or defend legal claims.

Order and transaction data: typically retained for up to 6 years from the end of the relevant company financial year, or longer where required by law or reasonably necessary for legal claims, audits, investigations or other lawful purposes.

Research-use declarations and age confirmations: typically retained for up to 6 years from the end of the relevant company financial year, or longer where reasonably necessary to evidence the basis on which products were supplied, comply with applicable requirements, or establish, exercise or defend legal claims.

Newsletter and marketing data: retained while you remain subscribed or until you otherwise object or withdraw consent. After unsubscribing, we may retain a minimal suppression record for as long as necessary to ensure that we do not send further marketing to that address.

Technical and security log data: generally retained for up to 30 days, unless a longer period is reasonably necessary for security, incident investigation, or legal purposes.

Customer support communications: retained for as long as reasonably necessary to resolve the relevant matter, maintain appropriate business records and establish, exercise or defend legal claims. The retention period will depend on the nature and circumstances of the enquiry.

User-generated content: published reviews are retained indefinitely unless you exercise your right to erasure.

Stock alert requests: deleted 30 days after the alert is sent, or after 6 months if the product does not come back into stock.

Quote requests: retained for as long as reasonably necessary to respond to the request and maintain appropriate business records; where an order follows, the order and transaction data retention period above applies to the resulting order records.

Where personal data is subject to a legal hold, active dispute, investigation, regulatory matter or other lawful preservation requirement, we may retain it for the duration of that matter even if the usual retention period has expired. When personal data is no longer required, we will securely delete or anonymise it unless further retention is necessary for a lawful purpose.

8. Cookies and similar technologies

8.1 Essential cookies and local storage — we use only technologies that are strictly necessary to provide the Site, including session cookies, secure authentication cookies, and local storage used to remember functional preferences such as whether you have dismissed our popup, whether you have already subscribed to our newsletter, and whether you have confirmed the research-use notice during your current visit. Where Stripe or Fena use cookies on their hosted payment pages, their own terms apply.

8.2 Cookie audit — we periodically audit our cookie and local storage usage. We will update this Policy where our use of these technologies changes.

8.3 Future non-essential cookies — if we introduce non-essential cookies or similar technologies, such as analytics, advertising or behavioural tracking technologies, we will provide the information and obtain consent required by applicable law before setting or using them where consent is required.

8.4 Managing cookies — you can manage or disable cookies through your browser settings and, where applicable, through our cookie-consent controls. Disabling essential cookies may affect the functionality of the Site.

9. Data security

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction, damage, alteration or disclosure. Measures may include: secure transmission of data using HTTPS/TLS where appropriate; use of reputable service providers and contractual arrangements designed to protect personal data; access controls and internal procedures limiting access to personal data to authorised persons who need it for their role; secure authentication practices and protection of account credentials (we do not store passwords in plain text); and rate-limiting, monitoring and other security controls designed to detect and prevent abuse and cyber threats.

Personal data breach management: we maintain procedures for detecting, assessing and responding to personal data breaches. Where required by applicable data protection law, we will notify the Information Commissioner's Office of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk to individuals' rights and freedoms, we will notify affected individuals without undue delay where required by law.

No method of transmission over the internet or electronic storage is completely secure. While we take reasonable and appropriate measures to protect personal data, we cannot guarantee absolute security.

10. Your rights

Subject to applicable legal conditions and exemptions, you may have the following rights in relation to your personal data: the right of access, to request a copy of the personal data we hold about you; the right to rectification, to request correction of inaccurate or incomplete personal data; the right to erasure, to request deletion of your personal data in certain circumstances; the right to restriction, to request that we restrict processing in certain circumstances; the right to data portability, where applicable, to receive personal data you have provided to us in a structured, commonly used and machine-readable format and transmit it to another controller; the right to object, to object to processing based on legitimate interests or to direct marketing (where you object to direct marketing, we will stop processing your personal data for that purpose); rights relating to automated decision-making, to benefit from the protections provided by applicable law in relation to solely automated decision-making producing legal or similarly significant effects; and the right to withdraw consent, where processing is based on consent, at any time (withdrawal does not affect the lawfulness of processing carried out before withdrawal).

To exercise your rights, please contact us at legal@totalpeptides.uk. We will normally respond within one month of receiving a valid request, subject to any lawful extension. We may ask for information reasonably necessary to verify your identity before acting on a request. We may refuse or limit a request where permitted by law, including where a legal exemption applies, and will explain this where appropriate.

Data protection complaints: if you have concerns about how we have handled your personal data, you may contact us at legal@totalpeptides.uk. We will provide a clear means of raising a data protection complaint, acknowledge receipt of a complaint within 30 days, investigate it appropriately and communicate the outcome without unjustifiable or excessive delay. We encourage you to contact us first so that we can try to resolve your concern.

You also have the right to complain to the Information Commissioner's Office (ICO). The ICO's contact details are: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom. Website: https://www.ico.org.uk

11. Security vulnerability reporting

If you believe you have found a security vulnerability affecting the Site, please report it to security@totalpeptides.uk. Please provide sufficient information for us to investigate and, where reasonably possible, avoid accessing, altering, deleting or disclosing personal data that is not necessary to demonstrate the vulnerability.

We ask that you do not publicly disclose a vulnerability until we have had a reasonable opportunity to investigate and remediate it. Nothing in this section authorises access to systems or data that would otherwise be unlawful, and our response to any report will not limit any rights or remedies available under applicable law.

12. Children and minors

The Site is not directed at, and is not intended for use by, anyone under the age of 18. We do not knowingly collect personal data from individuals under 18 as customers or account holders.

If we become aware that we have collected personal data from an individual under 18, we will take reasonable steps to delete that information as soon as practicable, unless we are required by law to retain it or have another lawful reason to do so.

If you are under 18, please do not use the Site, create an account, place an order or provide personal data to us. If a parent or guardian believes that a person under 18 has provided personal data to us, they may contact legal@totalpeptides.uk.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technologies, data-processing activities, suppliers, legal requirements or regulatory guidance. We will publish the updated version on the Site and update the effective and last-updated dates. Where required by law, we will provide additional notice of material changes before they take effect.

14. Third-party websites and services

The Site may contain links to third-party websites or services. Those third parties operate under their own terms and privacy notices. We are not responsible for the privacy practices of websites or services that we do not control. You should review the privacy notice of a third party before providing personal data to it.

15. Contact

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Email: legal@totalpeptides.uk

Postal address: 2 Virginia Gardens, Lofthouse, Wakefield, WF3 3TE