Privacy & Cookie Policy
LSPEPTIDES trading as LS Peptides Last updated: [DATE]
1. Who we are
1.1 LSPEPTIDES (“we”, “us”) is the data controller for the personal data described in this policy. We are registered in England and Wales under company number [COMPANY NUMBER], registered office [REGISTERED ADDRESS].
1.2 We are registered with the Information Commissioner’s Office under registration number [ICO NUMBER].
1.3 For any privacy question, or to exercise your rights, contact [PRIVACY EMAIL].
2. What we collect and why
| Data | Why we use it | Lawful basis |
|---|---|---|
| Name, email, phone, billing and delivery address | To take, process, dispatch and support your order | Performance of a contract |
| Order history, payment reference, bank transfer confirmation | To fulfil orders, reconcile payments, handle returns | Performance of a contract |
| VAT number, company number, trading details (wholesale) | To verify and operate a trade account | Performance of a contract; legitimate interests (fraud prevention) |
| Invoices, receipts, tax records | To meet HMRC record-keeping duties | Legal obligation |
| Email address, if you subscribe | To send marketing emails | Consent |
| Messages you send us | To answer your enquiry | Legitimate interests (responding to customers) |
| IP address, device and browser data, pages visited | Website security, fraud prevention, and to understand how the site is used | Legitimate interests; statistical purposes exception (PECR Schedule A1) |
| Age and research-use confirmation | To record that you confirmed eligibility before ordering | Legitimate interests (compliance record) |
2.1 We do not ask for, and you must not send us, any information about your health, medical conditions or intended personal use. Our contact forms are not a route for that information. If you send it we will delete it.
3. Who we share it with
3.1 We share personal data with the following categories of recipient, all of whom act on our instructions:
– Hosting provider — [HOSTING PROVIDER], United Kingdom – Email delivery — [EMAIL PROVIDER], [LOCATION] – Carriers — [CARRIER], for delivery – Accountant / bookkeeper — Luke, for tax records – Our bank — for payment reconciliation
3.2 Where any recipient is outside the UK, we rely on [UK adequacy regulations / the International Data Transfer Agreement / the UK Addendum to the EU Standard Contractual Clauses] as the transfer mechanism.
3.3 We may disclose personal data where we are required to by law, or to a regulator or law enforcement body.
3.4 We do not sell your personal data.
4. How long we keep it
| Record | Retention |
|---|---|
| Order and invoice records | 6 years from the end of the tax year (HMRC) |
| Customer account data | While the account is active, then 2 years |
| Marketing consent and email address | Until you withdraw consent, then a suppression record |
| Support enquiries | 2 years from resolution |
| Age / research-use confirmations | 6 years, alongside the order record |
| Server and security logs | 90 days |
| CCTV, if any | [PERIOD] |
5. Your rights
5.1 You have the right to: be informed; access your data; have inaccurate data corrected; have data erased; restrict processing; data portability; object to processing based on legitimate interests; object to direct marketing at any time; and not be subject to solely automated decision-making with legal effects.
5.2 To exercise any right, email [PRIVACY EMAIL]. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.
5.3 Complaints. If you are unhappy with how we have handled your data, please tell us first at [PRIVACY EMAIL]. We will acknowledge your complaint within 5 working days and respond substantively within 30 days. If you remain dissatisfied you can complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
6. Cookies
6.1 Cookies are small files placed on your device. We use the following:
| Cookie | Purpose | Type | Duration |
|---|---|---|---|
age_gate |
Records that you confirmed you are 18 or over and accepted the research-use notice | Necessary for the service you requested | Session, or 30 days if you tick “remember me” |
age_gate_failed |
Records a negative confirmation | Necessary | Session |
woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_* |
Keeps your basket and checkout working | Strictly necessary | Session to 2 days |
wordpress_logged_in_* |
Keeps you signed in | Strictly necessary | Session |
cookie_consent |
Remembers your cookie choices | Strictly necessary | 12 months |
| [ANALYTICS COOKIE] | Measures how the site is used | Statistical | [PERIOD] |
6.2 Strictly necessary cookies do not require your consent. The age_gate cookie is set only when you click to confirm, and the site cannot be used without it; we consider it necessary on that basis.
6.3 We use analytics under the statistical-purposes exception in PECR Schedule A1. You can object to analytics at any time here: [OBJECTION LINK]. Analytics data is not used for advertising and is not shared with advertising networks.
6.4 We do not use advertising, retargeting or social media tracking pixels. If that changes, we will ask for your consent first and will not set them before you agree.
6.5 You can change your cookie choices at any time using the [COOKIE SETTINGS] link in the footer, or through your browser settings.
7. Security
7.1 The site uses TLS encryption. Access to personal data is limited to staff who need it. We hold no debit or credit card details at any time.
8. Changes
8.1 We may update this policy. The “last updated” date above shows when. Material changes will be notified by email where we hold your address.