You are here:
  1. Home
  2. Privacy Policy

Privacy Policy

Last updated: 17/06/2026

Peptide Direct Ltd ("we", "us", "our") is committed to protecting the personal data of everyone who interacts with our business. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights in relation to it.

We are the Data Controller of the personal data described in this policy. Our principal place of business is at Waterwells Business Park, Kestrel Court, Waterwells Drive, Quedgeley, Gloucester GL2 2AT, United Kingdom. We also operate an EU office at Factory Berlin Mitte, Rheinsberger Str. 76/77, 10115 Berlin, Germany.

This policy applies to personal data collected through our website at peptide-direct.com, through direct contact (email, telephone, or in person), and through the order and account management process.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR) where applicable, and the Data Protection Act 2018.

1. What Personal Data We Collect

We collect the following categories of personal data:

Contact and business information

  • Full name and job title
  • Business name and registered address
  • Email address and telephone number
  • Delivery address

Order and account information

  • Order history and details (compounds ordered, quantities, strengths)
  • Invoice and payment records
  • Account onboarding documentation (business verification, licences, permits)
  • Certificate of Analysis records associated with your orders

Payment information

  • For payments processed via Stripe: payment card details are processed directly by Stripe and are not stored by us. We retain transaction references and payment status only.
  • For payments processed via PayPal: payment details are processed directly by PayPal and are not stored by us. We retain transaction references and payment status only.
  • For bank transfer payments: we may retain your bank account name and sort code/IBAN as provided on remittance advice, solely for reconciliation purposes.
  • For cryptocurrency payments: where payments are made via a third-party crypto payment processor, that processor's own privacy policy applies to the processing of wallet and transaction data. Where payments are made via direct wallet-to-wallet transfer, we retain only the transaction hash and wallet address provided to us for reconciliation purposes. No additional personal data is collected in connection with direct crypto payments.

Website usage data

  • IP address and browser type
  • Pages visited and time spent on the site
  • Referring URL
  • Device and operating system information

Communication data

  • Emails, messages, and enquiries sent to us
  • Notes from telephone conversations where relevant to your account

2. How We Collect Personal Data

We collect personal data in the following ways:

  • Directly from you — when you contact us, submit an enquiry, complete our buyer onboarding process, or place an order
  • Through our website — via cookies and analytics tools (see Section 7 and our Cookie Policy)
  • From payment processors — transaction status and reference data from Stripe, PayPal, or crypto payment processors
  • From publicly available sources — such as Companies House or equivalent business registries, where we verify buyer business legitimacy

3. Why We Use Your Personal Data (Legal Basis)

We process your personal data on the following legal bases:

Performance of a contract (Article 6(1)(b) UK/EU GDPR)

We process your contact details, order information, and payment records to fulfil orders you place with us, manage your account, issue invoices, arrange delivery, and provide post-order support.

Legitimate interests (Article 6(1)(f) UK/EU GDPR)

We process your data where it is in our legitimate interests to do so and those interests are not overridden by your rights, including:

  • Verifying buyer eligibility and business legitimacy as part of our vetting process
  • Maintaining records of orders and transactions for business management purposes
  • Analysing website usage data (via Google Analytics) to improve our website and services
  • Communicating with you about your account, orders, or enquiries
  • Detecting and preventing fraud or misuse of our products

Legal obligation (Article 6(1)(c) UK/EU GDPR)

We are required to retain certain financial and business records under UK tax and company law, and to comply with any applicable regulatory requirements.

Consent (Article 6(1)(a) UK/EU GDPR)

Where we rely on your consent — for example, for non-essential cookies — you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

4. How Long We Retain Your Data

We retain personal data for as long as necessary for the purposes set out in this policy, subject to the following:

  • Order and financial records: retained for a minimum of 7 years in accordance with UK tax and company law requirements
  • Account and onboarding documentation: retained for the duration of your account relationship with us, plus 3 years following account closure
  • Communication records: retained for 3 years from the date of last contact, unless forming part of an order record
  • Website analytics data: retained in accordance with Google Analytics data retention settings (typically 26 months)
  • Enquiries that did not result in an order: retained for 12 months from the date of last contact

Where retention is no longer necessary and there is no legal obligation to retain data, we will securely delete or anonymise it.

5. Who We Share Your Data With

We do not sell your personal data to third parties. We share personal data only where necessary with the following categories of recipient:

Payment processors

  • Stripe Inc. — for card payment processing. Stripe's privacy policy is available at stripe.com/gb/privacy
  • PayPal (Europe) S.à r.l. et Cie, S.C.A. — for PayPal payment processing. PayPal's privacy policy is available at paypal.com/uk/legalhub/privacy-full
  • Cryptocurrency payment processors (where applicable) — where crypto payments are processed via a third-party processor, your data will be subject to that processor's own privacy policy

Logistics and delivery

  • Courier and freight partners — your name, delivery address, and order reference are shared with carriers to fulfil delivery

Analytics

  • Google Analytics (Google LLC) — anonymised website usage data is shared with Google for analytics purposes. Google's privacy policy is available at policies.google.com/privacy. We have enabled IP anonymisation in Google Analytics. Google Analytics data may be transferred to the United States; this is covered by Google's standard contractual clauses with the EU/UK

Professional advisers

  • Accountants, solicitors, and other professional advisers where necessary for legal or financial purposes, subject to professional confidentiality obligations

Regulatory and legal authorities

  • Where required by law, court order, or regulatory authority

All third-party processors we engage are required to process your data only in accordance with our instructions and applicable data protection law.

6. International Data Transfers

Peptide Direct Ltd operates from the United Kingdom and the European Union. Some of our third-party service providers (including Google) are based in the United States. Where personal data is transferred outside the UK or EEA, we ensure that appropriate safeguards are in place, including:

  • Standard Contractual Clauses approved by the UK ICO or European Commission
  • Adequacy decisions where applicable
  • Other legally recognised transfer mechanisms

7. Cookies and Analytics

Our website uses cookies. A cookie is a small text file placed on your device when you visit a website. We use the following categories of cookies:

  • Strictly necessary cookies: essential for the website to function. These cannot be disabled.
  • Analytics cookies: we use Google Analytics to collect anonymised data about how visitors use our website (pages viewed, time on site, traffic sources). This helps us improve the website and our services. These cookies are only placed with your consent.

For full details of the cookies we use, including how to manage or disable them, see our Cookie Policy.

You can manage your cookie preferences at any time via the cookie consent tool on our website.

8. Your Rights

Under UK GDPR and EU GDPR, you have the following rights in relation to your personal data:

  • Right of access: to request a copy of the personal data we hold about you
  • Right to rectification: to request correction of inaccurate or incomplete personal data
  • Right to erasure: to request deletion of your personal data where we no longer have a lawful basis to retain it
  • Right to restriction: to request that we restrict processing of your personal data in certain circumstances
  • Right to data portability: to receive your personal data in a structured, commonly used, machine-readable format where processing is based on consent or contract
  • Right to object: to object to processing based on our legitimate interests
  • Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time

To exercise any of these rights, please contact us at info@peptide-direct.com. We will respond within one month of receiving your request. We may need to verify your identity before processing your request.

You also have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk. In the EU, you may contact the data protection authority in your country of residence.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include secure server infrastructure, restricted access controls, and encrypted transmission of data where applicable.

While we take data security seriously, no system is completely secure. If you have concerns about the security of your data, please contact us at info@peptide-direct.com.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations. The current version will always be available on this page. Where changes are material, we will take reasonable steps to notify affected individuals.

11. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:

Peptide Direct Ltd
Waterwells Business Park, Kestrel Court, Waterwells Drive
Quedgeley, Gloucester GL2 2AT
United Kingdom
Email: info@peptide-direct.com
Telephone: +44 788 048 5232

For EU-related data protection enquiries, you may also contact our EU office at Factory Berlin Mitte, Rheinsberger Str. 76/77, 10115 Berlin, Germany.