Privacy policy

1. Who is responsible

BioPepSyn Lab operates this store and is responsible for the personal data described here. Contact: support@biopepsynlab.com. The contracting seller and business address are available on request and are shown on the commercial invoice where one is issued.

2. What we collect

When you place an order or contact us, we collect:

• Order and delivery details: name, email address, company or institution, phone number, delivery address, destination country, items, quantities, amounts and currency.
• Payment records: the payment method, order number, provider reference (for example a Stripe session or PayPal reference), bank transfer reference, and — for USDT — the transaction ID and receiving address. We do not receive or store card numbers, CVV codes or full bank credentials.
• Order history and correspondence: order events, status changes, notes and messages you send to our support channels.
• Technical and anti-abuse data: a salted hash of your IP address (not the raw address), a hash of your browser user agent, and rate-limit counters. These are used to protect the store and are not used to identify you for marketing.
• Preferences: your cart contents and saved contact details in your browser’s local storage, and your analytics or marketing choices.

We do not ask for, and should never receive, special-category data, government identifiers or card credentials through this store.

3. Why we use it and our legal bases

• To create, price, take payment for, ship and support your order — performance of a contract.
• To prevent fraud, abuse and payment errors, and to keep the store secure — our legitimate interests.
• To meet tax, accounting and record-keeping obligations — legal obligation.
• To send restock or product updates — your consent, which you can withdraw at any time. Transactional emails about an order are not marketing.
• To measure advertising and site performance — your consent where required. You can decline analytics in the site banner.

4. Who receives it

We share only what is needed with:

• our hosting and email providers, which store and transmit the site and order messages;
• payment providers and banks. Card payments, where enabled, are processed by Stripe; PayPal or another provider may process a payment link. Bank transfers are handled by the receiving bank;
• carriers and customs brokers for delivery;
• analytics and advertising providers, only under the choices described in section 7;
• professional advisers, auditors and authorities where required by law.

We do not sell personal data. Blockchain transactions are public by design: if you pay in USDT, the sending and receiving addresses, amount and transaction ID are visible on the public TRON network. We do not write your name, email or address to the blockchain.

5. International transfers

Our providers may process data outside your country, including in the United States, the European Union and the United Kingdom. Where required, we rely on an adequacy decision or standard contractual clauses, together with technical and organisational safeguards.

6. How long we keep it

We keep order, payment and delivery records for as long as needed to fulfil the order, handle disputes, and meet tax and accounting obligations. Our current retention setting is 24 months after the last order activity, unless a longer period is required by law. Rate-limit and anti-abuse counters are kept for a short period (currently up to 48 hours). Marketing preferences are kept until you withdraw consent. Support messages are kept as long as needed to resolve the request.

7. Cookies, local storage and advertising measurement

The cart and your saved contact fields are stored in your browser’s local storage so the checkout works. Our admin session uses an essential, HttpOnly cookie. We do not use advertising cookies before you make a choice in the consent banner.

Where analytics is enabled, we use Google Analytics 4 to understand visits and quote clicks; inquiry text is excluded from analytics. Where advertising measurement is enabled, we may use the Meta Pixel and the Meta Conversions API to measure whether an ad led to a visit or a purchase. Those tools may receive a coarse event name, the page or order value, currency, and — for purchase measurement — hashed identifiers such as a hashed email address, together with technical data. We do not send your name, address, message text, card data or wallet credentials to advertising providers. You can decline analytics and advertising measurement in the banner, and you can change your choice using the privacy choices control.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing, to receive a portable copy of your data, and to withdraw consent. To make a request, email support@biopepsynlab.com. We may need to verify your identity and may retain records required by law. You may also complain to your local data-protection authority.

Where the GDPR or UK GDPR applies, you can object to processing based on legitimate interests. We will stop unless we have compelling grounds or a legal requirement.

9. Security

We use HTTPS, access controls, server-side price validation, hashed IP addresses for rate limiting, and a private database outside the public web root. Card details never reach our servers. No system is perfectly secure; if you believe your order data has been compromised, contact us immediately.

10. Children

This store is for adults aged 18 or older and for research organisations. We do not knowingly collect data from anyone under 18. If you believe a minor has provided data, contact us and we will delete it.

11. Changes and contact

We may update this policy as the store or our providers change. The version in force is the one published on this page. Privacy questions and requests: support@biopepsynlab.com.