Privacy Policy

Last updated: 16 September 2026

This policy explains how Peptide Origin Limited collects, uses and protects your personal data when you visit peptideorigin.com, place an order, contact us, or receive emails from us. It is written to meet the requirements of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Peptide Origin Limited is the data controller for the personal data described in this policy.

• Registered in England and Wales, company number 16688695
• Registered office: 2nd Floor College House, 17 King Edwards Road, Ruislip, London, United Kingdom, HA4 7AE
• Contact for privacy matters: sales@peptideorigin.com

We are not required to appoint a Data Protection Officer, but any questions about this policy or your data will be answered by the address above, normally within 12 hours.

2. The data we collect

Identity and contact data — your name, email address, billing and delivery address, and phone number if you provide one.

Order and transaction data — the products you order, order value, order history, and payment references. Payments are taken by bank transfer, open banking (Klyme) or Revolut. We never see or store your card numbers or online banking credentials; we receive only confirmation that payment was made and a payment reference.

Account data — if you create an account: your login email, password (stored hashed, never readable by us), and saved addresses.

Communications — emails you send to sales@peptideorigin.com and our replies.

Site chat — If you use the on-site support chat widget: the messages you send and receive, an opaque session identifier, and technical data used for security and abuse prevention (such as a hashed IP address and browser type). If you ask us to look up an order, when order lookup is available in chat we will ask only for your order number and delivery postcode to verify the request. We do not ask for passwords or full payment card numbers in chat. Please do not send health or medical information in chat; if you do, we will refuse that request and will not keep that content longer than needed for security.

Reviews — if you choose to leave a review, the review text and the name you submit with it. Reviews are limited to delivery, packaging and customer service and are moderated before publication.

Marketing preferences — whether you have opted in to review invitations, new-product updates and offers, and any unsubscribe requests.

Technical and usage data — IP address, browser and device type, pages visited and how you reached the site. Non-essential cookies and similar technologies are used only with your consent — see section 5.

We do not knowingly collect any special category data, and we do not want it: please do not send us health information.

3. How we use your data, and the legal basis for each use

We do not use automated decision-making that produces legal or similarly significant effects, and we never sell your personal data.

4. Who we share your data with

We share personal data only with service providers who need it to perform the purposes above:

• Payment providers — Klyme (open banking payments) and Revolut process the data needed to take your payment. Direct bank transfers are visible to our bank.
• Delivery — Royal Mail receives your name and delivery address to deliver your order.
• Hosting and email — our website hosting provider and IONOS (our email provider) process data on our systems, including order emails and support correspondence.
• Site support chat — Vercel (London/EU preferred), Neon (EU), and IONOS (existing email for sales@ escalations) process chat messages and related technical data on our instructions so we can run the support widget. Where a provider processes data outside the UK (including any Vercel US edge fallback), transfers are protected by the UK International Data Transfer Agreement / Addendum or Standard Contractual Clauses with the UK addendum, or another lawful mechanism as applicable.
• Analytics and advertising — with your consent, Google (Google Analytics 4 and Google Ads), Microsoft Advertising and TikTok set cookies or similar identifiers to measure site usage and ad performance. Jetpack (Automattic) provides site statistics.
• Review invitations — sent through the review system on our own website; your review data is not shared with any third-party review platform.
• Professional advisers and authorities — accountants, lawyers, insurers, banks, and regulators or law enforcement where the law requires it.

Each provider acts under a contract that restricts what they may do with your data.

5. Cookies

When you first visit the site you are asked whether to accept non-essential cookies. Essential cookies (for the cart, checkout and security) always run; statistics and marketing cookies run only if you accept them. You can change or withdraw your choice at any time using the cookie settings link in the footer. Full details of every cookie and service are in our Cookie Policy.

The support chat widget prefers session storage rather than cookies; see our Cookie Policy. Non-essential analytics or advertising technologies are not loaded by the chat widget without your consent.

6. International transfers

Some of our providers (Google, Microsoft, TikTok, Automattic) process data outside the UK, including in the United States. Where that happens, transfers are protected by the UK Extension to the EU–US Data Privacy Framework or by the UK International Data Transfer Agreement / Addendum (standard contractual clauses), as applicable.

7. How long we keep your data

• Order, invoice and payment records — 6 years from the end of the relevant financial year, as required for tax and company-law purposes.
• Customer accounts — until you ask us to delete your account.
• Support correspondence (email and similar) — up to 24 months after the matter is closed.
• Site chat transcripts — retained for up to 90 days from last activity, unless the chat was escalated into a dispute, complaint, or legal claim, in which case we may retain the relevant transcript for as long as needed to establish, exercise or defend that claim (and in line with our email support correspondence period where the matter continues by email). Content that appears to be health or dosing information is refused and is not retained longer than needed for security and abuse prevention.
• Marketing preferences — until you unsubscribe; we then keep a minimal suppression record so we do not contact you again.
• Analytics data — held in aggregate; user-level analytics data is retained for no more than 14 months.

8. Your rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Erase your data in certain circumstances
• Restrict or object to processing, including objecting at any time to direct marketing
• Data portability — receive the data you gave us in a machine-readable format
• Withdraw consent at any time where processing is based on consent (this does not affect processing before withdrawal)

To exercise any right, email sales@peptideorigin.com. We will respond within one month. We may ask you to confirm your identity before acting on a request.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113. We would appreciate the chance to resolve your concern first.

9. Marketing — opting out

Every marketing email and review invitation we send includes an unsubscribe link. You can also opt out of all marketing at any time by emailing sales@peptideorigin.com. Order confirmations, dispatch notifications and other service messages are not marketing and will still be sent.

10. Age restriction

Our products and website are intended for adults. You must be at least 18 years old to place an order, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will delete it.

11. Security

The site is served over HTTPS, passwords are stored hashed, payment credentials never touch our systems, and access to customer data is limited to those who need it. No system is perfectly secure, but if a breach occurs that risks your rights, we will notify you and the ICO as the law requires.

12. Changes to this policy

We will update this policy when our processing changes — for example, if we connect a new email marketing platform or add a new advertising channel — and change the date at the top. Significant changes will be flagged on this page.