Privacy Policy
Contents
1. Who We Are
BP Peptides ("we", "us", "our") operates the website bppep.co.uk. We are the data controller responsible for your personal data.
Contact: info@bppep.co.uk
If you have any questions about this policy or how we handle your data, please contact us at the email address above.
2. Data We Collect
We may collect and process the following categories of personal data:
| Category | Examples |
|---|---|
| Identity Data | First name, last name, username or similar identifier |
| Contact Data | Email address, postal address, phone number |
| Transaction Data | Details of products purchased, order history, payments made |
| Technical Data | IP address, browser type and version, time zone, browser plug-in types, operating system and platform |
| Usage Data | Pages viewed, links clicked, search terms, referring URL |
| Communications Data | Content of emails or messages you send us |
| Marketing Preferences | Your preferences for receiving marketing communications |
We do not collect any Special Category data (such as health, biometric, or genetic data) and we do not store full payment card details — payments are processed by our third-party payment provider.
3. How We Collect Your Data
- Directly from you — when you place an order, create an account, contact us, subscribe to our mailing list, or submit a form.
- Automatically — via cookies and similar tracking technologies when you browse our website.
- From third parties — such as payment processors (Stripe, PayPal), delivery partners, and analytics providers.
4. How We Use Your Data
| Purpose | Data Used |
|---|---|
| Processing and fulfilling your orders | Identity, Contact, Transaction |
| Managing your account | Identity, Contact |
| Processing payments securely | Transaction (via payment provider) |
| Communicating about your order | Identity, Contact, Transaction |
| Sending marketing emails (with consent) | Identity, Contact, Marketing Preferences |
| Improving our website and services | Technical, Usage |
| Fraud prevention and security | Identity, Technical, Transaction |
| Legal and regulatory compliance | All categories as required |
5. Legal Basis for Processing
Under UK GDPR, we rely on the following legal bases to process your personal data:
- Contract performance — processing necessary to fulfil your orders and manage your account.
- Legitimate interests — fraud prevention, improving our services, and direct marketing to existing customers (where permitted).
- Legal obligation — where processing is required to comply with UK law (e.g. financial record-keeping).
- Consent — for marketing emails to new subscribers and for non-essential cookies. You may withdraw consent at any time.
8. Data Retention
We retain your personal data only for as long as necessary for the purposes set out in this policy:
- Order records: Retained for 7 years to comply with HMRC requirements.
- Account data: Retained for as long as you hold an active account, plus 2 years after the last activity.
- Marketing data: Retained until you unsubscribe or withdraw consent.
- Contact / enquiry data: Retained for 2 years from the date of last contact.
When data is no longer needed, it is securely deleted or anonymised.
9. Your Rights
Under UK GDPR, you have the following rights regarding your personal data:
- Right of access — to request a copy of the personal data we hold about you.
- Right to rectification — to have inaccurate or incomplete data corrected.
- Right to erasure — to request deletion of your data ("right to be forgotten"), subject to legal obligations.
- Right to restrict processing — to limit how we use your data in certain circumstances.
- Right to data portability — to receive your data in a structured, machine-readable format.
- Right to object — to object to processing based on legitimate interests or for direct marketing.
- Rights related to automated decision-making — we do not use solely automated decision-making that produces legal effects on you.
To exercise any of these rights, email us at info@bppep.co.uk. We will respond within 30 days. There is no charge for making a request.
10. International Data Transfers
Some of our third-party providers (such as Google Analytics) may process data outside the UK or European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO).
11. Data Security
We take data security seriously and implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include:
- SSL/TLS encryption for all data transmitted between your browser and our website.
- Secure, access-controlled servers.
- Regular security reviews and updates.
- Restricted staff access on a need-to-know basis.
However, no method of internet transmission is 100% secure. If you believe your data has been compromised, please contact us immediately.
12. Children's Privacy
Our website and products are intended for adults who are qualified researchers or laboratory professionals. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that we have inadvertently collected data from a minor, we will delete it promptly.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date. We encourage you to review this policy periodically.
14. Contact & Complaints
For any questions, requests, or concerns about this Privacy Policy or how we handle your data:
- Email: info@bppep.co.uk
- Contact form: bppep.co.uk/contact
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your data appropriately:
- ICO website: ico.org.uk
- ICO helpline: 0303 123 1113