Privacy Policy and GDPR Compliance

At Peptide Works we value your privacy and are committed to using your personal information solely for managing your account and for the purposes described in this policy.

This policy explains what information is collected when you use this website, how it is collected, where it is held, how long it remains, and what you can require us to do with it. It covers the enquiry and support forms, comments, media you upload, cookies, content embedded from other websites, analytics, and email marketing.

The principle applied throughout is minimisation. We collect what is needed to answer your enquiry, manage your account and fulfil your order, and we do not collect more than that in case it proves useful later. Where a section below describes a category of data, that description is the limit of what is collected rather than an illustrative example.

This policy applies to personal information handled through this website. It should be read alongside our terms and conditions, which govern the use of the website and the basis on which products are supplied.

When you submit a support request or general enquiry, we collect your first name, last name and email address so that we can communicate with you effectively.

Those three items are the whole of what is required to receive an enquiry and reply to it. We do not require additional personal details as a condition of answering a question, and information you choose to include in the body of a message — a laboratory name, an order reference, a shipping query — is processed only to the extent needed to deal with the matter you raised.

Your personal data is stored exclusively in this website's database. No additional copies are maintained elsewhere. The lawful basis for processing this information is our legitimate interest in responding to enquiries directed to us, and, where the enquiry concerns an order, the performance of that contract.

Our web hosting provider is GDPR certified and compliant, and the information held in the website database sits within that hosting environment.

Enquiry correspondence is retained for as long as is necessary to deal with the matter raised and to maintain a record of the exchange where an order or a subsequent query may refer back to it. Where you would like correspondence removed sooner, the rights set out later in this policy apply and can be exercised at any time.

When visitors leave comments on the site, we collect the data shown in the comments form together with the visitor's IP address and browser user agent string. The IP address and user agent are collected to help with spam detection; automated comment spam is identified in large part by patterns in those two fields, and without them the comment function would be unusable.

An anonymised string created from your email address — a hash — may be provided to the Gravatar service to determine whether you use it. The Gravatar service privacy policy is available at https://automattic.com/privacy/. A hash of this kind is a one-way transformation: it allows a match to be checked without the email address itself being transmitted. After your comment is approved, your profile picture is visible to the public in the context of your comment.

Comments are, by their nature, published. Anything you write in a comment, including any personal information you choose to include in the text, is visible to other visitors once approved. Please do not include order references, contact details or any other information you would not want publicly readable — an enquiry through the proper channel is the appropriate route for anything of that kind.

If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images published on the website.

This is worth taking seriously rather than treating as boilerplate. Photographs taken on a phone or a modern camera frequently carry embedded metadata recording the coordinates, the time and the device used, and that metadata travels with the file. It is not visible when the image is viewed, and it is trivially readable by anyone who downloads the file. Stripping location metadata before upload is the only reliable way to prevent it being published alongside the image.

The cookies set by this website, and the periods for which they persist, are as follows.

If you leave a comment on our site, you may opt in to saving your name, email address and website in cookies. These exist for your convenience, so that you do not have to complete your details again when leaving another comment. These cookies last for one year.

If you have an account and log in to this site, a temporary cookie is set to determine whether your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

On logging in, several cookies are also set to save your login information and your screen display choices. Login cookies last for two days and screen options cookies last for a year. If you select "Remember Me", your login will persist for two weeks. If you log out of your account, the login cookies are removed.

If you edit or publish an article, an additional cookie is saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after one day.

Cookies can be cleared or blocked through your browser settings at any time. Blocking cookies that support login and session handling will affect the functioning of account features, which is a consequence of how those features work rather than a restriction imposed by this site.

Articles on this site may include embedded content such as videos, images or articles. Embedded content from other websites behaves in exactly the same way as if the visitor had visited the other website directly.

The practical consequence is that the third-party site can observe your visit to the page carrying its content, and may set its own cookies, apply its own tracking and combine that activity with data it already holds about you if you have an account with it. That processing takes place under the third party's privacy policy rather than this one, and we have no control over it.

Google Analytics

We use Google Analytics to track visitors on this site. Google Analytics uses cookies to collect this data.

In order to comply with regulatory requirements under GDPR, Google has included a data processing amendment. The data we collect is processed anonymously and the "Data sharing" element has been disabled. We do not use other Google services in combination with Google Analytics cookies.

Analytics data is used to understand how the website is used in aggregate — which pages are found, how visitors move between them, which content is not working. It is not used to build a profile of an individual visitor.

You hold rights over the personal information we hold about you, and the mechanisms for exercising them are set out below. Requests are handled through the website's data request process, and each begins with a confirmation step sent to your email address so that a request cannot be made in your name by someone else.

Freedom of information request

We will show you all of the data stored about you on our website. You may then select the data you wish the site owner to anonymise so that it can no longer be linked to your email address. Acting on that request is the site owner's responsibility, and once your data has been anonymised you will receive an email confirmation.

Right to erasure

You are able to submit a request to be erased from the site. When a request is made, you will receive an email confirmation asking you to confirm the deletion request. After that confirmation, the request is added to the requests table for review by the administrator.

If you have content published on the site under any post type, or comments, you will be added to that table so the content can be dealt with. If you have no content, you will receive confirmation of the erasure request and be provided with a six-digit token to keep safe, in case data needs to be recovered after erasure.

The requests table allows the administrator to reassign any content to another user or to delete it. In the case of comments, your content would be made anonymous rather than removed, so that the thread of a discussion is not broken. The administrator can also add users to the erasure requests table manually by email search.

Right of access and data portability

You can request a download of your data. After making the request you will receive a double opt-in confirmation email, after which a file in XML or JSON format is generated and emailed to you for download. The download link expires after forty-eight hours.

Right to rectification and complaints

You can request that data held about you is corrected, or file a complaint. After making the request you will receive a double opt-in confirmation email, and the request is then added to the table for the administrator to handle.

We use email marketing to keep you up to date, and we send newsletters. Each mailshot is fully GDPR compliant and contains an opt-out notification for use if you no longer wish to receive them.

For email marketing we store the absolute minimum: your name and your email address. Nothing further is required to send a newsletter, and nothing further is kept for that purpose.

Opting out takes effect on the mailing list itself and does not affect correspondence relating to an order you have placed. Dispatch confirmations, tracking details and replies to enquiries are not marketing and continue regardless of your newsletter preference.