Privacy Policy

Chempeptides (“we”, “our”, “us”) respects your privacy and is committed to protecting your personal data in compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Dutch data protection law. This Privacy Policy explains how we collect, use, store, and protect personal data when you visit our website at chempeptides.com or place an order with us.

1Who We Are

Chempeptides is an EU-based supplier of research-grade peptides operating from the Netherlands. We are the data controller responsible for personal data collected through this website. For any privacy-related inquiries, contact us at info-chempeptides@protonmail.com.

2Information We Collect

We collect personal data only when you actively provide it or when it is necessary for the operation of our services:

• Account data: name, email address, password (encrypted), shipping and billing addresses, phone number (optional).
• Order data: purchase history, transaction amounts, payment method (we do NOT store card details — see Section 5).
• Communication data: messages sent through our contact form, customer service emails, support inquiries.
• Technical data: IP address, browser type, device identifiers, pages visited, referring URLs. Collected automatically via cookies and server logs.
• Marketing data: newsletter subscription status, email engagement (only if you opt in).

3Legal Basis for Processing

We process your personal data on the following lawful bases under GDPR Article 6:

• Contract performance — to process and ship your orders, manage your account, and provide customer service.
• Legal obligation — to comply with tax, accounting, and regulatory requirements (e.g. invoice retention).
• Legitimate interest — to prevent fraud, secure our systems, improve our services, and conduct anonymised analytics.
• Consent — for marketing communications, optional cookies, and any non-essential data processing. You may withdraw consent at any time.

4How We Use Your Data

We use your personal data for the following specific purposes:

• Processing and shipping orders, including communication with logistics partners.
• Managing customer accounts and authentication.
• Issuing invoices, receipts, and tax documentation.
• Responding to customer service inquiries and providing technical support.
• Sending order confirmations, shipping notifications, and transactional emails.
• Sending marketing newsletters (only with your explicit opt-in consent).
• Detecting fraud, abuse, and unauthorised access to our systems.
• Improving website functionality, content, and user experience through anonymised analytics.

5Payment Processing

We do not store payment card details on our servers. All payment processing is handled by external, PCI-DSS-compliant payment service providers:

• iDEAL — for Dutch bank transfers
• SEPA Bank Transfer — for EU-wide bank payments
• Bunq Pay — for alternative European payments
• PayPal — for international transactions
• Wero — for modern European mobile payments (where available)

When you complete a payment, only transaction status, reference number, and amount are returned to our systems. Card numbers, CVV codes, and bank credentials are processed entirely by the payment provider under their own privacy policy.

6Cookies and Tracking

We use cookies to ensure the website functions correctly and to improve your experience:

• Essential cookies — required for cart functionality, login sessions, and checkout. Cannot be disabled.
• Preference cookies — remember language selection and user preferences.
• Analytics cookies — anonymised tracking via Google Analytics (only with consent).
• Marketing cookies — for measuring campaign effectiveness (only with consent).

You can manage cookie preferences via your browser settings at any time. Disabling essential cookies may break core website functionality.

7Third-Party Services

We use the following carefully-vetted third-party processors to operate our services:

• Hostinger — web hosting (Lithuania/EU)
• PostNL / DHL / DPD — package delivery and tracking
• Google Analytics — anonymised website usage statistics (optional, consent-based)
• Email providers — for sending transactional notifications

All third-party processors are GDPR-compliant and bound by Data Processing Agreements (DPAs).

8Data Sharing and Disclosure

We do not sell, rent, or trade your personal data to third parties. We share data only:

• With service providers strictly necessary to deliver your order (e.g. shipping carriers).
• With payment processors to complete transactions.
• When required by law, court order, or law enforcement request.
• To protect the rights, property, or safety of Chempeptides, our customers, or others.

9Data Retention

We retain personal data only as long as necessary for the purpose for which it was collected:

• Account data — until you close your account or request deletion.
• Order and invoice data — 7 years (Dutch tax law requirement).
• Marketing subscriptions — until you unsubscribe.
• Server logs — typically 30-90 days.

10Your Rights Under GDPR

As an EU/EEA resident, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”) — request deletion of your data, subject to legal retention requirements.
• Right to restrict processing — limit how we use your data.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing for marketing or based on legitimate interest.
• Right to withdraw consent — for any processing based on consent.
• Right to lodge a complaint — with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).

To exercise any of these rights, contact us at info-chempeptides@protonmail.com. We will respond within 30 days as required by GDPR Article 12.

11International Data Transfers

Our primary data processing takes place within the EU/EEA. Where data is transferred to non-EU countries (e.g. via Google Analytics in the United States), we ensure adequate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission.

12Security Measures

We implement appropriate technical and organisational measures to protect your personal data:

• HTTPS/TLS encryption on all website traffic.
• Encrypted password storage (bcrypt hashing).
• Access controls and authentication requirements for administrative systems.
• Regular security updates and vulnerability monitoring.
• Data minimisation — we collect only what is necessary.

No system is 100% secure. In the unlikely event of a data breach affecting your personal data, we will notify you and the Dutch Data Protection Authority within 72 hours as required by GDPR Article 33.

13Children’s Privacy

Our products and website are intended exclusively for qualified researchers. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware of such data, we will delete it promptly.

14Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or service offerings. The “Last Updated” date at the top of this page reflects the most recent revision. We will notify you of material changes by email (if you have an account) or via a prominent notice on the website.

15Contact Us