Privacy Policy

Biogenetic Research Labs Ltd, company number 17298432, registered office 20 Wenlock Road, London, England, N1 7GU, is the data controller.

We have not appointed a Data Protection Officer, because we are not required to. Data protection questions go to hello@protocolpeptides.co.uk.

We are in the process of registering with the Information Commissioner’s Office, and will publish our registration number here before launch.

• Identity and contact data. Name, email address, telephone number, delivery address, billing address, and the name of the organisation where you give one.
• Account data. Login credentials in hashed form, order history, saved addresses, communication preferences, and the date of your last activity.
• Order and transaction data. What you ordered, when, the price, delivery method, tracking reference, and the batch numbers dispatched to you.
• Payment data. Card payments are processed by our payment provider. We receive the outcome, the last four digits, the card type and the billing address. We never receive or store your full card number, expiry date or security code.
• Compliance data. The age confirmation and research-use confirmation you give at the gate and at checkout, with the date, time and a truncated IP address. We hold this because it is the evidence that the confirmation was given.
• Cookie consent data. Your cookie choices, the time you made them, the policy version, and a random consent identifier. This record is not linked to your account.
• Technical and usage data. IP address, browser and device type, operating system, referring page, pages viewed, and interaction events.
• Communications data. Emails, contact form messages and support correspondence.

What we do not collect. We do not ask for and do not want health data, medical history, or any other special category data under Article 9 of the UK GDPR. Do not send it to us. If you send it anyway we will delete it and will not use it.

We do not sell personal data and we do not share it for anyone else’s marketing.

We use the following categories of processor. Each is bound by a written contract meeting Article 28 of the UK GDPR.

We also disclose data where the law requires it, including to HMRC, Border Force, the MHRA, the police, or a court.

Where a processor is outside the UK, we transfer data only if the destination is covered by UK adequacy regulations, or under the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. You can ask us for a copy of the safeguard used for a specific transfer.

Under the UK GDPR you have the right to:

• Be told what we hold and get a copy of it.
• Have inaccurate data corrected.
• Have data erased, where we do not need it for a legal obligation such as tax records.
• Restrict how we use it while a question about it is resolved.
• Receive data you gave us in a portable machine readable form.
• Object to processing based on legitimate interests, and object at any time to direct marketing.
• Withdraw consent at any time, without affecting anything done before you withdrew it.

If you have an account, you can request a copy of your data, correct your details, or ask for your account and data to be erased from Your data. You can also email hello@protocolpeptides.co.uk. We respond within one month. There is no charge. We may ask you to confirm your identity first.

Where we cannot erase everything, we tell you exactly what we are keeping and why. Order, invoice and compliance records are kept for six years because tax law and our regulatory position require it; the rest is deleted.

We do not make decisions about you by automated means alone that produce a legal or similarly significant effect. Our payment provider runs automated fraud screening on transactions, which can result in a payment being declined. If that happens you can contact us and we will look at it manually.

The site is served over TLS. Passwords are stored hashed and salted. Access to order and personal data is restricted to named personnel and is logged. Payment card data never reaches our systems. We keep a record of security incidents and will notify the ICO within 72 hours, and you without undue delay, where a breach meets the threshold in Articles 33 and 34.

Cookies and similar technologies are covered in full in our Cookie Policy. You can change your choices at any time from Cookie Settings in the footer.

All compounds catalogued by Biogenetic Research Labs Ltd are for in-vitro laboratory research only. They are not medicinal products, are not for human or veterinary use, and are not intended for diagnosis or treatment. Nothing you send us about your intended research constitutes health data about you, and you should not send us health information about yourself or anyone else.

If you are not satisfied with how we have handled your data you can complain to the Information Commissioner’s Office.

We would prefer the chance to put it right first. Email hello@protocolpeptides.co.uk.

We update this policy when our processing changes. The effective date is at the top of this page. Where a change is significant we tell account holders by email.