Privacy policy

Who we are

PepLab (peplab.bio) is the operator of this e-commerce site for research peptides. For questions about personal data, please use the contact form on the site (/en/contact).

What data we collect

We collect only the data needed to process orders, respond to requests, and communicate with you:

• Identification and contact data: name, email, phone
• Delivery data: address, postal code, city, county, sector (if applicable)
• Order data: products, quantities, total, status, notes associated with the order
• Contact form messages: name, email, phone, and the message content submitted via the contact page
• Basic technical data: essential cookies / local storage (e.g. shopping cart, 18+ age confirmation, cookie preferences)
• Analytics data (optional): if you accept analytics cookies, Google Analytics 4 may collect data about site usage (see dedicated section)
• Anti-spam protection data: on the order form and the contact form we use Google reCAPTCHA (see dedicated section)

We do not request medical data and we do not process card payments on the site. Payment is made on delivery (cash on delivery).

How we use the data

We use the data to:

• process, confirm, and deliver orders
• communicate about the order (confirmation email, delivery clarifications)
• respond to messages sent through the contact form
• administer stock and internal operations
• comply with applicable legal obligations
• improve the site based on analytics data (only with consent)
• prevent abuse / spam (reCAPTCHA)

We do not sell personal data to third parties for marketing purposes.

Who can access the data

Access is limited to:

• the PepLab operator (order administration, contact messages, and the site)
• technical providers required to run the service: hosting (Vercel), database (Turso), transactional email (Resend), image storage (Vercel Blob), the delivery courier
• Google — for Google Analytics 4 (if you consented) and for reCAPTCHA on the order and contact forms
• authorities, only if the law requires it

These providers process data only as needed to provide the service.

Google Analytics 4

If you choose Accept all in the cookie banner, we load Google Analytics 4 (GA4) to measure traffic and shop events (e.g. product view, add to cart, begin checkout, purchase).

• Legal basis: consent
• What may be collected: pages visited, device/browser type, approximate location, cookie/analytics identifiers, shop interaction events
• When it is NOT loaded: if you choose Necessary only, the GA4 script is not loaded
• Withdrawing consent: clear site data in your browser (or localStorage for the key peplab-cookie-consent) and reload the page to choose again
• Google policy: https://policies.google.com/privacy

Google reCAPTCHA

On the order page and the contact page we use Google reCAPTCHA v3 (invisible score-based verification) to reduce automated orders / spam.

• Legal basis: legitimate interest in protecting the shop, the contact form, and users
• Google may process technical data (e.g. IP, device type, risk signals) under its policies
• reCAPTCHA terms: https://www.google.com/recaptcha/about/
• Google policy: https://policies.google.com/privacy

Contact form

When you send a message via /en/contact, we collect your name, email address, phone number, and message as required fields. This data:

• is stored in our admin system so we can respond to your request
• may trigger an email notification to the PepLab team
• may be anonymized (contact details removed) after the request has been handled
• is not used for marketing

Legal basis: legitimate interest in responding to your requests and, where applicable, steps prior to entering a contract at your request.

Legal bases for processing

We process data on the basis of:

• performance of the sales contract (order)
• legitimate interest in operating and securing the shop, preventing abuse, and responding to contact messages
• consent, where required (analytics cookies)

How long we keep the data

We keep order data as long as needed for delivery, support, accounting, and legal obligations. Contact form messages are kept as long as needed to resolve the request; after resolution, identification data (name, email, phone) may be deleted from the admin system, while the message context may be retained in anonymized form. Local cart data (browser) stays on your device until you delete it. Cookie preference is stored locally on the device.

Your rights

Under applicable law, you may request:

• access to your data
• rectification
• erasure (where applicable)
• restriction of or objection to certain processing
• data portability, where applicable
• withdrawal of consent for analytics cookies

To exercise your rights, use the contact form on the site (/en/contact).

Cookies

We use cookies / local storage for:

• cart and essential session functionality
• 18+ age confirmation
• cookie consent preferences
• Google Analytics cookies / identifiers, only after accepting analytics cookies
• technical components related to reCAPTCHA on checkout and the contact form

Updates

We may update this policy. The version published on the site is the applicable one.