Privacy policy

Ethereal Peptides is the controller of the personal information described in this policy — meaning we decide what is collected and why.

Privacy enquiries, including requests to exercise the rights in section 9, should be sent through the compliance route on our contact page.

Information you give us. Name, email address, billing and delivery addresses, telephone number where provided, organisation and role where provided, order contents, the research-use acknowledgement recorded against an order, and the content of any message you send us. There are no customer accounts, so we hold no passwords or account credentials.

Information collected automatically. IP address, approximate location derived from it, browser and device characteristics, pages viewed, referring page, and timestamps, collected through server logs and our hosting provider's standard request logging.

Information from third parties. Delivery status from carriers, and where applicable the results of sanctions or restricted-party screening.

What we do not collect. We never see or store payment card numbers, bank details or any financial credential — every payment method we accept is settled outside this website, so no payment data is entered here at all. What we record against an order is that payment was received and by which method. We do not knowingly collect special category or sensitive personal data, and you should not send it to us. We do not ask about health, and health information is not a relevant category for a research-use supply relationship.

We use only strictly necessary technologies. There is no analytics, no advertising and no cross-site tracking on this site, which is why you are not asked to accept cookies.

• Cart. A cookie holding an identifier for your cart, so it survives navigation. It is set as httpOnly, meaning page scripts cannot read it.
• Research-use acknowledgement. Stored in your browser so you are not asked on every visit.
• Security and delivery. Set by our hosting provider to route requests and mitigate abuse.

Some state is held in your browser's local storage rather than in cookies; clearing site data clears it.

• To perform the contract — processing and dispatching orders, taking payment, providing tracking, handling returns and answering support enquiries.
• To comply with legal obligations — tax and accounting records, sanctions screening, and retention of the research-use acknowledgement as a compliance record.
• For our legitimate interests — preventing fraud and abuse, securing the site, and enforcing our Terms of Service and compliance policies. We balance these against your interests and rights.
• With your consent — any marketing email. Consent can be withdrawn at any time, without affecting processing already carried out.

We do not use personal information for automated decision-making that produces legal or similarly significant effects. Every order is reviewed by a person before it is dispatched, because payment is confirmed manually.

We share personal information only where it is necessary, and only with:

• Carriers — the delivery address and contact details needed to deliver the parcel;
• Service providers — hosting, content delivery and email delivery, each acting on our instructions under a written agreement. We do not share personal information with a payment processor, because there isn't one;
• Professional advisers — legal and accounting, where necessary;
• Authorities — regulators, customs and law enforcement where we are legally required to disclose, or where disclosure is necessary to establish, exercise or defend legal claims;
• A successor — in connection with a merger, acquisition or transfer of the business, subject to this policy continuing to apply.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

We and our service providers operate in more than one country, so personal information may be transferred to and processed in a jurisdiction other than your own, including the United States. Where information is transferred out of the United Kingdom or the European Economic Area, we rely on an adequacy decision where one applies, or on Standard Contractual Clauses together with any additional measures the transfer requires.

• Order and transaction records, including the research-use acknowledgement — retained for the period required by tax, customs and regulatory law, and thereafter for as long as needed to defend legal claims.
• Account information — for as long as the account is open, and for a limited period afterwards to handle residual queries.
• Support correspondence — generally two years from the last message in the thread.
• Server logs — a short rolling window, kept for security and diagnostics.
• Marketing consent records — until consent is withdrawn, plus a record of the withdrawal itself.

When information is no longer needed it is deleted or irreversibly anonymised. Note that the compliance record attached to an order cannot be deleted on request while a legal retention obligation applies to it.

We apply technical and organisational measures appropriate to the information we hold: encryption in transit, access limited to personnel who need it, segregation of payment handling to the processor, and logging of administrative access. No system is perfectly secure, and we do not claim otherwise. Where a breach occurs that is likely to result in a risk to your rights, we will notify you and the relevant supervisory authority as the law requires.

Depending on where you are, you may have some or all of the following rights:

• Access — to obtain a copy of the personal information we hold about you;
• Rectification — to have inaccurate information corrected;
• Erasure — to have information deleted where we have no continuing basis to keep it;
• Restriction and objection — to limit or object to processing carried out on the basis of legitimate interests;
• Portability — to receive information you provided in a structured, machine-readable format;
• Withdrawal of consent — at any time, where processing relies on consent;
• Non-discrimination — we will not degrade service or pricing because you exercised a privacy right.

Requests are answered within the period the applicable law allows — one month under UK and EU data protection law, forty-five days under California law, extendable where a request is complex. We may need to verify your identity first. If you are dissatisfied with our response you may complain to your local supervisory authority.

We send marketing email only where you have opted in, and every such message carries a working unsubscribe link that takes effect immediately. Transactional messages — order confirmations, dispatch and tracking notices, and replies to your own enquiries — are not marketing and continue regardless of marketing preferences.

This site is intended for qualified researchers aged 21 or over. It is not directed at children, and we do not knowingly collect personal information from anyone under 21. If we learn that we have, we will delete it and close any associated account.

Product pages cite external scientific literature, and certificates may be hosted or verified by a third-party laboratory. Those sites have their own privacy practices, which we do not control and are not responsible for. This policy covers only what we do.

We may update this policy as our practices, our providers or the law change. The date at the head of this document reflects the current version. Where a change materially affects how we handle information already collected, we will take reasonable steps to tell you directly.

To exercise a right, ask a question, or raise a concern about how we handle personal information, use the compliance route on our contact page. We would rather resolve a complaint ourselves than have you take it elsewhere first, but you are entitled to do either.