Legal
Privacy Policy
How Positive Peptides collects, uses and protects personal data, in line with UK GDPR and the Data Protection Act 2018.
Last updated: 9 November 2026
Who we are
Positive Peptides ("we", "us") operates this website. We are based at Surrey, United Kingdom. We are the data controller for personal data collected through this website. You can contact us about privacy at positivepeptides1@gmail.com.
What data we collect
- Enquiry data. When you use the contact form or message us on WhatsApp we receive the details you provide: name, email address, organisation (optional), subject, message and any compound or batch number you refer to.
- Technical data. Our server records standard request logs (IP address, user agent, requested page, time) for security and troubleshooting. For spam protection we store a one-way hash of your IP address alongside form submissions rather than the address itself.
- Analytics. If enabled, we use a privacy-conscious analytics service that does not use cookies and does not collect personal data. See our Cookie Policy.
- Administrator accounts. Authorised staff who manage this website have accounts with their name, email address and a securely hashed password.
We do not sell products through this website, so we do not collect payment information.
Why we process it and our lawful basis
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Responding to enquiries and providing documentation | Legitimate interests; steps at your request prior to a contract |
| Keeping records of correspondence | Legitimate interests (record-keeping, defending claims) |
| Website security, spam prevention and logs | Legitimate interests (protecting our systems) |
| Aggregate analytics | Legitimate interests (understanding use of the site) |
| Administrator authentication | Legitimate interests; contract with staff |
How long we keep data
Enquiry records are retained for up to 24 months after the last correspondence unless a longer period is required for legal reasons. Server logs are retained for up to 90 days. Administrator audit logs are retained for the life of the account plus 12 months.
Who we share data with
We share personal data only with service providers who process it on our behalf under contract (for example our hosting provider, email delivery service and, where configured, a bot-protection service). We do not share enquiry data with advertisers. Where a provider is located outside the UK we rely on adequacy regulations or the UK International Data Transfer Agreement / Addendum.
Your rights
Under UK GDPR you have the right to access, rectify, erase, restrict and object to processing of your personal data, and to data portability where applicable. To exercise a right, contact positivepeptides1@gmail.com. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
Security
Administrator access is protected by authenticated sessions, password hashing and audit logging. Uploaded laboratory documents are validated before storage. The site is designed to be served over HTTPS.
Children
This website is intended for laboratory and scientific professionals and is not directed at children.
Changes
We may update this policy. The date at the top shows when it was last revised.