Last updated: 28 September 2026

This policy explains how Starflex Systems Limited, trading as UK Peptides ("we", "us", "our"), collects, uses, and protects personal data when you use www.uk-peptides.com, place an order, or contact us. We are the data controller for this website, registered in England and Wales under company number 08033431; registered office: 409 Linthorpe Road, Middlesbrough, TS5 6JN. You can reach us at any time at sales@uk-peptides.com.

We run this website on a simple principle: we collect the minimum personal data needed to take your order, deliver it, and support you afterwards, and we delete it when it is no longer needed. Full deletion timescales are published in our Data Retention Policy.

1. What we collect

• Identity and contact details. Your name, email address, delivery and billing address, and phone number, provided when you order or create an account.
• Order details. The products you buy, order value, delivery method, and order history.
• Payment status. Confirmation from our payment providers that a payment succeeded or failed. We never see or store your card number or bank login. If you pay in cryptocurrency, we also hold the payment address and the blockchain transaction reference for that payment, because our accounting records require it.
• Correspondence. Emails you send to sales@uk-peptides.com, including any photos or videos you attach, and our replies.
• Technical data. IP address, browser type, and pages visited, collected through cookies and analytics (see section 7).

We do not collect any special-category (sensitive) data, and we ask you not to include any in correspondence with us.

2. How we use it, and our lawful basis

• Processing and delivering your order, including payment, order confirmation, and delivery updates (performance of a contract).
• Replying when you contact us and resolving delivery or payment issues (legitimate interests: running a responsive business).
• Keeping accounting and tax records (legal obligation).
• Preventing fraud and keeping the site secure, including checking the photos and videos sent with a damage or missing-item claim, and their file metadata, for signs of editing or AI generation (legitimate interests).
• Sending marketing emails (consent, or the "soft opt-in" where you are an existing customer). Every marketing email contains an unsubscribe link, and unsubscribing takes effect immediately.
• Understanding how the site is used so we can improve it (legitimate interests, using aggregated analytics).

3. Who we share it with

We never sell personal data. We share it only with service providers who need it to perform a service for us, under terms that prohibit them from using it for their own purposes:

• Payment providers. Card acquiring, open banking ("Pay by Bank") and cryptocurrency payment services, to take and refund payments. Your card details are entered directly with the payment provider and never touch our servers.
• Delivery carriers. Royal Mail and courier partners (including UPS, booked through our shipping platform) receive your name, address, and contact details to deliver your order.
• Email providers. To send order confirmations, delivery updates, and (where subscribed) marketing emails.
• Hosting, CDN, and security providers. To run and protect the website.
• Analytics. Google Analytics, configured for aggregated statistics.
• Drafting tools. We use software, including AI-based tools, to help our team draft replies to customer emails. Every reply is reviewed by a member of staff before it is sent, and these providers may not use your data for their own purposes.

We may also disclose personal data where the law requires it, or where necessary to establish, exercise, or defend legal claims.

4. International transfers

Some of our service providers process data outside the UK, for example in the European Economic Area or the United States. Where they do, the transfer is protected by a UK adequacy decision (including the UK–US Data Bridge) or by the UK International Data Transfer Agreement or Addendum in place with the provider.

5. How long we keep it

Shorter than most. Routine customer-service emails are deleted within 12 months, typically after 6. Order and transaction records are kept for 6 years, as UK tax law requires. Marketing details are kept only until you unsubscribe. The full schedule, including backups and analytics, is published in our Data Retention Policy.

6. Security

The whole site runs over HTTPS (TLS). Payments are processed on our payment providers' secure platforms, so no card numbers or bank credentials are collected, stored, or seen by us. Access to customer data is limited to staff who need it, and the website sits behind a web application firewall.

7. Cookies

We use a small number of cookies:

• Essential cookies. The session cookie that operates your basket and checkout, and security cookies set by our content delivery network. The site cannot function without these.
• Analytics cookies. Google Analytics, used solely to produce aggregated statistics about how the site is used so we can improve it. These run under the statistical-purposes exception in UK cookie law (the Data (Use and Access) Act 2025). The data is not shared with anyone for their own purposes, and advertising features are switched off.

Analytics is ON in this browser. Click here to turn it off.

Turning analytics off takes effect immediately and we remember the choice in this browser. You can also block or delete cookies in your browser settings at any time; blocking essential cookies will prevent checkout from working.

8. Your rights

Under UK data protection law you have the right to:

• access a copy of the personal data we hold about you, free of charge;
• correct inaccurate or incomplete data;
• erasure, meaning you can ask us to delete your data. We will, except where the law requires us to keep it (for example, tax records);
• restrict or object to processing, including objecting to direct marketing at any time;
• portability, meaning you can receive the data you provided to us in a machine-readable format;
• withdraw consent at any time, where processing is based on consent.

Email sales@uk-peptides.com to exercise any of these rights. We respond within one month and never charge a fee unless a request is manifestly unfounded or excessive. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would welcome the chance to resolve any concern first, though.

9. Age

This website is for adults. You must be at least 18 years old to order, and we do not knowingly collect personal data relating to anyone under 18.

10. Changes to this policy

Any changes will be published on this page with an updated date at the top.