Legal

Privacy Policy

Last updated: 27 October 2026

NobelPepLab is committed to protecting your personal data. This policy explains what information we collect, why we collect it, and how you can exercise your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

NobelPepLab is a UK-based wholesale research peptide supplier operating through the website nobelpeplab.com.

For the purposes of UK GDPR, NOBELPEPLAB LTD (trading as NobelPepLab, company number 17535715, registered office 82a James Carter Road, Mildenhall IP28 7DE) is the data controller for the personal data described in this policy.

Contact: enquiries@nobelpeplab.com

2. Data we collect and why

We only collect the data we need to respond to your enquiries and fulfil orders. We only use your data for marketing emails if you asked for them.

Enquiry forms

When you submit an enquiry through our website, we collect:

Your name
Your email address
The subject and content of your message

Legal basis: Legitimate interest — to respond to your enquiry and discuss a potential business relationship.

Orders sent by email

If you send your cart to us using “Send this order by email” instead of WhatsApp, we collect:

Your name and email address
The country your order ships to
The items, quantities and prices in your cart, and your order reference
Any notes you add

Legal basis: Steps taken at your request before entering into a contract — to quote for and fulfil your order.

Orders placed at our online checkout (crypto or bank transfer)

If you order at our online checkout, we collect:

Your name, delivery address and email address, and your phone or WhatsApp number if you give it
The items, prices, any discount code and the order total, and any notes you add
Your confirmation that you are 18 or over and buying for research use, and that you accept our Terms
The payments made to us for the order: the coin, amount, transaction ID and its value in US dollars and pounds when it arrived; for a bank transfer, the amount and date it reached us (your bank account details are seen only in our own bank account, not stored by the website)
A photo of your packed order, if we send you one, and the courier and tracking number

We use these to take your payment, post your order, and email you about it (payment link, one reminder if it is unpaid after an hour, bank details ready, payment reminder, cancellation, payment confirmation, packed and shipped updates). Cryptocurrency payments are recorded on public blockchains by their nature; we never publish which payment belongs to which customer. Your order is stored with our website host, Netlify, in the EU (Frankfurt).

Legal basis: Contract performance — to process and fulfil your order — and legal obligation for our accounting records.

Price list and product alerts

If you download our price list or sign up for new-product and restock alerts, we collect your email address (and, for a “Notify me” request, the product you asked about).

Price list: we use your email to provide the list. We only send you product updates if you tick the box to ask for them.
Product alerts: we send an occasional email when a new compound is added or a product is available again. Every email lets you unsubscribe, or email us and we will remove you.

Legal basis: Consent — which you can withdraw at any time. The price list itself is available whether or not you agree to receive updates.

Offers and new-product emails

If you tick the “Email me offers” box on our cart, checkout or contact form, we use your email address to send occasional offers and news about new products. Every email has an unsubscribe link, or you can email us and we will stop.

Legal basis: Consent — which you can withdraw at any time. Leaving the box unticked does not affect your order or enquiry.

WhatsApp communications

If you contact us via WhatsApp to discuss an order, we may collect:

Your name and WhatsApp phone number
Your order details and delivery address
The content of your messages

Legal basis: Contract performance — to process and fulfil your order.

Orders sent from the cart by WhatsApp

When you press “Send this order on WhatsApp”, our website also saves a copy of the order so we can match it to your message:

Your order number, the items, quantities and prices, and the total
The payment method you chose
How you reached our website and the first page you visited

It does not include your name, phone number or email address. It is stored with our website host, Netlify.

Legal basis: Legitimate interests — keeping an accurate record of the orders we are asked to quote.

Guide purchases via Gumroad

If you purchase our Peptide Sourcing & Verification Guide, the transaction is processed by Gumroad Inc. NobelPepLab does not directly receive or store your payment information. Gumroad may share your email address with us as the seller. Gumroad's own privacy policy applies to your data during that transaction: gumroad.com/privacy.

Website usage data

We use Cloudflare Web Analytics to understand how the site is used. It is cookieless and does not follow you across other websites. It records page views, the referring site, approximate country and device type. It does not build a profile of you, and we do not sell or share this data for advertising. Cloudflare processes it on our behalf; see cloudflare.com/privacypolicy.

We also count, anonymously, how many times buttons such as “Add to cart”, “Open cart” and “Send on WhatsApp” are pressed, so we can see where ordering gets stuck. Nothing is stored on your device for this, and no name, address or IP address is kept: only a daily number for each button.

3. How we use your data

We use the personal data we collect solely for the following purposes:

Responding to your enquiries and questions
Processing, fulfilling, and communicating about orders
Sending occasional offers and new-product news by email, only to people who asked for them
Delivering digital purchases (the buying guide PDF)
Complying with legal obligations

We do not sell, rent, or trade your personal data to any third party. We do not use your data for automated decision-making or profiling.

4. Third parties and data processors

We use a small number of trusted third-party services to operate our website. These services may process your personal data on our behalf:

Netlify (Netlify Inc.)

Hosts this website, processes enquiry form submissions, and runs and stores orders placed at our online checkout (stored in the EU, Frankfurt). See their privacy policy.

Gumroad Inc.

Processes payments and delivers the buying guide PDF. See their privacy policy.

WhatsApp (Meta Platforms Inc.)

Used for order discussion and fulfilment. WhatsApp's own terms and privacy policy apply to messages sent through their platform. See their privacy policy.

Google (Gmail)

Our email account, used to reply to your emails. See their privacy policy.

Brevo (Sendinblue SAS, France)

Sends the automatic emails from our website, such as order confirmations, payment links and order updates, and any offers emails you asked for. See their privacy policy.

Google Maps Platform (address search)

When you type in the Address box at our online checkout, the text you type and the country you chose are sent, through our own server, to Google so it can suggest matching addresses. Nothing else about you is sent, and you can always type your address yourself. See Google’s privacy policy.

Blockchain data services (TronGrid, mempool.space)

Our checkout reads the public blockchain through these services to see when a payment reaches our wallet. We only ask about our own receiving addresses; no customer details are sent to them.

Cloudflare, Inc.

Provides Cloudflare Web Analytics, which records aggregate website usage. It is cookieless and does not identify you or follow you across other sites. See their privacy policy.

We do not transfer your personal data to countries outside the UK or EEA except where the platforms above (Netlify, Gumroad, WhatsApp, Google, Cloudflare) operate their infrastructure. Each of these providers has appropriate safeguards in place for international transfers.

5. How long we keep your data

We retain personal data only for as long as necessary for the purpose it was collected:

— Enquiry form submissions: retained for up to 12 months, then deleted.
— Orders sent by email: retained for up to 12 months after your last order, then deleted.
— Product alert sign-ups: kept until you unsubscribe, then deleted.
— Offers emails: kept until you unsubscribe. After that we keep only your email address on a “do not email” list, so we never email you by mistake.
— Order records: retained for 6 years to comply with UK tax and accounting obligations, then deleted.
— Checkout orders that were never paid (crypto or bank transfer): deleted automatically 12 months after they were started. Photos of packed orders are deleted with the order.
— WhatsApp conversations: managed within WhatsApp's own retention system. We delete order-related messages after 12 months.

You have the following rights regarding the personal data we hold about you:

Right of access

Request a copy of the personal data we hold about you.

Right to rectification

Ask us to correct inaccurate or incomplete data.

Right to erasure

Ask us to delete your data, subject to legal retention obligations.

Right to portability

Request your data in a machine-readable format where applicable.

Right to object

Object to processing based on legitimate interest where your interests override ours.

Right to restrict processing

Request that we limit how we use your data in certain circumstances.

To exercise any of these rights, email us at enquiries@nobelpeplab.com. We will respond within one calendar month.

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

7. Cookies and browser storage

This website does not use tracking, advertising, or analytics cookies. We do not set any cookies in your browser. (The only cookie we use is a sign-in cookie on our private staff orders page, which customers never visit.)

We do store some small items in your browser itself, using local and session storage rather than cookies. None of them identifies you, and none is sent to us unless you send an order or enquiry:

that you have confirmed you are 18 or over, so the age check is not repeated on every page;
your cart: the products, strengths and quantities you add, the payment method you pick, the order number shown in the cart, and a copy of your last sent order so you can see it again or order it again;
at the online checkout, the country you chose and links to the orders you placed from this browser, so you can find them again (your name and address are not kept in the browser);
the products you have recently opened, shown back to you as “Recently viewed” on product pages (up to eight; the “Clear” button removes them);
the site that referred you and the first page you landed on, which are submitted with an enquiry or order so we can see which channels produce genuine enquiries; these two are cleared when you close the tab.

The others remain until you clear your browser data, and you can remove all of them at any time by clearing this site’s data in your browser.

Our analytics provider, Cloudflare Web Analytics, is cookieless and sets nothing in your browser, which is why no cookie banner is shown. Third-party services embedded on this site (such as Google Fonts for typography) may set their own cookies. If we ever add a cookie-based service, this policy will be updated and a cookie notice will be displayed.

8. Data security

We take reasonable measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. Our website is served over HTTPS. Form submissions are transmitted securely via Netlify's encrypted infrastructure. While no method of transmission over the internet is completely secure, we are committed to handling your data responsibly.

9. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page. Continued use of our website or services after any changes constitutes your acceptance of the updated policy.

10. Contact us

For any questions about this Privacy Policy or to exercise your data rights, contact us:

enquiries@nobelpeplab.com