Privacy policy

Updated 4 October 2026.

This policy explains which personal data we process when you visit luxpeptides.uk, place an order or write to us, why we do it, and what rights you have under the General Data Protection Regulation (GDPR, EU 2016/679).

Who is responsible for your data

The data controller is LUXPEPTIDES.UK. For any data protection question write to [email protected].

What we collect and why

Orders. Name, e-mail, phone (required for parcel-locker delivery – for the pickup code), organisation (optional), delivery address, comment, the products ordered and your confirmation that you are 21+ and the products are for research use only. We use them to fulfil the order: send the payment details, check the payment, deliver and contact you. When you pay we also see the payer details: for a bank transfer the payer name, account and reference; for cryptocurrency the sending wallet address and transaction ID (these are public on the blockchain). Legal basis – entering into and performing a contract (GDPR art. 6(1)(b)); for accounting records – a legal obligation (art. 6(1)(c)).

Contact form and e-mails. Name, e-mail, phone (optional) and your message, so we can reply. Legal basis – your request and our legitimate interest in answering it (art. 6(1)(b) and (f)).

Newsletter. E-mail address and language – only if you subscribe yourself. Legal basis – your consent (art. 6(1)(a)). You can unsubscribe at any time – just write to us.

Anonymous visit statistics. We count how many people visit, the device type (computer, phone, tablet), language, the first page opened and whether they came through one of our QR codes or campaigns. No IP address or identifier is stored and no cookies are used – these figures cannot identify you. Legal basis – our legitimate interest in improving the site (art. 6(1)(f)).

Security. To block spam and attacks, our forms run a short computing task in your browser, and your IP address is held briefly in server memory to limit the number of requests. If a submission is rejected as spam, only an irreversibly hashed, shortened IP code is logged (last 200 entries) so we can spot repeated sources. Legal basis – our legitimate interest in keeping the site secure (art. 6(1)(f)).

We do not sell data and do not use it for profiling or automated decisions.

How long we keep it

Orders and correspondence – 3 years from the last contact.
Invoices and other accounting records – 10 years, as required by Lithuanian accounting law.
Newsletter subscription – until you unsubscribe.
Anonymous statistics – no longer than 24 months.
Backups – 14 days.

Who we share data with

Our server provider – the website and data are kept on a server we rent in the European Economic Area.
Our e-mail provider – to send order confirmations, payment details and replies. If the provider processes data outside the EEA, this is based on a European Commission adequacy decision or standard contractual clauses.
Parcel-locker networks (Omniva, LP Express, Venipak) – only the data needed for delivery.
OpenStreetMap (OSM Foundation, UK) – the parcel-locker map and address search. When you search for a locker by address, our server passes that address (without your IP or any other data) to the OSM Nominatim search; we do not store it. Map images are served from our server. The “Near me” button uses your device location only in your browser – it is not sent to us.
Our accountant and public authorities – where the law requires it.

Our domain name system (DNS) is run by Cloudflare, but no visitor data is passed to them. Fonts, the 3D library and all other files load from our own server only – the site does not contact Google, Facebook or any other third party.

Cookies and browser storage

The public website does not use cookies. Only these entries are kept in your browser's local storage (localStorage):

luxary-cart-v1 – the products in your cart. Necessary for the site to work. Kept until you clear the cart or your browser data.
lux-consent – your statistics choice. Necessary. Kept for 12 months.
lux-utm – which QR code or campaign brought you here (e.g. "leaflet"), so we can see which advertising works. Stored only if you agree to statistics. Kept for 30 days.
lux-gate (session storage, sessionStorage) – that you confirmed you are 21 or older and will use the products for research only. Necessary. Deleted when you close the browser.
lux-inquiry-draft (session storage) – what you typed in the order form, so it is not lost when you switch language or reload. Stays in your browser only; deleted when you place the order or close the browser.

We use no advertising, tracking or social media tools (no Google Analytics, Facebook Pixel or similar). You can change your choice at any time with "Cookie settings" at the bottom of the site.

Your rights

You have the right to:

access your data and receive a copy;
have inaccurate data corrected;
have your data erased ("right to be forgotten") when it is no longer needed or there is no longer a basis for processing it;
restrict processing, or object to processing based on legitimate interest;
receive your data in a structured format and transfer it to another controller;
withdraw consent at any time (this does not affect processing carried out before the withdrawal).

Send your request to [email protected]. We reply within one month. If you believe your data is processed unlawfully, you can complain to the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, Vilnius, vdai.lrv.lt) or the authority in your country.

How we protect data

All traffic is encrypted (HTTPS), the administration system requires a personal account (two-factor authentication available), access is limited to those who need it for their work, and daily backups are kept on the same secured server.

Minors

Our products are for adults (21+) and for research use only, so we do not knowingly collect data from anyone under 21.

Changes

If our processing changes, we will update this policy and the date at the top. Significant changes will also be announced on the site.