Privacy Policy
CertaPeptides is committed to protecting your personal data. This policy explains how we collect, use, and safeguard your information in compliance with the EU General Data Protection Regulation (GDPR).
Last updated: October 2026|GDPR Compliant
1. Information We Collect
- Personal Identification: Name, email address, phone number, shipping and billing address collected when you place an order or create an account.
- Payment Data: Payment information is processed securely by PCI-DSS compliant third-party payment providers. We do not store your card or bank details on our servers.
- Technical Data: IP address, browser type, device information, pages visited, time on site, and referring URL collected via essential and, where consented, analytics cookies.
- Order Data: Purchase history, product preferences, and cart contents for the duration of your session.
- Communication Records: Support emails, order inquiries, and customer service interactions.
2. How We Use Your Information
- Order Fulfilment (Art. 6(1)(b) GDPR): Processing and shipping your orders, managing your account, and providing customer support.
- Legitimate Interest (Art. 6(1)(f) GDPR): Fraud prevention, website security, and improving our products and services.
- Consent (Art. 6(1)(a) GDPR): Analytics cookies, marketing communications, and personalised recommendations — only with your explicit opt-in. Existing customers may also receive our monthly product newsletter and reorder reminders about similar products under the existing-customer rule (Law 506/2004 art. 12(2)); you can refuse at checkout and unsubscribe from every email.
- Legal Obligation (Art. 6(1)(c) GDPR): Tax compliance, invoicing records, and regulatory documentation as required by EU law.
- Anonymised Analytics: Generating anonymised, aggregated data to understand usage patterns and improve our website.
3. Data Sharing
- Shipping Partners: Name and address shared with EU-based logistics providers solely for order fulfilment.
- Payment Processors: Payment data processed by PCI-DSS Level 1 certified providers for secure transactions.
- Analytics (if consented): Anonymised, aggregated usage data only. No personal identifiers are shared.
- Legal Authorities: When required by applicable law or to prevent fraud.
- Review Invitations (Trustpilot): After your order has shipped, we send you a short delivery check-in email and a blind copy of it goes to Trustpilot A/S (Copenhagen, Denmark, EU). Trustpilot uses your name, email address and order number to email you an invitation to review your purchase (its Automatic Feedback Service). Legal basis: our legitimate interest in genuine, unfiltered customer feedback (Art. 6(1)(f) GDPR). Trustpilot is our processor for the invitation and an independent controller for any review you publish. To object, use the unsubscribe link in Trustpilot's email or write to support@chinapeptideshop.com; an invitation and its reminder that are already scheduled cannot be recalled.
- We do not sell, rent, or trade your personal information to third parties for marketing purposes.
3a. Order Checks and Contract Records
- Order checks: before we accept or ship an order, automatic checks decide whether it can go ahead: whether each product may be supplied at all and to the delivery country (some products cannot be shipped to some countries for legal and regulatory reasons); whether you have accepted our terms for this order from a verified account whose email matches the billing email; and whether the order (products, total, delivery address) is still the one you accepted. If an order cannot go ahead at checkout, we tell you why (for example which product cannot go to which country). If the products, quantities, delivery country or address, buyer or billing email of an order change after you accepted it, or its total goes up, we put it on hold and ask you to accept it again (a new delivery address by email confirmation; any other change by placing the order again); a lower total or a change only in how an address is written does not. If an order is put on hold later, we email you. We keep a record of the check with the order. A person reviews every order on hold, and you can ask a person to review any refusal by emailing support@chinapeptideshop.com; we consider what you tell us and reply with the outcome. Legal basis: for the product and destination checks, our legitimate interest in complying with the law and being able to show it (Art. 6(1)(f)); for the checks that you accepted our terms from a verified account and that the order is still the one you accepted, the contract (Art. 6(1)(b)). A refusal at checkout is necessary to decide whether we can enter into the contract (Art. 22(2)(a)).
- Contract records: when you place an order we record which versions of our terms, buyer declaration and clauses you accepted, your account ID, how you signed in, the time and the order, including what you ordered, the total and a fingerprint of your delivery address, so that a later change can be detected. If we accept your order, we keep a record that we sent you the order-acceptance email (when, and its reference). If you accept our terms by email for an order we create for you, we keep that email. To stop a signed acceptance being reused we keep a one-time code with your account ID for 30 days. Legal basis: the contract (Art. 6(1)(b)) and our legitimate interest in being able to prove it (Art. 6(1)(f)).
- Verified account: to place an order you sign in once by magic link or Google; we note that your email address was verified and how. Legal basis: the contract and fraud prevention (Art. 6(1)(b), (f)).
- How long: notes of our order checks 5 years after your order is closed (completed, cancelled or refunded, or 60 days after dispatch if it is never marked completed), other contract and order-check records 4 years; records of a payment for 5 years from 1 July of the year after the financial year of the payment, as accounting law requires; the note that your email was verified as long as your account exists; the one-time codes 30 days. Longer only while a specific claim or legal inquiry about that order is open. One small marker stays as long as the order record itself: that the order was placed under these terms (version 2), so that the right terms still apply if the order is ever reopened; it holds nothing else, and it goes when the order record is deleted. If you ask us to erase it, we review whether the order can still be reopened or paid and erase it when it cannot. If a payment was returned to you, a marker that it was returned (without any payment reference) stays with the order for as long as the order record is kept, so it is never counted as received again.
- Your rights: you can object to the legitimate-interest processing or ask for erasure. We review each request and keep a record only where it is still needed for a specific claim or a legal obligation, and then use it only for that claim or obligation. You can also ask us to restrict processing (for example while you contest a record); when we restrict a record we only store it, and use it only to establish, exercise or defend legal claims, to protect another person's rights, or with your consent.
- Who processes it: our hosting provider in the Netherlands (Snel.com), our email provider (Google), our storefront and database providers (Vercel, Frankfurt region; Supabase, Ireland region) and our network provider (Cloudflare). These records are not shared with carriers or marketing partners. Alerts about an order on hold go only to our internal email (Google) and our server logs. Vercel, Supabase, Cloudflare and Google are US companies, so some of this data may be accessed from or transferred to the United States. Those transfers are covered by the EU Standard Contractual Clauses, or by the EU-US Data Privacy Framework where the provider relies on it (Cloudflare, Google). Our server is hosted by Snel.com in the Netherlands.
4. Cookies
- Essential Cookies: Required for cart functionality, session management, authentication, and security. These cannot be disabled.
- Analytics Cookies: Help us understand how visitors use our site. Only set with your explicit consent.
- Preference Cookies: Remember your settings such as language, currency, and theme preferences.
- You can manage your cookie preferences at any time through the cookie settings panel or your browser settings.
5. Your Rights Under GDPR
- Right of Access (Art. 15): Request a copy of all personal data we hold about you.
- Right to Rectification (Art. 16): Correct inaccurate or incomplete personal data.
- Right to Erasure (Art. 17): Request deletion of your personal data ('right to be forgotten').
- Right to Restrict Processing (Art. 18): Limit how we use your data in certain circumstances.
- Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.
- Right to Object (Art. 21): Object to processing based on legitimate interests.
- Right to Withdraw Consent (Art. 7(3)): Withdraw consent for analytics or marketing at any time via cookie settings.
- To exercise any of these rights, contact us at support@chinapeptideshop.com. We will respond within 30 days as required by GDPR.
6. Data Retention
- Order & Transaction Data: Retained for 7 years to comply with EU tax and accounting regulations.
- Marketing Consent Records: Maintained until you withdraw consent.
- Account Data: Retained while your account is active, deleted upon request.
- Browsing & Analytics Data: Anonymised or deleted after 26 months.
- Our main systems are hosted in the EU (our server in the Netherlands, Vercel in the Frankfurt region, Supabase in the Ireland region). Vercel, Supabase, Cloudflare and Google are US companies, so some of this data may be accessed from or transferred to the United States. Those transfers are covered by the EU Standard Contractual Clauses, or by the EU-US Data Privacy Framework where the provider relies on it (Cloudflare, Google). Our server is hosted by Snel.com in the Netherlands. Data is encrypted at rest and in transit.
7. Security
- Encryption: SSL/TLS encryption on all pages and data transmissions. AES-256 encryption for data at rest.
- Payment Security: All payments processed through PCI-DSS compliant providers.
- Access Controls: Personal data access restricted to authorised personnel on a need-to-know basis.
- Regular Audits: Security audits and vulnerability assessments conducted regularly.
8. Contact
- Data Controller: CERTALAB S.R.L. (trading as CertaPeptides), CUI 54169956, Reg. Com. J2026014773006, registered office Intrarea Gheorghe Simionescu nr. 19, ap. B26, Sector 1, Bucharest, Romania.
- Email: support@chinapeptideshop.com — include 'GDPR Request' in the subject line for data protection inquiries.
- Supervisory Authority: you have the right to lodge a complaint with ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), dataprotection.ro, or with the data protection authority of the EU country where you live.
9. Updates to This Policy
- We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements.
- Any changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically.
Note: All CertaPeptides products are sold strictly for research and laboratory use only. They are not intended for human consumption. This privacy policy applies to all interactions with our website and services at chinapeptideshop.com.
Want to update your cookie preferences?
Questions about your data?
support@chinapeptideshop.com