Privacy Policy

Overview

Our Approach to Your Personal Information

At Peptide Works we value your privacy and are committed to using your personal information solely for managing your account. This policy sets out what we collect, why we collect it, where it is stored and what you can ask us to do with it. It applies to this website and to the enquiries and orders placed through it.

We have written it to be read rather than skimmed past. Where a specific duration applies to a cookie or a request process, that duration is stated. Where a process involves a confirmation step, that step is described. If anything here is unclear, you can ask us about it directly at info@peptide-works.com.

Storage

Where Your Data Is Stored

Your personal data is securely stored exclusively in this website's database, with no additional copies maintained elsewhere.

This matters more than it might appear. A single storage location means there is one place to search when you ask what we hold about you, one place to correct when something is wrong, and one place to erase when you ask us to erase it. It also means there is no secondary export sitting in a spreadsheet or a separate marketing system that could be missed when a request is actioned.

Our web hosting provider is GDPR certified and compliant, which means the infrastructure holding that database is itself subject to the same data protection standards we are.

Media

Media and Uploaded Images

If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

This is worth spelling out because it surprises people. Photographs taken on a phone routinely carry the coordinates of the place they were taken, embedded in the file itself rather than visible in the picture. When such a file is published, those coordinates travel with it and can be read by anyone who downloads it. If you are sending a photograph of a damaged delivery, for example, consider whether the file carries location data you would rather not share, and strip it if so.

Third Parties

Embedded Content From Other Websites

Articles on this site may include embedded content such as videos, images or articles. Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

The practical consequence is that the other website can collect data about you, use cookies, and track your interaction with that embedded content, exactly as it would if you had navigated there directly. Peptide Works does not control what those sites collect, and their own privacy policies govern that collection rather than this one.

Your Rights

Your Rights as a Data Subject

The GDPR gives you a set of rights over the personal data an organisation holds about you. Below is how each of those requests is handled on this website, including the confirmation steps involved and what you receive at the end.

Seeing what is held and asking for it to be anonymised

We show you all of the data stored on our website, and you can select the data you wish the site owner to anonymise so that it can no longer be linked to your email address. It is the site owner's responsibility to act upon your request. When your data is anonymised you will receive an email confirmation.

Right to erasure

You are able to submit a request to be erased from the site. The process runs as follows:

• You submit the erasure request.
• You receive an email confirmation asking you to confirm the deletion request.
• After you confirm by email, the request is added to the requests table for review by the administrator.
• If you have content published on the site — under any post type, or comments — you are added to that table so the content can be dealt with.
• If you have no content, you receive a confirmation of the erasure request together with a six digit token to keep safe, in case data recovery is later needed.

The requests table allows the administrator to reassign any content to another user or to delete it. In the event of comments, your content would be made anonymous rather than removed wholesale, which preserves the readability of a discussion thread while detaching it from you. An administrator can also add users to the erasure requests table manually by searching for an email address.

Right to access your data and data portability

You can place a request to download your data. After requesting it, you will receive a double opt-in confirmation email. Once confirmed, an XML or JSON file is generated and emailed to you for download, with an expiration time of 48 hours.

The double opt-in step exists to protect you: it ensures that a request made in your name can only be completed by someone with access to your mailbox. The 48 hour expiry on the download applies for the same reason, so that a file containing your personal data does not remain retrievable indefinitely from a link in an old email.

Right to rectification and complaints

You can place a request to rectify data or to file a complaint. After making the request you will receive a double opt-in confirmation email, and you are then added to the table for the administrator to handle the request.

Contact

Making a Request or Asking a Question

Any question about this policy, and any request to access, correct, anonymise or erase the data we hold, can be sent to us by email.

Write to info@peptide-works.com from the address associated with your account where possible, and say plainly which request you are making. Because several of the processes above include a double opt-in confirmation, a request made from the account's own address is the most direct route through them. You can find broader guidance on writing to us on the contact page.