1. Introduction
Peptide Lab (hereinafter ‘we’, ‘us’ or ‘our’) attaches great importance to the protection of your personal data. This privacy notice explains what personal data we collect, why we collect it, how we handle it and what rights you have.
This notice has been drawn up in accordance with the General Data Protection Regulation (GDPR), the Dutch GDPR Implementation Act and the Dutch Telecommunications Act.
2. Data Controller
Peptide Nederland — trading as ‘Peptide Lab’, Schipholweg 57, 2316 ZL Leiden, Netherlands. Chamber of Commerce: 42046001 · Email: privacy@peptide-lab.eu · Website: www.peptide-lab.eu.
3. What Personal Data Do We Process?
For orders/account registration: first and last name, company name, billing and delivery address, email, telephone number, IP address, payment details (via our payment provider), Chamber of Commerce/VAT details for businesses, order history and communications. For website use: IP address, browser type, operating system, pages visited and click behaviour, time/duration and referring URL. When you contact us: name, email and the content of the communication.
4. Legal Bases and Purposes
We process your data only on a legal basis (Article 6 GDPR):
| Purpose | Legal basis |
|---|---|
| Performance of the agreement (processing, delivery, invoicing) | Performance of a contract (Article 6(1)(b)) |
| Compliance with legal obligations, including tax record retention | Legal obligation (Article 6(1)(c)) |
| Customer service and communication | Performance of a contract / legitimate interest |
| Fraud prevention and security | Legitimate interest (Article 6(1)(f)) |
| Analytical cookies (Google Analytics) | Consent (Article 6(1)(a)) |
| Newsletter / marketing | Consent |
| Verification of age and research qualifications | Legitimate interest / legal obligation |
5. Retention Periods
- Invoice and payment data: 7 years (tax retention requirement under Article 52 of the Dutch General Taxes Act).
- Customer account and order history: for as long as the account is active, plus a maximum of 2 years after the last activity.
- Contact form / email: a maximum of 2 years after the last contact.
- Newsletter: until you unsubscribe. Analytics: a maximum of 14 months. Log data: a maximum of 12 months.
- Research-use verification: for the duration of the customer relationship plus 5 years.
6. Sharing with Third Parties
We share data only with parties necessary for our services, under a data processing agreement where required: payment providers, shipping partners, hosting providers, email/marketing services, Google Ireland Limited (Analytics), accounting service providers, IT service providers and government authorities (only where legally required).
7. Transfers outside the EU/EEA
We aim to process data within the EU/EEA. Transfers outside this area take place only on the basis of an adequacy decision, the EU Standard Contractual Clauses (SCCs) or other appropriate safeguards (Chapter V GDPR).
8. Google Analytics
We have configured Analytics with privacy-friendly settings: a data processing agreement with Google, IP anonymisation, no advertising data sharing and a maximum retention period of 14 months. Analytics is activated only after you give consent via the cookie banner.
9. Security
We take appropriate technical and organisational measures: SSL/TLS (HTTPS), access protection with strong passwords and, where possible, two-factor authentication, encryption of sensitive data, periodic backups and access restricted on a need-to-know basis. We report data breaches that pose a risk to the Dutch Data Protection Authority within 72 hours.
10. Your Rights
- Right of access (Article 15), rectification (Article 16) and erasure (Article 17).
- Right to restriction of processing (Article 18) and data portability (Article 20).
- Right to object (Article 21) and the right to withdraw consent.
- Right not to be subject to automated decision-making (Article 22) — Peptide Lab does not make such decisions.
You can submit a request to privacy@peptide-lab.eu. We respond within one month. Complaints may be submitted to the Dutch Data Protection Authority, Postbus 93374, 2509 AJ The Hague (autoriteitpersoonsgegevens.nl).
11. Minors and Changes
Our products are not aimed at minors; we do not process data relating to persons under 21 years of age. We reserve the right to amend this notice — the current version is always available on the Website. For cookies, please refer to our Cookie Notice.
FOR RESEARCH USE ONLY. For laboratory and research purposes only. Not for human or animal consumption.