Privacy Policy

1. Who we are

Data controller: Edinburgh Research Ltd (Company No. SC895591). Edinburgh Peptides is a trading name of Edinburgh Research Ltd. Registered office: 3, Third Floor, Hill Street, Edinburgh, United Kingdom, EH2 3JP. Contact: info@edinburghpeptides.co.uk.

2. Data we collect

• Identity and contact details (name, email, phone, institution)
• Delivery and billing addresses
• Order contents, payment references, and correspondence
• Technical data such as browser storage for age-gate confirmation and basket persistence
• Messages you send via the contact form or WhatsApp

3. Why we process data

• To fulfil orders and verify Pay by Bank payments (contract)
• To respond to enquiries and provide customer support (legitimate interests / contract)
• To look up a UK delivery or billing address from a postcode at checkout (contract)
• To meet legal and compliance obligations (legal obligation)
• To improve site security and prevent misuse (legitimate interests)
• To understand aggregated site traffic (legitimate interests)

4. How we share your personal data

We use a small number of trusted third-party service providers to help us run our website, process payments, look up UK addresses, and deliver orders. These providers act as our data processors — they only process your personal data on our instructions and for the purposes described below. We do not sell your personal data to anyone. We do not take card payments.

Payments — Fena

We use Fena (Fena Labs Ltd, registered in England, 8th Floor, 100 Bishopsgate, London EC2N 4AG) to process open banking payments on our website. When you make a payment, Fena processes your name, bank account details, and transaction data in order to securely authorise and complete the payment from your banking app. Fena is a UK-based, FCA-regulated open banking provider, so your data is processed within the UK.

Address lookup — Ideal Postcodes

We use Ideal Postcodes (IDDQD Limited, Floor 3, 207 Regent Street, London W1B 3HH) to suggest UK addresses from a postcode on the checkout form. If you use Find address, we send only the postcode you entered. Ideal Postcodes returns matching address lines so you can choose one. You can still type the address yourself. They do not receive your name, email, phone number, or order details. Address lookup data is processed in the UK/EU.

Delivery — Royal Mail

We use Royal Mail to deliver your orders. To fulfil delivery, Royal Mail receives your name, delivery address, and contact details (such as phone number or email, where needed for delivery updates). Royal Mail is based in the UK, so this does not involve a transfer of your data outside the UK.

Email — Resend

We use Resend, an email delivery service, to send transactional emails such as order confirmations, dispatch notices, and receipts. Resend processes your email address and relevant order information to deliver these emails. Resend's primary processing operations, including stored account data, message content, delivery logs, and webhook payloads, take place in the United States. Where your data is transferred outside the UK, this is done under the UK Addendum to the EU Standard Contractual Clauses, ensuring your data continues to receive an equivalent standard of protection.

Website hosting — Vercel

We use Vercel to host our website and run its underlying infrastructure. Vercel may process data such as your IP address, device and browser information, and other data that passes through our website's backend while you use our site. We also use Vercel Web Analytics to record anonymous, cookieless page views (path, referrer, approximate location, browser and device). Those statistics are aggregated and are not used to identify you. Vercel is a US-based company, and data may be processed or transferred to the United States or other countries where Vercel or its service providers operate. Where this involves a transfer of your data outside the UK, it is carried out under the UK International Data Transfer Addendum (IDTA) together with the EU Standard Contractual Clauses, to ensure your data is adequately protected.

Orders and stock — Supabase

We use Supabase to store order, stock, and returns records. That includes your name, contact details, addresses, and order contents, so we can fulfil the order and keep accounts. Supabase only processes this data on our instructions.

Reviews — Trustpilot

Trustpilot widgets on this website may collect technical data (for example IP address and device information) in order to display reviews. If you choose to leave a review, or if we send a review invitation after a paid order, Trustpilot processes the contact and order details needed for that invitation. See Trustpilot's own privacy policy for how they use that data.

Summary

We only share the minimum personal data necessary for each provider to perform its specific function, and each provider is contractually required to protect your data and only use it for the purposes we have instructed.

5. Retention

Order and invoice records are retained as required for accounting and legal purposes. Enquiry emails are retained for as long as needed to handle your request and related follow-up. Browser basket/age-gate data remains on your device until cleared.

6. Your rights

Under UK GDPR you may have rights to access, rectify, erase, restrict, or object to certain processing, and to data portability. Contact us to exercise these rights. You may also complain to the Information Commissioner's Office (ICO). We are registered with the ICO; the registration number will be added here once issued.

7. Cookies and local storage

We use essential browser storage for the age-gate confirmation, your basket, checkout, and staff sign-in. Vercel Web Analytics records anonymous page views without setting cookies. Trustpilot review widgets load only if you accept optional cookies, and you can change that choice at any time using the Cookie preferences link in the footer. Full details, including names and durations, are in our Cookie Policy.