Version 2.0 – June 2026
Pure Progress Ltd, trading as Pure Peptides UK (“we”, “us”, “our”), is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, share and protect your personal data when you visit our website at purepeptidesuk.com (the “Website”), place an order with us, or otherwise interact with our business.
This Privacy Policy is issued in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, together with the Privacy and Electronic Communications Regulations 2003 (PECR) in relation to cookies and electronic marketing.
For the purposes of these laws, the data controller is Pure Progress Ltd, company number 10512948, registered office 73 Stoneleigh Broadway, Epsom, Surrey, KT17 2HP.
1. What Personal Data We Collect
1.1 Information You Give Us
When you place an order, create an account, contact our customer service team, register for our affiliate programme, or otherwise interact with us, you may provide:
- name, billing and delivery address;
- email address and telephone number;
- payment information (processed securely by our payment providers – we do not store full card details);
- order history and product preferences;
- correspondence content, including support tickets and emails;
- for Business Customers: company name, role, and professional/institutional details relevant to your account.
1.2 Information We Collect Automatically
When you visit our Website, we automatically collect certain technical and usage data, including:
- IP address, device type, browser type and version, and operating system;
- pages viewed, time spent on pages, click and scroll behaviour, and referring/exit pages;
- approximate location derived from IP address;
- cookie identifiers and similar tracking technologies (see Section 6 below).
1.3 Information We Receive From Third Parties
We may receive information about you from the service providers listed in Section 4, including delivery confirmation data from carriers, marketing engagement data from our email platform, and review content from our reviews provider.
1.4 Special Category Data
We do not request or require any special category data (such as health data) as part of placing an order. All Products are sold strictly for research use and not for human or animal application; our order process does not ask about, and you should not provide, any information about your own or any other person’s health. If you voluntarily disclose health-related information to us – for example, in a customer service enquiry – we will only use it for the purpose of responding to that enquiry, will treat it as confidential, and will delete it in line with our retention practices once it is no longer needed.
2. How We Use Your Data and Our Lawful Basis
Under UK GDPR, we must have a lawful basis for every use of your personal data. The table below sets out our main processing activities and the basis relied upon for each.
| Purpose | Lawful Basis |
|---|
| Processing and fulfilling your order, including payment, dispatch and delivery | Performance of a contract with you |
| Providing customer service and responding to enquiries | Performance of a contract / legitimate interests |
| Sending order confirmations, dispatch notifications and service messages | Performance of a contract |
| Sending marketing emails or SMS about similar products and offers to existing customers | Legitimate interests (soft opt-in under PECR) — you may opt out at any time |
| Sending marketing communications to new subscribers who have signed up | Consent |
| Website analytics and performance monitoring | Legitimate interests / consent (for non-essential cookies) |
| Fraud prevention, order verification and compliance checks (including age verification and research-use confirmation) | Legal obligation / legitimate interests |
| Maintaining financial and tax records | Legal obligation |
| Resolving disputes and enforcing our Terms & Conditions | Legitimate interests / legal obligation |
We will never sell your personal data to third parties.
3. Marketing Communications
We use Omnisend to send email and SMS marketing communications. If you have purchased from us before, we may contact you about similar products and offers on the basis of our legitimate interests, in accordance with the “soft opt-in” provisions of PECR. If you have not purchased from us but have signed up to our newsletter, we will only send marketing communications where you have given consent.
You can opt out of marketing communications at any time by clicking the unsubscribe link included in every marketing email or SMS, by updating your preferences in your account, or by contacting us at info@purepeptidesuk.com. Opting out of marketing does not affect transactional communications relating to orders you have placed, and does not affect the lawfulness of processing carried out before you withdrew consent.
4. Who We Share Your Data With
We work with a number of trusted third-party service providers to operate our business. We only share the minimum data necessary for each provider to perform its function, and we have appropriate contracts in place with each provider governing their use of your data.
| Service Provider | Purpose | Data Shared | Location / Safeguard |
|---|
| UK-hosted private virtual server (website hosting infrastructure) | Hosting of our website and WooCommerce store software | All data processed through the Website passes through this infrastructure (order data, account data, browsing data) | United Kingdom |
| Fena eCommerce | Payment processing for card/bank-routed orders | Name, email address, and bank account details used to make payment | United Kingdom |
| Royal Mail Click & Drop | Order fulfilment and delivery | Name, delivery address, contact number | United Kingdom |
| DHL | International order fulfilment and delivery | Name, delivery address, contact number, customs data where applicable | United Kingdom / International — adequacy decision or Standard Contractual Clauses apply for transfers outside the UK |
| Plisio | Cryptocurrency payment processing | Wallet and transaction data only — no customer identity or billing data is shared | United Kingdom |
| Omnisend | Email and SMS marketing communications | Name, email address, marketing preferences, purchase history (for segmentation) | Lithuania (EEA) and other Omnisend group entities outside the EEA/UK — transfers are subject to Standard Contractual Clauses |
| Google Analytics | Website usage analytics and performance measurement | IP address (anonymised/truncated where configured), device and browser data, on-site behaviour | United States — transfers subject to Google’s standard contractual safeguards |
| Reviews.io | Collection and display of customer product/service reviews | Name, email address, order reference, review content | United Kingdom / EEA |
| Freshdesk | Customer service ticketing and support | Name, email address, order details, correspondence content | European Union — Freshdesk (Freshworks) data centres; transfers outside the EEA, where applicable, are subject to Standard Contractual Clauses |
We may also disclose your data where required by law, to comply with a court order or regulatory request, to a professional adviser (such as a solicitor or accountant), or to a third party in connection with the sale, merger or restructuring of our business, in which case the recipient would be bound by terms at least as protective as this Policy.
5. International Transfers of Data
Some of our service providers process data outside the United Kingdom, including in the European Economic Area and the United States, as set out in the table in Section 4. Where this occurs, we ensure that an appropriate safeguard is in place, such as:
- a UK adequacy regulation recognising that the destination country provides an adequate level of data protection; or
- Standard Contractual Clauses (or the UK International Data Transfer Addendum) approved by the Information Commissioner’s Office, which contractually bind the recipient to UK GDPR-equivalent protections.
You can request further information about the safeguards applicable to a specific transfer by contacting us using the details in Section 11.
6. Cookies and Similar Technologies
Our Website uses cookies and similar tracking technologies to distinguish you from other users, remember your preferences, and understand how our Website is used. Cookies fall into the following categories:
- Strictly necessary cookies — required for the Website to function (e.g. shopping basket, account login, currency selection). These cannot be disabled.
- Analytics and marketing cookies — used by providers such as Google Analytics (to help us understand how visitors use our Website) and Omnisend (to recognise returning visitors and measure marketing effectiveness). We treat these as a single category of non-essential cookies for consent purposes (see below).
When you first visit our Website, you will be shown a cookie consent banner, operated using the CookieYes consent management platform, which allows you to either accept or decline non-essential cookies (the analytics and marketing cookies described above). Strictly necessary cookies are not subject to this choice, as they are required for the Website to function. If you decline non-essential cookies, those cookies will not be set on your device, although you may be asked again on a future visit or if you clear your browser’s cookies. You can also manage or delete cookies at any time through your browser settings, though this may affect the functionality of our Website.
7. How Long We Keep Your Data
We retain personal data only for as long as necessary for the purposes set out in this Policy, and to meet our legal and regulatory obligations. Our general retention periods are as follows:
- Order and transaction records (including associated customer data): 6 years from the end of the financial year in which the transaction took place, in line with UK tax and accounting record-keeping requirements;
- Customer service correspondence: up to 3 years from the date of last contact, to allow us to handle any follow-up queries or disputes;
- Marketing data (e.g. email subscription): until you unsubscribe or withdraw consent, or up to 24 months of inactivity, whichever is sooner;
- Website analytics data: in line with the default retention settings of our analytics provider, typically up to 14 months for individual-level data.
Where data is no longer needed, we will securely delete or anonymise it. Where deletion is not immediately possible (for example, where data exists within secure backups), we will ensure it is not used for any further purpose pending deletion.
8. How We Protect Your Data
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction, including secure (HTTPS/TLS) connections, restricted internal access to customer data, secure payment processing through our payment providers, and regular review of our security practices. While we take all reasonable steps to protect your data, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.
9. Children’s Data
Our Website and Products are not intended for, marketed to, or to be used by individuals under the age of 18. We do not knowingly collect personal data from anyone under 18. If we become aware that we have inadvertently collected personal data from a person under 18, we will take reasonable steps to delete that data as soon as possible. If you believe a child has provided us with personal data, please contact us using the details in Section 11.
10. Your Rights
Under UK GDPR, you have the following rights in relation to your personal data:
| Right | What it means |
|---|
| Access | You can ask us for a copy of the personal data we hold about you. |
| Rectification | You can ask us to correct inaccurate or incomplete data. |
| Erasure | You can ask us to delete your data where there is no compelling reason for us to continue holding it (this does not override our legal obligation to retain certain records, such as transaction records, for tax purposes). |
| Restriction | You can ask us to suspend the processing of your data in certain circumstances. |
| Portability | You can ask us to transfer your data to you or to another organisation in a structured, commonly used, machine-readable format. |
| Objection | You can object to processing based on legitimate interests, including direct marketing, at any time. |
| Withdraw consent | Where processing is based on consent, you can withdraw that consent at any time. |
To exercise any of these rights, please contact us using the details in Section 11. We will respond within one month of receiving a valid request, though this may be extended by a further two months for complex requests, in which case we will let you know. We may need to verify your identity before responding to a request to protect your data from unauthorised access.
Exercising these rights is normally free of charge. We may charge a reasonable administrative fee, or decline to act, if a request is clearly unfounded, repetitive or excessive.
11. Contact Us and Complaints
If you have any questions about this Privacy Policy, or wish to exercise any of your rights, please contact us at info@purepeptidesuk.com or by post to 73 Stoneleigh Broadway, Epsom, Surrey, KT17 2HP.
If you are unhappy with how we have handled your personal data, we would encourage you to contact us first so that we have the opportunity to resolve your concern directly. You also have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office (ICO):
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, our use of third-party service providers, or applicable law. Where we make a material change, we will post an updated version on our Website with a revised effective date, and where appropriate, notify you by email. We encourage you to review this Policy periodically.
Version 2.0 — June 2026 | Pure Progress Ltd | purepeptidesuk.com
