Privacy Policy — Hati Peptides

1. Who We Are

Hati Peptides ("we", "us", "our") is a UK-based supplier of research-grade peptides. We are registered in England and Wales. Our registered office address is available on request. For data protection purposes, we are the data controller of your personal information.

2. Information We Collect

We collect the following personal information when you use our website:

• Contact information: Name, email address, shipping address, postcode
• Order information: Products purchased, order history, payment method
• Technical information: Browser type, device information, and your IP address
• IP address and request metadata: We record the IP address from which you place orders, request verification codes, request login links, and from which payment webhooks are received. We also record the IP address associated with your account sign-up and last login.
• Cookies and usage data: See our Cookie Policy for details

3. How We Use Your Information

We use your personal information for the following purposes:

• To process and fulfil your orders
• To communicate with you about your orders and account
• To verify your age and eligibility (18+ requirement)
• To comply with legal and regulatory obligations
• To improve our website and services
• To prevent fraud and ensure security, including rate-limiting abusive requests, investigating suspicious activity, and resolving disputes

Legal basis: We process your data based on contract performance (order fulfilment), legal obligations (tax, age verification), and legitimate interests (fraud prevention, website improvement). IP address collection is justified under our legitimate interest in preventing fraud and abuse.

4. Data Sharing

We do not sell your personal information. We may share your data with:

• Service providers: Payment processors, email services (Resend), shipping carriers (Royal Mail)
• Legal authorities: When required by law, court order, or regulatory request
• Professional advisers: Accountants, insurers, and legal advisers as necessary

5. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for legal, accounting, or reporting requirements. Typically:

• Order data: 7 years (for tax and accounting purposes)
• Account data: Until you delete your account or we close inactive accounts
• Marketing data: Until you unsubscribe
• IP addresses and request metadata: 2 years (for fraud prevention and dispute investigation)

6. Your Rights

Under GDPR, you have the following rights:

• Access: Request a copy of your personal data
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data ("right to be forgotten")
• Restriction: Request limitation of processing
• Portability: Request transfer of your data
• Objection: Object to processing based on legitimate interests

To exercise your rights, email us at privacy@hatipeptides.co.uk. We will respond within 30 days.

7. Cookies

We use cookies and similar technologies. See our Cookie Policy for full details.

8. Security

We implement appropriate technical and organisational measures to protect your personal data, including SSL encryption, access controls, and regular security reviews. However, no internet transmission is completely secure.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or a prominent notice on our website.

10. Contact Us

For any privacy-related questions or to exercise your rights, contact:

Data Controller: Hati Peptides
Email: privacy@hatipeptides.co.uk