Independent COA certificates · Delivery in 1–3 business days · Cash on delivery
Cart

Privacy Policy

1. Data Controller

The controller of the personal data processed through peptamed.eu is [COMPANY], registration number [REG NO], address: [ADDRESS], email: [EMAIL], phone: [PHONE]. This policy explains what personal data we collect, why we process it and what rights you have under the General Data Protection Regulation (EU) 2016/679 (‘GDPR’).

2. What Data We Collect

We process only the data necessary for the operation of the store:

  • Order data — first and last name, delivery address, phone number, email address, contents of the order and the selected payment method;
  • Communication data — emails and enquiries you send to us;
  • Technical data — IP address, browser and device type, and server log records collected automatically when you visit the site;
  • Payment data — for bank transfers we see the payer name and the transfer reference; we do not store card numbers.

We do not collect special categories of data and we do not carry out automated decision-making or profiling.

3. Purposes and Legal Bases

  • Performance of a contract (Art. 6(1)(b) GDPR) — receiving, processing and delivering orders, order-related communication, handling claims and returns;
  • Legal obligations (Art. 6(1)(c) GDPR) — accounting and tax records, issuing sales documents;
  • Legitimate interest (Art. 6(1)(f) GDPR) — site security, prevention of fraud and abuse, establishment and defence of legal claims;
  • Consent (Art. 6(1)(a) GDPR) — only if we introduce a newsletter or marketing messages in the future; we currently do not send any without explicit consent.

4. Retention Periods

Order data and the related sales documents are kept for the periods required by accounting and tax legislation (as a rule up to 10 years for accounting documents). Correspondence is kept for up to 2 years after the matter is closed. Server logs are kept for a short period (as a rule up to 12 months) for security purposes. After these periods expire, the data is deleted or anonymised.

5. Who We Share Data With

We do not sell personal data. We share it only with processors and recipients necessary for providing the service:

  • Courier companies — Speedy (for Bulgaria) and partner couriers for EU deliveries receive your name, address, phone number and, for cash on delivery, the amount due;
  • Hosting provider — the servers on which the site runs, located within the European Union;
  • Accounting and legal advisors — where required by law or for the protection of legal interests;
  • Public authorities — only on a valid legal basis.

We do not transfer data to third countries outside the EU/EEA. Should this become necessary, we will apply appropriate safeguards under Chapter V of the GDPR.

6. Cookies

The site uses only technically necessary cookies:

  • Essential cookies — for the shopping cart, session and language selection; the store cannot function without them;
  • LiteSpeed Cache — technical cookies of the caching system that improve loading speed and do not track the user.

We currently do not use any third-party marketing, advertising or analytics cookies. If this changes, we will ask for prior consent via a cookie banner.

7. Your Rights

Under the GDPR you have the right to:

  • access your personal data and receive a copy of it;
  • rectification of inaccurate data;
  • erasure (‘right to be forgotten’) where there is no legal ground for further storage;
  • restriction of processing and objection to processing based on legitimate interest;
  • data portability in a structured, machine-readable format;
  • withdraw any consent at any time, without affecting the lawfulness of processing carried out before the withdrawal;
  • lodge a complaint with a supervisory authority — for Bulgaria this is the Commission for Personal Data Protection (CPDP, www.cpdp.bg); you may also contact the supervisory authority of your country of residence.

8. Contact

To exercise your rights or for any questions about personal data, contact us at [EMAIL] or at [ADDRESS]. We will respond without undue delay and no later than one month after receiving your request.