Privacy policy

1. Who we are

NH Peptides supplies lyophilised research peptides and small molecule research compounds to qualified researchers and purchasing institutions in the United Kingdom. In this policy we refer to ourselves as “we”, “us” and “our”, and “you” means anyone who uses this website, contacts us, or places an order with us.

We are the data controller for the personal information described in this policy. This means we decide what personal information is collected through this website and what it is used for, and we are responsible for looking after it. Our processing is governed by the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations.

If you have any question about this policy, or you want to exercise any of the rights set out in section 10, contact us at [privacy contact address]. We will give you our full business details on request.

2. Information we collect

We only collect information that you provide to us, or that is generated automatically when you use the website. We do not buy personal data from third parties.

Information you give us

• Name, and the name of the institution, laboratory or business you purchase on behalf of
• Billing address, delivery address, email address and telephone number
• Account credentials, if you create an account
• Your confirmation that you are aged 18 or over and that material is being purchased for laboratory research use
• The content of any enquiry, support message or documentation request you send us
• VAT registration number and purchase order references, where you supply them

Information generated when you use the website

• Order history, lot numbers supplied to you, and delivery and returns records
• IP address, device type, browser and approximate location, used for security and fraud prevention
• Pages viewed and actions taken on the site, where you have consented to analytics cookies

Payment information. Card details are entered directly into our payment provider’s systems and are not stored on our servers. We receive confirmation of payment, the payment reference, and the last four digits and card type for reconciliation and fraud checks only.

We do not ask for special category data, and you should not send us health information or any other sensitive personal data when you contact us.

3. How we use your information and our lawful basis

Under UK GDPR we must have a lawful basis for every use of your personal information. The purposes we process for, and the basis we rely on, are set out below.

• Taking, processing and delivering your order, including passing delivery details to our carrier and handling returns. Basis: performance of a contract with you, or steps taken at your request before entering a contract.
• Managing your account and responding to enquiries, including supplying certificates of analysis and storage documentation. Basis: performance of a contract, or our legitimate interests in responding to people who contact us.
• Confirming that you are aged 18 or over and are a qualified researcher or purchasing on behalf of a research institution, laboratory or business. Basis: our legitimate interests in restricting supply appropriately, and compliance with our legal obligations.
• Fraud prevention, payment screening, and protecting the security of the website. Basis: our legitimate interests in preventing fraud and misuse, and compliance with legal obligations.
• Keeping accounting, tax and transaction records. Basis: compliance with a legal obligation.
• Maintaining lot traceability records so that supplied material can be traced if a batch issue arises. Basis: compliance with legal obligations and our legitimate interests in product traceability.
• Sending restock alerts, new lot notices and other marketing email. Basis: your consent, or the soft opt-in described in section 4.
• Analytics and improving the website. Basis: your consent, given through the cookie banner.

Where we rely on legitimate interests, we have assessed those interests against your rights and freedoms. You can ask us for further information about that assessment, and you can object to processing carried out on this basis as described in section 10.

Providing the information marked as required at checkout is necessary for us to enter into a contract with you. If you do not provide it, we cannot accept your order.

4. Marketing and your choices

We send marketing email in two situations only.

• Where you have opted in. If you sign up for restock alerts or new lot notices, we send those messages on the basis of the consent you gave at sign up.
• Where you are an existing customer. If you have bought from us, we may email you about similar research products and documentation. You are given the opportunity to refuse this when you place your order and in every message we send.

You can withdraw consent or object to marketing at any time. Use the unsubscribe link in any marketing email, or write to us at [privacy contact address]. We action requests promptly and in any event within one month.

Withdrawing marketing consent does not stop service messages that we must send to fulfil your order, such as order confirmations, dispatch and tracking notices, invoices, returns correspondence and any safety or batch notice affecting material you have received.

We do not sell or rent your details to other organisations for their own marketing.

5. Cookies and similar technologies

We use cookies and similar technologies on this website. Strictly necessary cookies, which keep your basket, session, account login and security protections working, are set without consent because the site cannot function without them.

All other cookies, including analytics and any marketing or measurement tags, are only set once you accept them through our cookie banner. You can change or withdraw your choice at any time using the cookie settings link, or by clearing cookies in your browser.

Further detail on the individual cookies we set, their purpose and their lifespan is available in our cookie notice.

6. Who we share your information with

We share personal information only where it is needed for the purposes in section 3. The categories of recipient are:

• Payment providers, to take payment and carry out fraud and authentication checks
• Delivery carriers, to deliver your order and provide tracking
• Website hosting, security and IT support providers, who maintain the platform on our behalf
• Email and marketing platform providers, who send messages on our instructions
• Accountants, auditors and professional advisers, where required for our records or legal position
• Regulators, law enforcement and other authorities, where we are legally required to disclose information or need to establish, exercise or defend legal claims

Providers acting on our behalf are appointed as processors under written contracts that require them to act only on our instructions, to keep the information secure, and not to use it for their own purposes.

If our business is sold or reorganised, personal information may be transferred to the acquiring party. We will tell you if that happens and if it changes how your information is used.

7. Transfers outside the United Kingdom

Some of our service providers are based outside the United Kingdom, or store data outside it. Where personal information is transferred outside the UK, we make sure one of the following safeguards is in place:

• The country is covered by UK adequacy regulations
• The transfer is made under the International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses
• Another safeguard permitted by UK data protection law applies

You can request details of the safeguard applied to a particular transfer by contacting us.

8. How long we keep your information

We keep personal information only for as long as we need it for the purpose it was collected for, or for as long as the law requires.

• Order, invoice and tax records. Six years from the end of the accounting period they relate to, to meet HMRC record keeping requirements.
• Lot traceability records linking a supplied lot to a purchaser. Six years from the date of supply, so that material can be traced if a batch issue arises.
• Account records where no order has been placed. Deleted after twenty four months of inactivity.
• Enquiries and support correspondence. Twenty four months from the last contact, unless the matter relates to an order or a claim.
• Marketing subscriber records. Held until you withdraw consent or object.
• Suppression records. If you unsubscribe, we keep the minimum information needed to make sure we do not contact you again. This record is kept indefinitely because deleting it would risk us contacting you in error.
• Website and security logs. Twelve months.

When information is no longer needed we delete it, or anonymise it so that it can no longer be linked to you.

9. How we protect your information

We have technical and organisational measures in place appropriate to the information we hold:

• In transit. The website is served over HTTPS and information you submit is encrypted in transit. You can confirm this from the padlock in your browser address bar.
• Access control. Access to customer records is limited to the people who need it to do their job, protected by individual accounts and strong authentication.
• Payment data. Card details are handled by our payment provider and are not stored on our systems.
• Infrastructure. Hosting is maintained in a monitored environment with firewalling, patching and backups.
• Incident response. We have a procedure for handling suspected personal data breaches. Where a breach is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner’s Office within seventy two hours of becoming aware of it, and tell you directly where the law requires it.

No transmission over the internet can be guaranteed completely secure. Where you hold an account with us, you are responsible for keeping your password confidential.

10. Your rights

Under UK data protection law you have the following rights. Some of them apply only in certain circumstances.

• Access. Ask for a copy of the personal information we hold about you.
• Rectification. Ask us to correct information that is inaccurate or incomplete.
• Erasure. Ask us to delete your information, where we no longer have a lawful reason to keep it. This does not override records we are legally required to retain, such as accounting and traceability records.
• Restriction. Ask us to pause our use of your information while an accuracy or objection issue is resolved.
• Portability. Ask for the information you gave us, in a structured, commonly used, machine readable format, where we process it by automated means on the basis of consent or a contract.
• Objection. Object to processing carried out on the basis of legitimate interests. Where you object to direct marketing, we will stop without exception.
• Withdrawing consent. Withdraw consent at any time where we rely on it. This does not affect processing carried out before you withdrew.

To exercise a right, write to [privacy contact address]. We may ask you for information to confirm your identity. We respond within one month, and will tell you if we need to extend that period because the request is complex.

There is no charge for making a request, unless it is manifestly unfounded or excessive.

11. Complaints

If you are unhappy with how we have handled your personal information, please contact us first so we can try to put it right.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection.

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

12. Changes to this policy and how to contact us

We review this policy regularly and may update it to reflect changes in the law, in our providers, or in how the website works. Any revised version is published on this page with an updated date below. Where a change materially affects how we use your information, we will tell you directly.

To contact us about this policy, about your personal information, or to make a request under section 10:

• Business: NH Peptides
• Email: sales@nhpeptides.co.uk 
• Phone: 07469 330817

Written correspondence can be sent to our business address, which we will provide on request.

Effective date: 02/09/2026. Last updated: 02/09/2026.