Privacy policy

Who we are

Forge Peptides (“we”, “us”) is the data controller for this website.

For any question about your data, use the contact form and choose “Privacy and your data”. We aim to reply within one working day.

What data we collect

We collect only what we need to run the shop and look after your order.

• Identity and contact: your name, email address, phone number and delivery address, and your password if you create an account (stored only as a secure hash).
• Orders and payment: what you ordered, totals, and payment confirmations. Payments are made by pay by bank through Wallid, our payment provider. We never see your online banking login or any card details.
• Technical: your IP address and basic request details, used only to keep the site secure (for example, to slow down repeated sign-in attempts).
• Messages: anything you send us through the contact form or by email.
• Browsing and carts: the pages you look at, where you came from (a search engine or a link, for example) and what you put in your cart, so we can see how the shop is used and improve it. Visits are counted without cookies: each visitor is a code that changes every day, and we don’t keep your IP address. If you place an order, we note which visit it came from for 90 days. If you’re signed in or place an order, your cart is linked to your account or order.

How we use it

We use your data to process and deliver your orders, provide support and manage your account, meet our legal obligations (including enforcing our Research use only policy), keep the site secure and prevent fraud, and send you essential emails about your orders, account or our policies.

We only send marketing emails if you sign up for our newsletter, in the footer, at checkout or in your account. The only other emails you may get are ones you ask for, such as a back-in-stock alert, and one email after delivery asking how your order went. If you agreed to emails from us and leave a basket, or an order isn’t paid, we may send one email to say it’s saved. Every one of these emails has a link to stop them.

We never sell your data.

Lawful basis for processing

Under UK GDPR we rely on:

• Contract: processing your orders, managing your account and providing support.
• Legal obligation: meeting our obligations under UK tax and consumer law, and our Research use only policy.
• Legitimate interests: securing the site, preventing fraud, keeping accurate business records, and understanding how the shop is used so we can improve it. We weigh these against your rights and freedoms.
• Consent: our newsletter, back-in-stock alerts and basket reminders, when you agree to them. You can withdraw consent at any time.

Sharing and transfers

We share data only with service providers who need it to run the shop: our payment provider (Wallid, with Yapily, which connects the payment to your bank), the courier, our email delivery service and our hosting provider. Each is bound by a data-processing agreement and may use it only to provide their service to us.

Partners who refer customers to us see only an order number, date and their commission. They never see your name, email, address or what you ordered.

Where data is transferred outside the UK, we rely on safeguards recognised by the Information Commissioner’s Office, such as standard contractual clauses.

Cookies

We use the cookies the shop needs to work, plus optional ones you can accept or turn down. We count visits without cookies, and we don’t use advertising or third-party tracking cookies. The full list is in our Cookie policy.

Retention and security

Your name, email, phone number and address are encrypted when stored. Security logs are deleted after 14 days. Carts are deleted after 13 months (or when you delete your account), and visit records after 26 months.

Order records, including the delivery address, are kept for six years, as UK tax law requires, and then deleted. Account details are kept until you delete your account; deleting it doesn’t remove order records before then.

All traffic to the site is encrypted in transit, and access to customer data is limited to the staff who need it, with two-factor sign-in required.

Your rights

Under UK GDPR you have the right to access the personal data we hold about you, to have it corrected, deleted or restricted, to object to how we use it, and to receive a copy of it.

If you have an account, you can download your data or delete your account from your account page. Otherwise, contact us.

You can also complain to the Information Commissioner’s Office at ico.org.uk. We’d ask you to contact us first so we can try to put things right.

Children

We sell only to adults aged 18 and over and don’t knowingly collect data from anyone under 18. If you think a minor has given us personal data, contact us and we will delete it.

Data breaches

If a personal data breach is likely to put your rights and freedoms at risk, we will tell the Information Commissioner’s Office within 72 hours of becoming aware of it, and tell you directly without undue delay where required.

Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it last changed. We’ll tell you about significant changes by email or with a notice on the site.