Privacy policy

Last updated: [date].

This privacy policy explains how PXP Textiles Ltd (we, us, our), of 36 Mossvale Road, Glasgow, Scotland, G33 5PU, collects, uses and protects your personal data when you visit this website or place an order with us. We are the data controller for the purposes of UK data protection law.

Email

support@pxppeptides.co.uk

1. Personal data we collect

• Identity and contact data: name, billing and delivery address, email address, telephone number.
• Order and transaction data: products purchased, order value, payment confirmation. We do not store full card numbers; those are handled by our payment provider.
• Account data: login details and order history, if you create an account; your date of birth, which we ask for when you create an account so that we can confirm you are 18 or over; and your sex, if you choose to give it. "Prefer not to say" is always offered, and choosing it stores nothing.
• Technical data: IP address, browser type, device information, and data collected through cookies (see clause 5).
• Communications: records of correspondence if you contact us, including complaints.
• Eligibility confirmation: your confirmation that you are 18 or over and are purchasing for research purposes, as required under our terms and conditions.

We do not knowingly collect special category data, such as health data, about you, and we ask that you do not send us such information unless it is necessary to resolve a query.

2. How we use your data, and our lawful basis

• Processing and fulfilling your order, taking payment, arranging delivery. Lawful basis: performance of a contract.
• Dealing with returns, cancellations and complaints. Lawful basis: performance of a contract, and legal obligation.
• Verifying that you meet our eligibility requirements, meaning age and the research-use declaration. Lawful basis: performance of a contract, and legitimate interests in lawful trading.
• Keeping accounting and tax records. Lawful basis: legal obligation.
• Sending service updates about your order. Lawful basis: performance of a contract.
• Improving our website and preventing fraud. Lawful basis: legitimate interests.
• Responding to the MHRA, trading standards or other regulatory requests. Lawful basis: legal obligation.

We only rely on "recognised legitimate interests", introduced by the Data (Use and Access) Act 2025, in the narrow, non-commercial circumstances the law permits: crime prevention and safeguarding, for example. For our ordinary commercial activities, such as marketing, we rely on your consent or on our own assessed legitimate interests, each balanced against your rights.

3. Marketing

We do not send marketing emails. There is no marketing sign-up on this site and no consent box at checkout, so no marketing consent is collected and none is relied on. The only emails we send are about an order or an enquiry you have made. We do not share your data with third parties for their own marketing purposes.

If that changes, this clause changes with it, and any marketing would be sent only to people who had opted in and could unsubscribe from any email.

4. Who we share your data with

We share personal data with:

• Payment processors, to take payment securely Wallid (WALLID.CO LTD).
• Couriers and delivery partners, to fulfil your order.
• IT, hosting and email service providers, who process data on our behalf under contract.
• Our accountant or bookkeeper, for tax and accounting purposes.
• Regulators or law enforcement, including the MHRA, HMRC or trading standards, where we are legally required to do so.
• A buyer, if we sell or reorganise our business, subject to equivalent protections for your data.

We do not sell your personal data.

5. Cookies and similar technologies

5.1 This site sets no cookies. There is no cookie banner and no cookie settings link, because there is nothing to consent to. There is no advertising pixel, no social media embed and no chat widget.

5.1a One script on each page counts visits, and it belongs to SeeWork, which hosts this site and holds our records (clause 8). It tells SeeWork that a page was viewed: the page’s address, the site you came from, any labels on the link you followed, and whether you are on a phone, a tablet or a computer. It sets no cookie and stores nothing on your device, which is why it is not behind a banner. To tell one visitor from another within a single day, SeeWork combines your IP address and browser type with a key it replaces every day and then deletes, and keeps only the result: your IP address itself is not stored, and the same person cannot be recognised from one day to the next. Nothing it counts is shared with anyone else.

5.2 What it does keep on your device is five browser storage entries. Four of them stay on your device and identify nobody. The fifth, pxp.account.key, does neither of those things, and is described as what it is:

• pxp.cart.v1, your basket. A product identifier and a quantity for each line and nothing else: no price, no product name, no personal information. Prices are worked out again from the catalogue every time the basket is drawn.
• pxp.ruo.v1, the date you acknowledged the research-use statement, so you are not asked again on every page.
• pxp.theme.v1, whether you chose the light or the dark appearance.
• pxp.account.key, your sign-in credential. Unlike the other four it is sent to our records service at db.seework.co whenever the site needs to know who you are — on the account page, and on the shop pages so the products and prices shown are those agreed with you — and it identifies you, because resolving it to your account is what it is for. Held in session storage, which normally means closing the tab signs you out; browsers can restore session storage when they reopen tabs after a restart, so on a shared or borrowed computer use Sign out rather than relying on closing the window.
• pxp.order.saved.v1, written only when you place an order: that order's reference, the product identifiers and quantities it was placed with, and its total, so that reloading the page does not file the same order twice. Also session storage, and cleared when the order completes. It is not sent anywhere, but it does describe a purchase you made.

5.3 All five are yours to inspect or delete, through your browser's settings. Clearing them empties your basket, signs you out of the portal, and returns the appearance and the research-use acknowledgement to their defaults.

5.4 The one request this site makes to anybody other than its own host and SeeWork is to Google Fonts, at fonts.googleapis.com and fonts.gstatic.com. That request necessarily tells Google the IP address of the device asking and which page asked. Serving the font files from PXP's own domain would remove it.

6. International transfers

Where any of our service providers store or process data outside the United Kingdom, we put appropriate safeguards in place, such as the UK International Data Transfer Agreement, an adequacy decision extended to the UK, or equivalent standard contractual clauses, so that your data receives a standard of protection that is not materially lower than in the UK.

7. How long we keep your data

We keep order and transaction data for as long as it is needed to fulfil the order, to deal with any returns or disputes, and to meet our accounting and tax obligations, which is generally six years from the end of the relevant tax year. We keep account data for as long as your account remains active. We delete or anonymise data once it is no longer needed for these purposes.

8. Security

We use appropriate technical and organisational measures, including encryption in transit and access controls, to protect your personal data against unauthorised access, loss or misuse.

9. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased, in certain circumstances;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time, where we rely on consent; and
• not be subject to decisions based solely on automated processing that significantly affect you. We do not currently use any such automated decision-making, and a decision to refuse an order is made by a person.

To exercise any of these rights, contact us at support@pxppeptides.co.uk. We will respond within one month, as required by law.

10. How to complain

If you are unhappy with how we have handled your data, contact us first at support@pxppeptides.co.uk so that we can try to resolve it directly. We aim to acknowledge data protection complaints within two business days.

You also have the right to complain to the Information Commissioner's Office, the United Kingdom's supervisory authority for data protection, at ico.org.uk or on 0303 123 1113, at any time. Complaining to us first does not affect that right.

11. Children

Our products and this website are intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18.

12. Changes to this policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated "last updated" date. Please check back periodically.