GDPR Policy

Last updated: 17 August 2026

This policy applies to visitors and customers located in the European Economic Area (EEA), the United Kingdom, and Switzerland. It supplements our Privacy Policy and explains your rights under the EU General Data Protection Regulation (GDPR) and UK GDPR.

Where this policy and our Privacy Policy differ, this policy prevails for individuals in those regions.

1. Data Controller

Australian Peptides is the data controller for personal data collected through this Website.

Australian Peptides 100 Collins St, Melbourne VIC 3000, Australia Email: info@australianpeptides.com

We are based outside the EEA and UK. This policy applies where we offer goods to, or monitor the behaviour of, individuals located in those regions.

2. Personal Data We Process

Identity and contact data — name, email address, phone number, institution name
Order data — billing and shipping address, order history, product preferences
Account data — username, hashed password, account preferences
Payment data — transaction records and partial card identifiers (full card data is handled by our payment processors, not by us)
Technical data — IP address, browser and device type, operating system
Usage data — pages visited, session duration, referring URL, email open and click activity
Communications data — support enquiries and correspondence
Marketing preferences — consent records, opt-in and opt-out history

We do not process special category data.

3. Lawful Bases for Processing

We rely on the following lawful bases:

Performance of a contract — to process and deliver your order, manage your account, handle returns and refunds, and provide customer support.

Consent — to send marketing emails and SMS, and to set non-essential cookies including analytics and advertising cookies. You can withdraw consent at any time.

Legitimate interests — to secure our Website, prevent fraud and abuse, maintain business records, and analyse aggregate usage to improve our products and service. We balance these interests against your rights and freedoms.

Legal obligation — to comply with tax, accounting, customs, and regulatory record-keeping requirements.

4. Your Rights

You have the right to:

Access — obtain a copy of the personal data we hold about you
Rectification — have inaccurate or incomplete data corrected
Erasure — request deletion of your data where we have no overriding legal basis to retain it
Restriction — ask us to limit processing while a dispute or accuracy issue is resolved
Data portability — receive your data in a structured, machine-readable format, or have it transmitted to another controller
Object — object to processing based on legitimate interests, and to direct marketing at any time
Withdraw consent — withdraw consent for marketing or cookies at any time, without affecting the lawfulness of prior processing
Not be subject to automated decision-making — we do not carry out automated decision-making or profiling that produces legal effects

5. Exercising Your Rights

Email info@australianpeptides.com with your request and enough information to identify your records.

We respond within one month of receipt
For complex or multiple requests we may extend this by a further two months and will tell you if we do
We may ask you to verify your identity before releasing data
Requests are free of charge unless manifestly unfounded or excessive

To unsubscribe from marketing immediately, use the link in any of our emails or reply STOP to any SMS.

6. International Transfers

Your personal data is transferred outside the EEA and UK, including to Australia (where we operate) and the United States (where Mailchimp processes email marketing data).

For these transfers we rely on:

Standard Contractual Clauses approved by the European Commission, and the UK International Data Transfer Addendum where applicable
Supplementary technical measures including encryption in transit and access controls
Your explicit consent, where relevant

You can request information about the safeguards in place by contacting us.

7. Data Retention

Order and transaction records — 7 years, to meet tax and accounting obligations
Account data — for the life of your account, plus 12 months after closure
Marketing data — until you unsubscribe, after which we keep a minimal suppression record to honour your opt-out
Support correspondence — 24 months
Analytics data — 26 months
Cookie consent records — 12 months

Once a retention period ends, data is deleted or irreversibly anonymised.

8. Cookies and Consent

Non-essential cookies — including analytics, advertising, and remarketing cookies — are only set after you give consent through our cookie banner.

You can change or withdraw your cookie preferences at any time via the cookie settings link in our footer, or by clearing cookies in your browser. Essential cookies required for cart, checkout, and login cannot be disabled without breaking those functions.

9. Processors We Use

We share personal data with processors acting on our instructions under written data processing agreements. These include our website host, payment processors, shipping and logistics providers, Mailchimp (email marketing), and Google Analytics (website measurement).

We do not sell personal data.

10. Data Security

We apply appropriate technical and organisational measures including SSL/TLS encryption, hashed password storage, restricted administrator access, role-based permissions, and regular platform and plugin updates.

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and notify affected individuals without undue delay where the risk is high.

11. Complaints

If you have a concern, contact us first at info@australianpeptides.com and we will work to resolve it.

You also have the right to lodge a complaint with your local data protection authority. In the UK this is the Information Commissioner’s Office (ico.org.uk). In the EEA, a list of national authorities is available from the European Data Protection Board (edpb.europa.eu).

12. Changes to This Policy

We may update this policy to reflect changes in law or our processing activities. The current version is always published on this page with the effective date shown above.

13. Contact