Privacy Policy
1 About this policy
This Privacy Policy explains how Black Summit Ventures Ltd, trading as Peptology Labs, collects and uses personal information when you visit https://peptologylabs.is, create an account, place an order, subscribe to updates or contact us.
We process personal information under the EU General Data Protection Regulation (“GDPR”), applicable Cyprus data-protection legislation and, where applicable, the UK GDPR and other relevant privacy and electronic-communications laws.
This policy provides information about our processing. Using the website or accepting our Terms and Conditions does not, by itself, constitute consent to marketing or optional tracking.
2 Who is responsible for your information
The controller responsible for the processing described in this policy is:
Black Summit Ventures Ltd, trading as Peptology Labs
Company registration number: HE 498301
Business address: Amathountos 74, Agios Tychonas, 4532 Limassol, Cyprus
Email: info@peptologylabs.is
Website: https://peptologylabs.is
Contact us at the above email address with privacy enquiries or requests concerning your personal information.
3 Information we collect and its sources
Information you provide may include your name, billing and delivery addresses, email address, telephone number, account credentials, order details, marketing preferences, reviews and information sent through our contact form or customer-support channels.
Where reasonably needed to verify eligibility to purchase research materials, we may request relevant organisation details, purchasing authority and information about the proposed research purpose. We limit requests to information needed for that assessment.
Transaction records may include the amount, currency, payment reference, payment status, refund details and payer or bank-account information supplied by you, our bank or a payment provider. We do not request your online-banking password or bank authentication codes.
Technical information may include IP address, browser and device details, security logs, cookie identifiers, pages visited, referral source and website interactions. Optional analytics and advertising information is collected subject to the choices and rules described in section 7.
We also receive relevant information from payment providers, banks, fulfilment partners and carriers, such as payment confirmations, fraud alerts, tracking updates and delivery information. Where email engagement tracking is enabled and legally permitted, we may receive information about message delivery, opens and link clicks.
Please do not send medical records, health information or other sensitive personal information that is unnecessary for your enquiry. We do not request such information to provide medical advice. Unnecessary sensitive information may be removed or access restricted; any necessary processing requires an applicable legal basis and special-category condition, such as establishing or defending legal claims.
4 Purposes and lawful bases
We use personal information for the purposes below. The applicable basis depends on the activity and your relationship with us.
Orders, payments, delivery and refunds: we use identity, contact, order and transaction information to take steps at your request before a contract and perform our contract with you. Where you act for an organisation, we rely on our legitimate interest in administering that business relationship for processing your representative contact details.
Accounts and customer support: we use account and communication information to provide requested account services, deal with order enquiries and administer contracts. General enquiries and organisational contacts are handled on the basis of our legitimate interest in responding to requests and operating the business.
Purchase verification, fraud prevention and security: we use relevant identity, order, payment and technical information for our legitimate interests in preventing fraud, protecting our systems and checking that orders meet our research-use restrictions. Where a specific legal duty requires a check or disclosure, we rely on that legal obligation.
Accounting, tax and required records: we retain and use relevant transaction and business records to comply with applicable legal obligations. Managing complaints, recovering sums lawfully due and establishing or defending claims may also rely on our legitimate interests in protecting our business and resolving disputes.
Marketing: we rely on consent where required. Where applicable electronic-marketing law permits messages without prior consent, we may rely on our legitimate interest in marketing relevant products, subject to the conditions of that permission and your right to object. Section 6 explains your choices.
Analytics and advertising: where optional tracking requires consent, we rely on that consent. Essential security and service-performance monitoring may rely on our legitimate interest in maintaining a secure, functioning website, provided any separate device-access or electronic-communications requirements are also met.
Reviews and service improvement: we use voluntarily submitted reviews and feedback for our legitimate interests in displaying genuine feedback and improving the service, subject to applicable publication and privacy requirements.
Where we rely on legitimate interests, we assess whether the processing is necessary and whether your rights and interests override ours. We do not treat that basis as a substitute for consent where consent is legally required.
5 Payments and delivery
Payments may be made through available bank-transfer or open-banking methods. Your bank and the payment provider handle authentication through their own systems. We receive information necessary to identify, reconcile and, where appropriate, refund the payment, rather than your banking login credentials.
Banks and payment providers may act as independent controllers for their own payment, security and regulatory activities. Their privacy notices explain that processing.
We provide fulfilment partners and carriers with information needed to prepare, dispatch, track and deliver orders and handle delivery issues. This may include your name, address, relevant contact details and the order or customs information needed for the shipment. These organisations may have independent legal and operational purposes described in their own notices.
6 Marketing and service communications
We may send promotional emails or other marketing messages where permitted by applicable law. Creating an account, making a purchase or having your details moved to a new system does not automatically constitute marketing consent.
Where permitted, we may use your preferences, purchase history and interactions to make messages more relevant. Optional tracking or advertising features are subject to section 7 and any consent required for the technology used.
You can stop marketing emails using the unsubscribe link or by contacting info@peptologylabs.is. We may retain a minimal suppression record so that your choice continues to be respected. You can object to direct marketing, including related profiling, at any time.
We may still send necessary messages about orders, payments, delivery, account security, product issues or material service changes. Such messages are separate from promotional subscriptions. Abandoned-cart or checkout reminders are sent only where applicable marketing rules permit them.
7 Cookies and similar technologies
We use cookies and similar technologies for functions such as maintaining a shopping cart, managing sessions, remembering privacy choices and protecting the website. Technologies strictly necessary to provide a service you request may operate without optional-cookie consent where the law permits.
Optional analytics, advertising pixels and comparable tracking technologies requiring consent are activated only after you consent. Where enabled with the required permission, these tools may measure visits, interactions and advertising conversions or support relevant advertising through external platforms.
You can accept or reject optional categories and change or withdraw your choice through the website’s cookie preference controls. Refusing optional tracking does not prevent use of essential shopping functions. Browser controls offer additional options, although blocking essential cookies may affect functionality.
The cookie notice and preference controls identify the technologies currently used, their providers, purposes and durations. Email open or click tracking is also subject to applicable consent and electronic-communications requirements; email cookies and pixels are not automatically authorised by website consent.
8 Who receives information
We share relevant information, where necessary and lawfully permitted, with:
- website hosting, infrastructure, security and technical-support providers;
- e-commerce, account, customer-service and business-administration providers;
- banks, payment providers and fraud-prevention services;
- fulfilment partners, carriers and customs intermediaries;
- email delivery and marketing-service providers;
- analytics and advertising providers, subject to applicable choices and consent;
- accountants, professional advisers and insurers; and
- public authorities or other parties where disclosure is legally required, or necessary and lawfully permitted to establish, exercise or defend legal claims.
Providers acting as our processors must process information under appropriate contractual instructions and protections. Other recipients, such as banks or carriers, may act as independent controllers for specified activities.
For a genuine business sale or restructuring, relevant information may be disclosed to professional advisers or a prospective successor where necessary and lawful, with appropriate confidentiality and access controls. Any change of controller is subject to applicable transparency requirements.
9 Existing records and the company transition
If customer records are lawfully transferred to Black Summit Ventures Ltd from Peptology Labs Ltd as part of the transition of the Peptology Labs business, they may include contact details, account records, order history, support correspondence and recorded privacy or marketing preferences.
For necessary service continuity, we rely on our legitimate interest in maintaining customer relationships or performance of a contract lawfully assumed by us, as applicable. Other uses follow the purposes and bases in section 4. We provide any additional notice required. Existing marketing choices must be respected; the transfer does not itself create new consent.
Peptology Labs Ltd may remain responsible for records it must retain for its own previous transactions, accounting or legal obligations. Changing this website policy does not automatically transfer responsibility for all historic processing.
10 International processing
Our service providers or their authorised subprocessors may process information outside the European Economic Area, including through hosting, support, payment or delivery operations. Where such processing constitutes a restricted international transfer, an applicable transfer mechanism is required.
Depending on the destination and recipient, this may be an applicable adequacy decision or approved contractual safeguards, such as the European Commission’s Standard Contractual Clauses, supported by any necessary assessment and supplementary measures. Where UK transfer rules also apply, the relevant UK mechanism must be used. Exceptions are used only where their legal conditions are met.
You can request information about relevant destinations and safeguards, including a copy of applicable safeguards with necessary confidential details redacted, by contacting info@peptologylabs.is.
11 How long we keep information
Retention depends on the type of information and why it is held. We use the following criteria:
Order, payment and accounting records: completion of the transaction, followed by the applicable statutory accounting, tax and audit retention periods and any relevant unresolved claim or investigation.
Account information: the period the account remains active or reasonably needed to provide requested services, taking account of inactivity and closure requests. Separately required transaction records may remain after account closure.
Support, complaints and verification records: resolution of the matter and any proportionate follow-up, security or legal-claims period. Unneeded supporting material is removed earlier where practicable.
Marketing records: the period for which the relevant permission or other lawful basis remains valid, subject to inactivity reviews. Limited consent evidence and suppression records may remain where needed to demonstrate and honour your choices.
Security logs, analytics and cookies: the period needed for their stated operational purpose, security investigation or configured retention setting. Cookie durations are identified in the cookie notice or preference controls.
We periodically review information and delete or genuinely anonymise it when no longer needed. Information subject to a legal hold may be retained for the relevant matter. Backups are removed or overwritten through the applicable backup cycle and are not used to bypass a valid deletion request.
12 Automated processing
Automated tools may support security screening, payment checks, website analytics and permitted marketing segmentation. Profiling for direct marketing is subject to your right to object.
If you believe an automated check has incorrectly affected an order or your account, contact info@peptologylabs.is to request an explanation and review. Where the law provides safeguards for a decision made solely by automated processing, including rights to human intervention, to express your views or to contest the decision, those safeguards apply. Any additional information required about such a decision will be provided at the relevant stage.
13 Security
We use technical and organisational measures appropriate to the nature and risks of the information processed, including controls over access and arrangements with service providers. Access is limited to authorised people who need the information for their work.
No system or transmission method is completely secure. This does not remove our data-protection responsibilities. Keep your login details confidential and notify us promptly if you suspect unauthorised account access.
14 Your choices and rights
Depending on the circumstances and applicable law, you may request access to your personal information, correction of inaccuracies, erasure, restriction of processing or a portable copy of qualifying information. You may object to processing based on legitimate interests on grounds relating to your situation.
You may object to direct marketing at any time. Where processing relies on consent, you may withdraw it without affecting the lawfulness of processing before withdrawal.
Contact info@peptologylabs.is to exercise your rights. We may request proportionate information to verify identity or clarify a request. We normally respond within one month; where a lawful extension applies, we will explain it. Requests are normally free, subject to the limited exceptions permitted by law.
Some information is needed to process an order, make delivery or meet a legal obligation. If you do not provide it, we may be unable to complete that activity. Optional marketing consent is not a condition of purchase. Deletion or objection rights do not require us to remove records we must lawfully retain.
15 Complaints
You can contact us about a privacy concern at info@peptologylabs.is. You also have the right to complain to a competent data-protection supervisory authority.
In Cyprus, this is the Commissioner for Personal Data Protection: https://www.dataprotection.gov.cy.
Where UK data-protection law applies, you may contact the Information Commissioner’s Office: https://ico.org.uk. You may also have the right to complain to the authority in the country where you live or work or where an alleged infringement occurred.
16 Children and external websites
Our products and purchasing services are intended for people aged 18 or over. We do not intentionally invite children to open accounts or submit personal information. If we discover information collected from a child through those services, we will assess and delete or restrict it as appropriate, subject to any lawful retention requirement.
External websites have their own privacy arrangements. This policy covers our processing and does not describe every activity of a linked website or independent provider.
17 Changes to this policy
We may update this policy to reflect changes in the business, systems or law. The revision date will identify the latest version. Where a material change or new purpose requires further notice or consent, we will provide that notice or obtain consent before the relevant processing begins.