Effective from 2026-04-17

Privacy Policy

Last updated: 2026-04-17

Version effective 17 April 2026. Data Protection Officer: privacy@peptidlabs.eu.

PeptidLabs takes the protection of your personal data seriously. This policy describes what data we collect, why we collect it, how we process it, and what your rights are under Regulation (EU) 2016/679 (GDPR) and the Bulgarian Personal Data Protection Act.

1. Data Controller

The controller within the meaning of the GDPR is PeptidLabs (търговско име). For questions related to personal data: privacy@peptidlabs.eu.

2. Data We Collect

Order data — name, delivery address, email, phone.
Payment data — processed entirely by Stripe; we do not store card numbers, CVVs or authentication data.
Shipping data — we transmit the minimum necessary data to the courier (Econt, Speedy, DHL or another carrier).
Technical data — IP address, browser type, access time, pages visited, anonymized for analytics purposes.
Cookies and local storage — see the separate Cookie Policy.

3. Purposes and Legal Basis

Contract performance — for order processing, delivery and communication (Art. 6(1)(b) GDPR).
Legal obligation — for retention of accounting records and invoices (Art. 6(1)(c) GDPR).
Legitimate interest — for fraud prevention and service improvement (Art. 6(1)(f) GDPR).
Consent — for marketing emails and non-essential cookies (Art. 6(1)(a) GDPR).

4. Retention Periods

Order data and invoices — 10 years under the Bulgarian Accounting Act.
Newsletter subscription data — until the Customer unsubscribes.
Technical logs — up to 90 days.
Cookies — per their configuration (see Cookie Policy).

5. Third Party Processors

Supabase Inc. (US, EU SCC) — database hosting.
Stripe Payments Europe Ltd. (Ireland) — card payment processing.
Resend Inc. (US, EU SCC) — transactional email delivery.
Econt Express / Speedy / DHL — courier services.
Vercel Inc. (US, EU SCC) — application hosting.

6. Your GDPR Rights

To exercise your rights, please write to privacy@peptidlabs.eu. We respond within 30 days.

Right of access (Art. 15) — to obtain confirmation and a copy of your data.
Right to rectification (Art. 16) — to request correction of inaccurate data.
"Right to erasure" (Art. 17) — the "right to be forgotten" in certain cases.
Right to restriction of processing (Art. 18).
Right to data portability (Art. 20) — to receive your data in a structured format.
Right to object (Art. 21) — including to profiling and marketing.
Right to lodge a complaint with the Bulgarian Personal Data Protection Commission — www.cpdp.bg.

7. Security

We apply technical and organizational measures, including TLS encryption in transit, database Row-Level Security, strict role-based access and regular security audits.

8. Minors

The platform is not intended for persons under 18. We do not knowingly collect data from minors.

9. Changes to this Policy

We may update this policy. The date of the last update is indicated at the top. Significant changes are communicated by email to registered customers.

10. Contact

Data Protection Officer (DPO): privacy@peptidlabs.eu

2. Data We Collect

Order data — name, delivery address, email, phone.

Payment data — processed entirely by Stripe; we do not store card numbers, CVVs or authentication data.

Shipping data — we transmit the minimum necessary data to the courier (Econt, Speedy, DHL or another carrier).

Technical data — IP address, browser type, access time, pages visited, anonymized for analytics purposes.

Cookies and local storage — see the separate Cookie Policy.

3. Purposes and Legal Basis

Contract performance — for order processing, delivery and communication (Art. 6(1)(b) GDPR).

Legal obligation — for retention of accounting records and invoices (Art. 6(1)(c) GDPR).

Legitimate interest — for fraud prevention and service improvement (Art. 6(1)(f) GDPR).

Consent — for marketing emails and non-essential cookies (Art. 6(1)(a) GDPR).

6. Your GDPR Rights

To exercise your rights, please write to privacy@peptidlabs.eu. We respond within 30 days.

Right of access (Art. 15) — to obtain confirmation and a copy of your data.

Right to rectification (Art. 16) — to request correction of inaccurate data.

"Right to erasure" (Art. 17) — the "right to be forgotten" in certain cases.

Right to restriction of processing (Art. 18).

Right to data portability (Art. 20) — to receive your data in a structured format.

Right to object (Art. 21) — including to profiling and marketing.

Right to lodge a complaint with the Bulgarian Personal Data Protection Commission — www.cpdp.bg.