Skip to main content
Research use only · Laboratory handling only
JUNI peptides
Research use onlySold for laboratory research use only. Not for administration, ingestion, inhalation, or topical application. Not a drug, food, or cosmetic.

Privacy

We collect the minimum personal data needed to ship an order and to comply with our legal obligations.

Controller

The data controller under GDPR Article 4(7) is the entity responsible for operating this storefront. Its identifying details are being finalized with counsel and will be published on the imprint page once confirmed.

Data we collect

  • Name, email, billing and shipping address — required to fulfil orders.
  • Order history — retained for accounting and customer support.
  • Payment metadata — including provider, amount, currency, transaction and order references, status, and reconciliation evidence. Payment providers handle payment-account credentials and transfer execution; we do not receive or store customer payment-account passwords.
  • For PeerPay checkouts, internal cart, order, payment, and payment-session identifiers; the selected payment-method group; configured settlement asset, network, and destination identifiers; PeerPay order and payment status snapshots; signed internal references; and verified webhook event identifiers, timestamps, payload digests, processing outcomes, and payloads. Hosted-checkout tokens are encrypted at rest while they are needed.
  • Anonymous traffic analytics — to understand which pages are read.

How we use it

  • To process and ship your order.
  • To communicate about your order (confirmation, dispatch, problems).
  • To meet tax and customs reporting obligations.
  • To improve the site and detect abuse.

What we do not do

  • Sell or rent your data.
  • Send marketing emails without explicit opt-in.
  • Run third-party advertising trackers.

Retention

Order records are retained for the period required by accounting and tax law in the operating jurisdiction (typically 7 to 10 years), then deleted or anonymized.

For PeerPay, full webhook payloads with a resolved status of processed or ignored are replaced with a pruned marker after 90 days. The event identifier, payload digest, processing outcome, and related order and payment evidence remain in the transaction and reconciliation record for the applicable accounting or legal-retention period.

Unresolved PeerPay webhook payloads and audit or reconciliation records, including records marked failed, dead_lettered, or reconciliation_required, are not included in the automatic 90-day pruning process. They are retained while the issue is unresolved so an authorized replay or investigation remains possible. Once resolved, the resolved-payload rule above applies; earlier removal requires an authorized manual retention or deletion process and is subject to legal-retention obligations. Encrypted hosted-checkout tokens are removed when the related attempt is fulfilled or cancelled.

Your rights

EU and UK residents are entitled to the following rights under the General Data Protection Regulation (Regulation (EU) 2016/679) and the UK GDPR:

  • Article 15 — Right of access. Confirmation of whether we process your personal data and a copy of it.
  • Article 16 — Right to rectification. Correction of inaccurate or incomplete data.
  • Article 17 — Right to erasure (“right to be forgotten”). Deletion where one of the grounds in Art. 17(1) applies and no overriding legal-retention obligation intervenes.
  • Article 18 — Right to restriction of processing.
  • Article 20 — Right to data portability. Receipt of data in a structured, commonly used, machine-readable format.
  • Article 21 — Right to object to processing based on legitimate interest or carried out for direct marketing.
  • Article 77 — Right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.

To exercise any of these rights write to research@junipeptides.com. We respond within 30 days (extendable by a further two months where necessary under Art. 12(3)).

EU residents may also lodge a complaint with their national data-protection authority. The directory is published by the European Data Protection Board at edpb.europa.eu/about-edpb/about-edpb/members_en.

Subprocessors

We operate the storefront, e-commerce backend, and primary database in our controlled application environment. We also use approved external providers for some delivery functions. Those providers may process personal data on our behalf, including:

  • Resend (Delaware, USA) — transactional email delivery (order confirmations, shipping updates). EU SCCs in place.
  • Cloudflare (San Francisco, USA) — DNS, CDN, DDoS protection, and edge tunnel terminating to our origin. EU SCCs in place.
  • Cloud object storage and media delivery provider — storage and delivery of product and other site media. The production provider, processing regions, transfer terms, and data-processing agreement must be approved and identified in this notice before the service is launched.
  • Traffic analytics provider (optional) — anonymous or pseudonymous traffic measurement. Analytics is disabled by default; if enabled, the production provider and processing terms must first be approved and identified in this notice.
  • BTCPay Server — self-hosted on our infrastructure for Bitcoin / Lightning settlement.
  • PeerPay — hosted payment checkout for supported payment apps and crypto wallets. We provide the order amount and currency, callback URLs, the selected payment-method group, and an opaque signed attempt reference needed to reconcile the payment. We receive and retain PeerPay order, payment, and verified-webhook status snapshots as described under “Data we collect” and “Retention” above. PeerPay and the payment platform you choose process the payment-account and transaction evidence under their own notices and retention obligations. We do not receive or store your payment-platform password or login credentials. This processing is necessary to perform the purchase contract.

Media storage and delivery are not self-hosted in the supported production topology. Traffic analytics is either disabled or supplied by the specifically approved external provider disclosed above.

Contact

Data-protection enquiries: research@junipeptides.com.