Privacy policy

BacLab is the data controller for the personal data described in this notice. That means we decide what is collected and why, and we are accountable for it under the UK GDPR and the Data Protection Act 2018.

How to reach us about data protection

our contact page

We have not appointed a Data Protection Officer; we are not required to. Data protection questions go to the contact above.

We collect only what an order needs. Specifically:

Identity and contact data

Your name, email address and, where you give it, your phone number.

Delivery data

The postal address you supply so the order can be sent to you. For card orders this reaches us from Stripe after payment, because the address is collected on Stripe’s checkout page rather than ours.

Order data

What you bought, the quantity, the price, the currency, the order status, and the dates the order moved between statuses.

Payment data

A payment reference from the payment provider, the provider name, and the method used (for example “card”). We never receive, see or store your card number, expiry date or security code.

Correspondence

Messages you send us, and our replies.

Email delivery records

Which order emails were sent to which address and when, so we do not send the same message twice.

Mailing list

If you join our mailing list: your email address, when and where on the site you signed up, the wording you agreed to, a one-way scrambled form of your IP address (used only to spot bulk sign-ups), and whether your welcome gift has been used.

We do not ask for, and do not want, any special category data — including health data. Please do not send us any.

To take and fulfil your order — performance of a contract

Processing payment, packing, dispatching, and sending order confirmation, dispatch and delivery emails. Without this data we cannot sell to you.

To keep accounting and tax records — legal obligation

We must retain records of what we sold, to whom and for how much, to satisfy HMRC and company law.

To answer your questions and handle returns — legitimate interests

Our interest in running a business that responds to its customers. We have considered your rights and consider this processing unintrusive and expected.

To prevent fraud and secure the site — legitimate interests

Our interest, and yours, in not being defrauded. This includes rate-limiting and checking orders that look anomalous.

To send our mailing list — consent

You opted in when you signed up. See clause 5.

To send past customers repurchase reminders and occasional offers — the PECR soft opt-in

See clause 5.

To measure how the site is used — consent

See clause 6.

Card, Apple Pay and Google Pay payments are processed by Stripe Payments Europe, Ltd. on Stripe’s own hosted checkout page. Your card details are entered there and never pass through this website. Stripe is a separate data controller for the payment data it collects, and processes it under its own privacy policy at stripe.com/gb/privacy. Stripe returns to us only what we need to fulfil the order: your name, email, delivery address and a payment reference.

Where cryptocurrency payment is offered, the payment gateway receives the order reference and the amount. It does not receive your name, email or address, and we do not receive your wallet address except where you give it to us for a refund.

Transactional email. Order confirmation, dispatch and delivery notifications are part of fulfilling your order. They are not marketing and you cannot opt out of them while an order is live — you would not know where your order was.

Repurchase reminders. We may email you once, some time after an order, to say that your supply is likely running low. This is marketing. We send it under the “soft opt-in” in regulation 22(3) of the Privacy and Electronic Communications Regulations 2003: you bought a similar product from us, it is about that product, and every such email carries a one-click unsubscribe link. Use it and we will record your address on a suppression list and never send you another. You may also opt out at any time by emailing our contact page.

Our mailing list. If you sign up on this site, we email you about offers, restocks and new pack sizes, on the basis of your consent. Signing up also entitles you to one free vial on your first order: we add it automatically when you check out from the browser you signed up on, or with the email address you signed up with. Every email carries a one-click unsubscribe link; use it, or email our contact page, and we stop. We keep your signup record while you are subscribed, and the fact that you unsubscribed (your email address only) so that we never email you again.

Offers to past customers. If you have bought from us, we may also occasionally email you offers on our own products under the same soft opt-in as repurchase reminders, with the same one-click unsubscribe.

Email is delivered by Resend, acting as our processor. We keep a record of which emails were sent to which address and when.

Unless you accept cookies or join our mailing list, this site sets no cookies on a shopping visitor’s browser. Your basket is held in your own browser’s local storage, on your device, and is never transmitted to us until you check out. Clearing your browser data clears it. The only cookies this site sets itself are a session cookie for staff signing into the admin area, set only after a successful staff login, and, if you join our mailing list, a cookie that remembers you did, set when you sign up or follow the link in one of our emails, so this browser can receive your welcome vial. Both are strictly necessary for something you asked for, and neither tracks you.

With your consent, we also use the Meta Pixel, which measures how the site is used and how our adverts perform. It sets its own cookies and identifiers on your device and processes data about your visit under its own privacy notice.

None of this loads until you click Accept on our cookie banner. If you click Reject, or make no choice, nothing is loaded and no tracking cookie is set. The banner remembers your choice in your browser’s local storage, which is not a cookie and is never sent to us.

You can change your mind at any time using , which also sits at the foot of every page. Withdrawing consent stops the tracking and clears the cookies these services left on this site’s domain. It does not affect anything collected while consent was in place.

Stripe sets its own cookies on Stripe’s checkout page, including for fraud prevention. That happens on Stripe’s domain and is governed by Stripe’s privacy policy.

We do not sell your personal data, and we never share it for anyone else’s marketing. We share it only with the organisations that make an order possible:

• Stripe — payment processing and refunds.
• Resend — sending order and reminder emails.
• Trustpilot — your name, email address and order reference, so Trustpilot can invite you to review your order. It sends one invitation, which you can ignore, and does not receive what you bought or your address. If you have unsubscribed from our emails we do not pass your details on. Trustpilot’s review widgets on this site load from Trustpilot’s servers.
• Our delivery carrier — your name and delivery address, so the parcel can reach you.
• Our hosting provider — which stores the site and its database on our behalf.
• Professional advisers and authorities — our accountant, and any regulator, court or law enforcement body where we are legally required to disclose.

Each of these acts as our processor under a written contract, except Stripe, which is a separate controller for payment data. If our business is sold or transferred, your data may transfer with it; the buyer would be bound by this notice.

Some of our providers process data outside the UK, including in the United States. Where that happens we rely on the safeguards permitted by Article 46 of the UK GDPR — a UK adequacy decision where one covers the country, or the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. You can ask us for details of the safeguard used for any specific transfer.

Order and payment records

6 years from the end of the financial year the order falls in, because HMRC requires it. We cannot delete these earlier, even on request.

Correspondence

Up to 2 years after the matter is closed, so we can pick up a returning question.

Email suppression list

Indefinitely. Keeping your address on a do-not-email list is the only way to guarantee we do not email you again.

Server and security logs

Typically 30 to 90 days, depending on the provider.

When a retention period ends we delete the data or irreversibly anonymise it, so what remains can no longer identify you.

The site is served over HTTPS. Admin access requires a password and is protected by a signed, HTTP-only, secure session cookie, with credentials stored as bcrypt hashes. Access to order data is limited to the people who need it to pack and support orders. No system is perfectly secure, and we cannot guarantee the security of data in transit across the internet, but we will notify you and the ICO where a breach is likely to result in a risk to your rights, within 72 hours of becoming aware of it.

Under the UK GDPR you have the right to:

• be informed about how we use your data — this notice;
• access a copy of the data we hold about you;
• rectify data that is inaccurate or incomplete;
• erasure of your data, where we have no overriding reason to keep it — note that tax records are such a reason;
• restrict our processing while a dispute about accuracy or legitimate interests is resolved;
• data portability — to receive the data you gave us in a structured, commonly used, machine-readable format;
• object to processing based on legitimate interests, and to object to direct marketing at any time, absolutely; and
• withdraw consent at any time where we rely on it, without affecting processing carried out before you withdrew it.

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

To exercise any of these, contact our contact page. We respond within one month, and will tell you if we need to extend that by up to two further months because the request is complex. There is no charge unless a request is manifestly unfounded or excessive. We may ask you to confirm your identity first, so that we do not disclose your data to someone else.

If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at any time — ico.org.uk/make-a-complaint or 0303 123 1113. Complaining to us first is not a precondition of complaining to them.

This site is not intended for anyone under 18 and we do not knowingly collect data about children. If you believe a child has given us personal data, contact our contact page and we will delete it.

We update this notice when what we do with personal data changes. The date at the top of this page is the date of the current version. Where a change materially affects you — a new purpose, a new recipient, a new lawful basis — we will tell you directly rather than relying on you re-reading this page.