Privacy Policy

1. Controller

The controller responsible for processing personal data on novacell-peptides.com is NCBL Sciences OÜ, Tornimäe tn 5, 10145 Tallinn, Estonia, registry code 17455124 ("we"). NovaCell Peptides is a brand of NCBL Sciences OÜ. For any privacy questions, contact us at info@novacell-peptides.com.

2. Data we process

We only process data that is necessary for the respective purpose:

• Order data: name, delivery and billing address, email address, phone number (optional), ordered products, payment method and payment status. We do not collect card data.
• Confirmations during checkout (minimum age of 18, use exclusively for research purposes) with a timestamp and a shortened, non-reversible value derived from the IP address as evidence.
• Communication: the content of your emails and enquiries to us.
• Newsletter: email address, language and the time of sign-up and confirmation (double opt-in).
• Partner programme: details from your application, partner code, commission and payout data.
• Reviews: name or initials, review text and star rating that you publish yourself.
• Technical data when visiting the website: IP address, date and time, page requested, browser and device information (server logs of our host) and internal shop statistics (e.g. page views, cart events) without names or contact details.

3. Purposes and legal bases

• Processing orders, shipping, payment processing, payment reminders and customer service – Art. 6(1)(b) GDPR (contract).
• Compliance with legal obligations, in particular accounting, taxes and VAT (OSS) – Art. 6(1)(c) GDPR.
• Security of the shop, prevention of misuse and fraud, evidence of checkout confirmations, internal statistics to improve the shop and emails to existing customers (e.g. a request for a review) – Art. 6(1)(f) GDPR (legitimate interest). You may object at any time.
• Newsletter, reminders about an unfinished cart for people who have not ordered before, and analytics and marketing cookies – Art. 6(1)(a) GDPR (consent), which you can withdraw at any time with effect for the future.

4. Recipients and service providers

We only share data where this is necessary for the purposes above. Our service providers process data on our behalf and on our instructions (Art. 28 GDPR), or as independent controllers where their own legal obligations are concerned:

• Website hosting: Netlify, Inc. (USA).
• Database, backend and user accounts: Supabase, Inc. (USA).
• Sending emails: Resend (USA).
• Cryptocurrency payments: NOWPayments, only if you choose this payment method.
• Bank transfers: our account-holding bank.
• Shipping: our warehouse and dispatch in Poland and the carriers DPD and DHL as well as shipping brokers (Apaczka) – name, delivery address and, where needed for delivery notifications, email address or phone number.
• Tax and accounting service providers to meet our legal obligations.
• Google Ireland Limited (Google Analytics 4, Google Ads conversion measurement) – only after your consent in the cookie banner.

5. Transfers to third countries

Some service providers are based in the USA. Transfers are made on the basis of the EU-US Data Privacy Framework where the provider is certified, or on the basis of the European Commission's Standard Contractual Clauses (Art. 46 GDPR).

6. Cookies, local storage and consent

We use technically necessary browser storage (e.g. cart, language, your cookie choice) without consent, because the shop would not work otherwise.

Google Analytics 4 and Google Ads conversion measurement are only loaded after you agree in the cookie banner. You can change or withdraw your choice at any time via "Cookie settings" in the footer. Fonts are loaded from our own server.

7. Emails

We send order confirmations, payment and shipping information because they are part of performing the contract.

After an order we may ask you by email for a review or inform you about similar products. You can object to this at any time – via the link in every email or by writing to info@novacell-peptides.com – without incurring any costs other than the transmission costs at basic rates.

You only receive the newsletter after confirming your sign-up (double opt-in). You can unsubscribe at any time via the unsubscribe link.

8. Retention

We only store personal data for as long as necessary for the respective purpose. Contract and accounting records are kept for the statutory periods (under Estonian law generally 7 years). Newsletter data is kept until you unsubscribe, evidence of consent for as long as we have to be able to prove consent. Afterwards the data is deleted or anonymised.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future.

Right to object (Art. 21 GDPR): you can object to processing based on our legitimate interest on grounds relating to your particular situation. You can object to the use of your data for direct marketing at any time without giving reasons.

An email to info@novacell-peptides.com is sufficient for all requests.

10. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority, in particular the Estonian Data Protection Inspectorate responsible for us (Andmekaitse Inspektsioon, www.aki.ee), or the authority in your country of residence.

11. Necessity of data and minimum age

To place an order we need the details marked as mandatory in the order form; without them we cannot perform the contract. Our offer is aimed exclusively at persons aged 18 and over. No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

12. Data security

Data is transmitted in encrypted form (TLS). Access to customer data is restricted to authorised persons and protected for administrators by two-factor authentication.