Privacy policy

1. Controller

[Legal entity name], org. no. [XXXXXX-XXXX], [street address, postcode, city], Sweden, trading as Fitpeptides, is the controller of the personal data described here. For any privacy question or request, write to pepnordic@proton.me.

2. Information we collect

When you order we collect your name, delivery and billing address, email address, telephone number, order history and the fact of payment. Our payment provider processes the card or bank details themselves — we receive only a confirmation and the last digits of the instrument.

If you create an account we also store your login credentials in hashed form. If you contact us or apply to the affiliate programme we keep the correspondence and what you tell us about your audience. We collect basic technical data — IP address, browser, pages viewed — to keep the site secure and working.

3. Why we use it and on what legal basis

We use your data to take and deliver your order, handle payment, returns and support, and to meet legal obligations — that processing rests on performance of our contract with you and on legal obligation, in particular the Swedish Accounting Act. We use technical and aggregated data to secure and improve the site on the basis of our legitimate interest. We send marketing email only where you have asked for it, and every message carries an unsubscribe link.

4. Who we share it with

We share only what is needed with our payment provider, our shipping carriers, our email and hosting providers, and our accountant. They act as our processors under written agreements and may not use your data for their own purposes. We never sell personal data. If a processor is outside the EU/EEA, the transfer is covered by the European Commission's standard contractual clauses.

5. How long we keep it

Order and invoice data is kept for seven years to satisfy Swedish accounting law. Account data is kept while your account is open and for twelve months after you close it. Support correspondence is kept for two years. Marketing consent is kept until you withdraw it.

6. Cookies

We use cookies that are strictly necessary for the basket, checkout and login to work, and, with your consent, cookies that measure how the site is used and that attribute affiliate referrals. You can accept or decline the non-essential ones in the cookie banner and change your mind at any time; you can also block cookies in your browser, though the shop may then not work correctly.

7. Your rights

Under the GDPR you may request access to your data, correction of it, erasure, restriction of processing, a portable copy, and you may object to processing based on legitimate interest. Where processing rests on consent you may withdraw it at any time. Write to pepnordic@proton.me and we will answer within one month.

If you believe we handle your data incorrectly you may complain to the Swedish Authority for Privacy Protection (IMY), Box 8114, 104 20 Stockholm, imy@imy.se.

8. Security and changes

The site runs over TLS, access to order data is limited to the people who need it, and passwords are stored hashed. We review this policy regularly; material changes are announced on this page. Last updated [date].