Privacy Policy

HelixCore Peptides (“we”, “us”, “our”) is the data controller for personal data collected through helixcore.co.uk. We take your privacy seriously and are committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Contact: privacy@helixcore.co.uk

Account data: name, email address, password (hashed — we never store plaintext passwords).

Order data: shipping address, phone number, order history, payment method (not card details).

Technical data: IP address, browser type, pages visited, timestamps (collected via server logs and cookies).

Communications: any messages you send us via email.

We do not collect special category data (health, genetic, biometric data) and do not use automated profiling or decision-making.

We retain your personal data for as long as necessary to fulfil the purposes above:

• Account data: for the life of your account, plus 2 years after closure
• Order data: 7 years (legal/accounting obligation)
• Server logs: 90 days rolling
• Marketing consent records: until you withdraw consent

We share your data only where necessary:

• Royal Mail — shipping name and address to fulfil delivery
• Payment processor — bank reconciliation details when payment is made by bank transfer or approved pay-by-bank method
• Email service provider — to send transactional emails
• Law enforcement — where required by law

We do not sell your personal data to third parties. We do not use third-party advertising trackers.

We use strictly necessary cookies for session management, your shopping cart, and a persistent age-gate confirmation stored in your browser's local storage. These are always on and don't require consent.

With your consent, given via the cookie banner on your first visit, we also use:

• Google Analytics (analytics) — to understand which products and pages researchers find most useful.
• Chatwoot (functional) — our support-chat widget, which sets its own cookies to keep a conversation alive across page loads.

Neither loads until you accept. If you reject, only strictly necessary cookies are set. You can change your choice at any time via the “Cookie preferences” link in the footer. See our Cookie Policy for the full cookie list and durations.

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your data (subject to legal retention obligations)
• Restriction — request we restrict processing in certain circumstances
• Portability — receive your data in a structured, machine-readable format
• Object — object to processing based on legitimate interests or for direct marketing
• Withdraw consent — where processing is based on consent, you may withdraw at any time

To exercise any right, email privacy@helixcore.co.uk. We will respond within 30 days. If you are unsatisfied, you may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We implement appropriate technical and organisational measures to protect your data, including TLS encryption in transit, bcrypt-hashed passwords, JWT-based authentication with short-lived access tokens, and server-side rate limiting. Access to production systems is restricted to authorised personnel only.

We process all data within the UK and EEA. We do not transfer personal data to countries outside these areas without appropriate safeguards.

We may update this policy from time to time. Material changes will be notified by email to registered customers. The date at the top reflects the latest revision.

HelixCore Ltd. Registered in England & Wales. Company number 17247085.