Privacy Policy

The controller within the meaning of Art. 4(7) GDPR (Datenschutz-Grundverordnung) is:

KILUK Peptides, [ENTER BUSINESS ADDRESS]. Email: kontakt@kiluk-peptides.com. Telephone: [ENTER TELEPHONE NUMBER]. VAT identification number: [ENTER VAT ID No.].

We have not appointed a data protection officer, because the statutory requirements of § 38 BDSG (Federal Data Protection Act, Bundesdatenschutzgesetz) are not met. For all data protection questions, please contact the address given above directly.

Personal data is any information relating to an identified or identifiable natural person — for example name, postal address, email address or IP address.

We collect only data that is necessary for the respective purpose, and we do not use it for other purposes without informing you. We do not sell data, we do not trade in addresses, and we do not use third-party advertising or tracking services. Data is disclosed only to the recipients named in this policy, and only to the extent that a legal basis covers it.

When you place an order, we collect the details marked as required in the order form:

In addition, we store the content of the order (item, variant, quantity, prices, discount, shipping costs, total amount), the payment method chosen, the order number assigned, the time of the order and the processing status. The order process includes a confirmation that you have reached the age of 18 and that you are obtaining the products exclusively for use in laboratory, educational and research settings; we store this confirmation as part of the order record.

The legal basis is Art. 6(1)(b) GDPR — the processing is necessary for the performance of the purchase contract and for taking steps prior to entering into a contract. Where we subsequently retain the same data in our accounting records, this is based on Art. 6(1)(c) GDPR in conjunction with the retention obligations under commercial and tax law (section 13).

Without these details we can neither conclude nor perform the contract. Providing them is not required by law, but it is required under the contract.

This shop does not maintain customer accounts. You do not create a password, we do not store any login credentials, and we do not build profiles across several orders.

You can retrieve the status of an order via a status page. Access is possible only with the order number in combination with a randomly generated access key that you receive with the order confirmation. The order number alone does not open the page. Treat the link as confidential — anyone who has it can see the order data.

The legal basis for providing the status page is Art. 6(1)(b) GDPR.

Payment is made in advance by SEPA bank transfer. In doing so, we do not collect any bank details from you via the website: there is no field for an IBAN, account number or credit card details, and we do not request such details by email either. You transfer the amount yourself through your bank; the order number serves as the payment reference. The payment period is 7 calendar days from the order; if no payment has been received by then, the order is cancelled.

When the payment is received, our credit institution provides us with the data that a bank transfer carries with it: name of the account holder, IBAN, amount, booking date and payment reference. We use these details exclusively in order to match the payment to the order, and for our accounting. The legal basis is Art. 6(1)(b) GDPR and, for the accounting record, Art. 6(1)(c) GDPR.

Incoming payments run through our business account with a credit institution established in the European Union; we state the bank details in the order confirmation. The credit institution processes the payment data as a controller in its own right under the rules applicable to payment services; there is no processing relationship with us in this respect.

Payment in cryptocurrencies is not currently enabled. As soon as we offer it, we will add the data then processed and the service provider involved to this policy.

For delivery, we pass on your name, delivery address and — where provided — telephone number and email address to the parcel service provider commissioned with the shipment. The shipping notification states which company transports your consignment. The transfer is necessary for the performance of the contract; the legal basis is Art. 6(1)(b) GDPR. We ship only to Germany and to EU countries; delivery data therefore does not reach third countries. Shipping is in neutral packaging; the service provider receives no information about the contents of the consignment beyond the data required for transport.

Other recipients may be:

Beyond this, we disclose personal data only if you have consented or if we are legally obliged to do so.

This website is operated with Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel provides the infrastructure, delivers the pages and, in doing so, processes all data that arises when the website is accessed and when an order is submitted.

A data processing agreement under Art. 28 GDPR is in place with Vercel. Vercel processes the data exclusively on our instructions and not for its own purposes. The website is delivered from a region within the European Union. On transfers to third countries, see section 12.

Order records are stored in a key-value store that we obtain as a managed service through our hosting provider. This provider is likewise a processor under Art. 28 GDPR.

The legal basis for using a hosting provider is Art. 6(1)(f) GDPR. Our legitimate interest lies in a secure, available and economically operable online offering; where the processing serves the performance of the contract, Art. 6(1)(b) GDPR applies in addition.

Each time the website is accessed, technical access data that your browser transmits automatically is recorded in log files:

This data is not combined with other data sources and does not serve to identify you as a person. We use it exclusively in order to ensure technical operation, to find errors and to fend off attacks.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the stable and secure operation of the website. The log files are deleted or shortened after 30 days at the latest, unless they are exceptionally required for longer in order to investigate a specific security-relevant incident.

We do not use cookies for analytics, marketing or reach measurement, and we do not embed advertising networks, social media plugins or external analytics services. This is why no consent banner appears on this site.

For the shopping cart, the content of your selection is stored in your browser's local storage so that it is retained when you move between pages and when you return. This data remains on your device and is transmitted to us only when you submit an order. It contains item, variant and quantity — no name or address data.

In addition, technically necessary cookies may be used that serve solely the security of the order process, for example to fend off abusive form submissions. They do not evaluate your behaviour and do not serve to recognise you across pages or sessions.

Storing information on your device and reading it from there is strictly necessary for the service you have requested and is therefore permitted without consent under § 25(2) no. 2 TDDDG (Telecommunications Digital Services Data Protection Act, Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz). The data protection legal basis for the subsequent processing is Art. 6(1)(b) and (f) GDPR. You can delete local storage at any time via your browser settings; the shopping cart will then be empty.

For an order we send automated emails: confirmation of receipt together with the payment information, confirmation that the payment has been received, and the shipping notification. For the technical dispatch of these messages we use the Resend service, operated by Resend, Inc., based in the United States. In doing so, Resend processes your email address and the content of the message as a processor under Art. 28 GDPR. The legal basis is Art. 6(1)(b) GDPR. On transfers to third countries, see section 12.

We do not send a newsletter. You will receive promotional emails from us only if you have expressly agreed to this; you can withdraw such consent at any time with effect for the future.

If you write to us at kontakt@kiluk-peptides.com, we process your address and the content of the message in order to answer the enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry concerns a contract or the initiation of one, otherwise Art. 6(1)(f) GDPR with our legitimate interest in answering enquiries. We operate our email mailbox through a provider acting for us as a processor under Art. 28 GDPR. We delete enquiries as soon as they have been conclusively dealt with and no retention obligation applies, at the latest after twelve months.

The website is delivered exclusively over a TLS-encrypted connection (HTTPS). Data that you enter in the order form is thereby transmitted in encrypted form in transit. You can recognise this by the padlock symbol in your browser's address bar.

Access to order data is limited to the controller and to the processors necessary for handling the order, and is secured by access protection. Beyond this, we take technical and organisational measures under Art. 32 GDPR in order to protect your data against loss, alteration and unauthorised access. We cannot guarantee complete protection during data transmission over the internet; unencrypted email in particular is not a secure channel for confidential information.

Some of the service providers used are based in the United States or also process data outside the European Union and the European Economic Area — in particular Vercel (section 7) and Resend (section 10).

A transfer takes place only where the requirements of Art. 44 et seq. GDPR are met. We base it on the standard contractual clauses of the EU Commission under Art. 46(2)(c) GDPR together with supplementary protective measures and, where the respective provider is certified under the EU-US Data Privacy Framework, on the adequacy decision of the EU Commission under Art. 45 GDPR.

Despite these safeguards, it cannot be ruled out that authorities in third countries may access data on the basis of the laws applicable there, and that enforcing data subject rights is more difficult there than within the EU. We will provide you with a copy of the agreed safeguards on request.

We store personal data only for as long as it is necessary for the respective purpose or for as long as statutory retention obligations exist.

Once the periods have expired, the data is deleted. During the ongoing retention period, processing is limited to fulfilling the retention obligation; the data is no longer used for other purposes.

You have the following rights vis-à-vis us:

An informal message to kontakt@kiluk-peptides.com or to the address given in section 1 is sufficient in order to exercise them. We respond without undue delay, at the latest within one month of receipt. In order to avoid disclosing information to unauthorised persons, we may request additional details that are necessary to confirm your identity — for example the order number.

A specific note on the right to object (Widerspruchsrecht): where we process data on the basis of Art. 6(1)(f) GDPR, you can object to the processing on grounds relating to your particular situation. We will then no longer process the data, unless we demonstrate compelling legitimate grounds which override your interests, or the processing serves to establish, exercise or defend legal claims.

Irrespective of other remedies, you have the right under Art. 77 GDPR to lodge a complaint with a data protection supervisory authority if you consider that the processing of your data infringes the GDPR. The competent authority is the one of your habitual residence, your place of work or the place of the alleged infringement.

The authority competent for us as controller is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (the Hessian Commissioner for Data Protection and Freedom of Information), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, PO Box 3163, 65021 Wiesbaden. Contact details and a complaint form are available on the authority's website at datenschutz.hessen.de.

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR. Orders are not accepted or rejected by an automated assessment procedure, and no credit check by credit agencies takes place. We do not evaluate your behaviour on the website in order to build interest or purchase profiles.

We adapt this policy when the legal situation, our service providers or the functions of the shop change — for example when a further payment method is enabled. The version published on this page applies in each case. For order processes already completed, the version valid at the time of the order remains authoritative.

We will provide you with earlier versions on request.