Skip to content

RGPD

Privacy Policy

PeptidLab (hereinafter “we”) attaches great importance to the protection of your privacy. This policy informs you of the way in which your personal data is collected, used and protected, in accordance with the General Data Protection Regulation (GDPR) and the Data Protection Act.

1. Data controller

AM SERVICES, which operates PeptidLab, reachable at contact@peptidlab.li.

2. Data collected

  • Identity: name, first name, company name (laboratory)
  • Contact: email (phone optional)
  • Delivery: postal address
  • Order: purchase history, payment method
  • Technical: pages viewed, device type and cookie identifiers, only if you accept them (see article 8)

3. Purposes of processing

  • Process and ship your order
  • Contact you about your order or request
  • Manage your customer account
  • Publish your opinion on a product, if you submit one (only your first name is displayed)
  • Measure site audience and the effectiveness of our ads, with your consent
  • Comply with our legal and accounting obligations

4. Legal bases

  • Execution of the contract for the data necessary for your order
  • Consent for messages sent via the contact form and reviews, as well as for audience-measurement and advertising cookies
  • Legal obligation for the conservation of invoices (10 years)
  • Legitimate interest for improving the service

5. Shelf life

  • Order data: 10 years (accounting obligation)
  • Inactive customer account: 3 years after last connection
  • Contact messages: 3 years after the last exchange

6. Data recipients

  • Our carrier (for delivery)
  • Our payment provider (Stripe)
  • Our host, HostMeNow LTD (United Kingdom), for the website and the order server
  • Google (Analytics, Ads), Meta and TikTok, only if you accept the corresponding cookies (see article 8)
  • Public authorities in the event of a legal obligation

Your data is not never sold. Apart from the tools listed above and your consent, they are not passed on to third parties.

7. Your rights

In accordance with the GDPR, you have the following rights:

  • Right of access to your data
  • Right of rectification in case of inaccurate data
  • Right to erasure (right to be forgotten)
  • Right to portability
  • Right to object to treatment
  • Right to limitation of treatment
  • Right to withdraw your consent at any time

To exercise these rights, contact us at contact@peptidlab.li. We respond within a maximum of 30 days. You can also lodge a complaint with the CNIL.

8. Cookies and local storage

On your first visit, a banner asks for your consent. No audience-measurement or advertising cookie is set until you accept. "Reject all" is as easy as "Accept all", and your choice is kept for 6 months. You can change it at any time with the link Manage cookies, at the bottom of every page; withdrawing your consent deletes the cookies concerned.

  • Necessary (always active) : the session cookie, to log in to your account; the browser's local storage, for your cart, any promo code, the chosen language and your cookie choice.
  • Audience measurement (with your consent) : Google Analytics, via Google Tag Manager — pages viewed, journeys and visit statistics.
  • Visit origin (with your consent) : cookie pl_src set by PeptidLab, kept for 30 days. It records where you came from (search engine, ad campaign, referring site, first page viewed) so we know which channels lead to orders. It contains no advertising identifier, is read only by our server at checkout and is not passed on to any third party.
  • Visit origin, without your consent : nothing is stored on your device. When you move from one page of the site to another, the origin of your arrival (Google ad, campaign, referring site, first page viewed) is added to the address of the next page (parameter pl_o). It is only valid for the current visit, contains no identifier and is only recorded with your order, if you place one, so we know which channels lead to sales. Legal basis: our legitimate interest in measuring the effectiveness of our acquisition channels, without tracking from one visit to the next.
  • Advertising (with your consent) : Google Ads, Meta (Facebook, Instagram) and TikTok — campaign measurement and personalised ads. When you place an order, your e-mail and phone number may be passed to them as an encrypted fingerprint (SHA-256 hash), never in plain text.

Without your consent, Google tools run in "consent denied" mode: no cookie is set or read. To measure ad conversions without cookies, Google may copy the ad click identifier (gclid) and a temporary measurement identifier (parameter _gl) into the address of the following pages of the site, without storing anything on your device. TikTok and Meta are not loaded. These companies may process data outside the European Union, under the safeguards provided by the GDPR (standard contractual clauses, Data Privacy Framework).

9. Security

We implement the necessary technical and organizational measures to ensure the security of your data: SSL/TLS encryption, restricted access, regular backups. Banking data is processed exclusively by Stripe.

10. Changes

This policy may be modified at any time. The date of the current version is shown below.

Version in force on 24 October 2026.