Privacy policy

The data controller is Waypoint Labs Ltd (registered in England and Wales, company number 17418752), trading as Terminus Peptides, the operator of this website. The route for anything on this page — questions, objections, or exercising a right — is the contact page. This policy is maintained by the site owner and will be professionally reviewed as the business grows; it is written to be accurate now, not aspirational.

What this site collects

This site does not use advertising or tracking cookies, and sets no cookies of its own. Page views are counted with the hosting provider’s cookieless analytics, described below.

• Aggregate page-view analytics (Vercel Web Analytics): the page visited, the referring page, approximate location derived from the request, and the device, operating system and browser type. No cookie or identifier is stored on the device; the provider tells visits apart with a hash of the incoming request that it discards within 24 hours. What this site sees is aggregate counts, never an individual’s browsing history.
• WhatsApp enquiries: the button in the corner of the site is a plain link that opens a conversation in the reader’s own WhatsApp app. Nothing from WhatsApp loads on this site and no message passes through it — what a reader chooses to send is processed by WhatsApp (Meta) under WhatsApp’s own terms, and reaches this business in its WhatsApp Business app, where conversations are kept only as long as the enquiry needs.
• Enquiry form submissions: the name, email address, category and message a reader chooses to send. The form does not ask for health information and readers are asked not to provide it.
• Mailing list sign-ups: the email address, the date of sign-up, the date of confirmation, and the exact consent wording shown at the time. Unsubscribes are recorded and suppressed rather than deleted, so that a later import cannot silently re-add someone who opted out.
• Trade account applications: full name, work email address, telephone number, organisation, role, country, website, company or VAT number, a written statement of intended use, and the exact declaration wording shown at the time of applying. Applications also record whether and when the email address was verified, and the outcome of the manual review.
• Server logs held by the hosting provider, Vercel, which may include IP address and request metadata. They exist for security and reliability, are kept for a short operational period, and are not used to profile anyone.

Lawful basis

Enquiries are processed on the basis of legitimate interests in responding to correspondence. Mailing list processing relies on consent, which is why sign-ups are not mailable until confirmed. Trade account applications are processed on the basis of legitimate interests in verifying who is being supplied, and, once an account is open, for the performance of a contract.

Retention

Enquiry correspondence is kept for up to two years from the last exchange, then deleted. Trade account records are kept for as long as the account is open and for six years afterwards, both to meet the record-keeping periods that apply to business records and so that a rejected application is not re-reviewed from scratch. Refused applications are retained rather than deleted for the same reason, and applicants are told so at the point of applying.

Your rights

Under UK data protection law readers have rights of access, rectification, erasure, restriction, objection and portability, and may complain to the Information Commissioner’s Office. The route for exercising those rights with Terminus Peptides is the contact page.