Privacy Policy

Last updated: 23 September 2026

1. Who we are

ExtolX Limited (company number 17314659) is the controller of the personal information described in this notice. Our registered office is 44 Hillcrest Avenue, Ingol, Preston, England, PR2 3UP.

2. Information we collect

Depending on how you interact with us, we may collect:

identity and contact details, including name, organisation, billing and delivery addresses, email address and telephone number;
account and eligibility information, including confirmation that you are at least 18 and information used to assess whether an order is appropriate;
order, payment and transaction information (we do not normally receive complete payment-card or bank-login credentials from payment providers);
communications, complaints, returns and product-safety reports;
technical and usage information, including IP address, device, browser, cookie and advertising identifiers, referral source, website activity, product interactions and conversion events;
address-search information entered into the checkout address-autocomplete feature;
marketing preferences; and
information required to prevent fraud, protect safety or comply with law;
review and feedback information, including ratings, review text, display name, order or product verification, invitation and delivery status, opt-out or suppression status, moderation decisions, reports and our public replies; and
affiliate and referral information, where an affiliate programme is active, including affiliate identity and contact details, referral identifiers, landing and referrer URLs, attributed orders, commissions, payout and tax or accounting records.

Please do not send us health information or information about intended human use. Our products are supplied only for legitimate laboratory research and are not for human or veterinary use.

3. Why we use information and our lawful bases

We use personal information:

to create accounts, process orders, take payment, deliver products and provide customer service, because this is necessary to perform a contract or take requested pre-contract steps;
to verify eligibility, prevent misuse and fraud, maintain security, keep appropriate transaction and product-traceability records, and establish or defend legal claims, based on our legitimate interests and legal obligations;
to handle safety reports, recalls and regulatory enquiries, to comply with legal obligations and protect legitimate interests;
to maintain tax, accounting and corporate records, to comply with legal obligations;
to send requested service messages and, where permitted, marketing communications, based on consent or legitimate interests as applicable;
to send a proportionate, neutral invitation asking for honest feedback about a completed order; verify, moderate, publish and respond to genuine reviews; prevent fake, concealed-incentivised or misleading review information; and maintain a minimal suppression record when someone objects or opts out. We rely on our legitimate interests in improving our service, helping customers make informed decisions and protecting the integrity of published reviews. We do not attach a reward or promotional offer to a review request, and you may object or opt out at any time; and
to measure website use, product interactions, advertising performance and conversions through Google Analytics and Google Ads. We rely on consent for non-essential cookies and similar storage. Where Google consent mode sends limited cookieless measurement signals before consent, we rely on our legitimate interests in obtaining aggregated service and campaign measurements, subject to appropriate minimisation and your rights.

Where we rely on legitimate interests, we consider the necessity of the processing and its impact on individuals. You may object as explained below.

4. Sources

We obtain information from you, your organisation, website technology, payment and delivery providers, fraud-prevention services and publicly available business sources where appropriate.

5. Sharing information

We may share information with:

Hostinger, which provides our website and email hosting, website backups and associated infrastructure and security services. Customer accounts, WooCommerce orders, SureForms submissions and business email may be stored or processed on Hostinger systems. Hostinger's privacy information is available at https://www.hostinger.com/uk/legal/privacy-policy;
Wallid, which provides our Pay-by-Bank checkout and payment service. When you choose Wallid, it and participating banking or open-banking providers may receive identity, contact, order, account and transaction information needed to initiate, authenticate, reconcile or refund the payment, prevent fraud and comply with law. Wallid's privacy information is available at https://wallid.co/privacy-policy;
Starling Bank, which provides our business bank account and receives payer, payee, account, reference and transaction information when a payment or refund is made by manual bank transfer. Starling's privacy information is available at https://www.starlingbank.com/legal/privacy-notice/;
Royal Mail, which receives recipient name, delivery address, contact details where needed, parcel and tracking information in order to deliver, return and trace orders and handle delivery claims. Royal Mail's privacy information is available at https://www.royalmail.com/privacy-notice;
Cloudflare, which provides Turnstile protection on our forms and processes technical, device and interaction information to distinguish legitimate visitors from automated or abusive traffic. Cloudflare's privacy information is available at https://www.cloudflare.com/privacypolicy/;
Google, which provides Google Analytics, Google Ads conversion measurement, Google for WooCommerce and Google Places address autocomplete. Depending on your choices and use of the site, Google may receive IP address, device and browser information, cookie or advertising identifiers, page and product interactions, referral and ad-click information, conversion events, and address-search text entered into autocomplete. Google tags operate using consent mode and non-essential storage should remain denied until you consent. Google's privacy information is available at https://policies.google.com/privacy?gl=uk&hl=en-GB;
WhatsApp and Meta companies, when you choose to contact us through WhatsApp. WhatsApp processes your telephone number, account and device information, communications metadata and other information under its own terms and privacy policy. Messages are end-to-end encrypted in transit, but information you send is also received and retained by ExtolX as correspondence. WhatsApp's UK privacy information is available at https://www.whatsapp.com/legal/privacy-policy-uk;
Brainstorm Force US LLC, the provider of the SureForms software, if information is sent to it through an enabled cloud feature, diagnostic or support request. Ordinary form submissions are intended to be stored on our Hostinger-hosted WordPress website and delivered to our Hostinger-hosted email account. SureForms' privacy information is available at https://sureforms.com/privacy-policy/;
WPManageNinja/FluentSMTP, which provides the software used to route and log transactional website email. Email metadata and content are processed through our configured Hostinger SMTP service, and local email logs are retained on our hosted website for 14 days. The plugin is currently configured to share limited non-sensitive diagnostic or usage information with its provider. FluentSMTP's privacy information is available at https://fluentsmtp.com/privacy-policy/;
Customer Reviews for WooCommerce (CusRev), used in self-hosted mode for completed orders not routed to PeptideReview. The invitation is generated by our WordPress site, sent through our configured Hostinger email service, and the review form and reminder record are handled on our Hostinger-hosted website. Customer order data is not sent to CusRev.com for ordinary self-hosted reminders. The plugin developer may receive limited licence, update, diagnostic or support information if an optional feature or support request is used;
PeptideReview.co.uk, a third-party review platform used for completed orders recorded by WooCommerce as PeptideSupermarket referrals. We send the customer's name, billing email address, ExtolX order reference and a limited referral-source flag so that PeptideReview can send and manage a neutral review invitation, suppress duplicates and opt-outs, and verify any resulting review. We do not send the delivery address, product lines or order value in the current configuration. The first invitation is normally sent five days after completion and may be followed, if no review or opt-out has been recorded, by reminders three and ten days later. PeptideReview must not use invitation data for unrelated marketing or make it available to PeptideSupermarket unless a separate lawful and transparent basis applies. PeptideReview's privacy information is available at https://peptidereview.co.uk/privacy;
insurers, testing laboratories, legal advisers and other professional advisers where their services require the information;
regulators, law-enforcement bodies, courts and public authorities where required or appropriate; and
a buyer, investor or adviser involved in a proposed sale or reorganisation of our business.

WordPress, WooCommerce, CartFlows and related checkout, cart, pricing and shipping extensions are software used to operate our hosted website and shop. Order and interaction information used by these tools is primarily stored on our Hostinger-hosted website. Their developers may receive limited diagnostic, licence, update or support information where an optional service, telemetry or support feature is enabled.

CookieYes provides the consent banner and preference controls used on our website. We currently use its free native WordPress mode without connecting the website to a CookieYes cloud account. Consent preferences are stored in the visitor's browser rather than in CookieYes cloud consent logs. If we connect the cloud service later, we will update this notice before or when that processing begins, as required.

We do not currently use an external warehouse, fulfilment provider, label-printing provider or accountant. Our overseas product supplier does not receive customer information. If this changes, we will update this notice before or when the new processing begins, as required.

We do not sell personal information.

6. International transfers

Some suppliers may process information outside the UK. Before using such suppliers, we will put an appropriate UK transfer mechanism in place where required and assess relevant protections. Contact us for information about safeguards applying to a particular transfer.

7. Retention

We keep personal information only for as long as reasonably necessary for the purposes described in this notice. Our standard periods are:

order, invoice, payment, tax and accounting records: normally six years after the end of the relevant company financial year;
active customer account information: while the account remains active and normally for two years after the customer's last activity;
routine customer-service correspondence: normally two years after the matter is resolved;
returns, refunds, contractual complaints, chargebacks and associated fraud records: normally six years after the matter is resolved;
product batch, supplier and traceability records: normally ten years after the final sale of the relevant batch, where retaining identifiable customer information remains necessary for product-safety, recall, legal or regulatory purposes;
product-safety incidents, recalls and serious product complaints: normally ten years after the matter is closed, or longer where required by a regulator, an investigation or applicable law;
completed customer eligibility records: while the account remains active and normally for two years afterwards;
rejected eligibility applications: normally 12 months after the decision;
incomplete shopping-basket information: normally between 30 and 90 days;
general website and security logs: normally 90 days, unless they are required for a security investigation, fraud prevention or legal claim;
contact-form enquiries that do not result in a customer relationship: normally 12 months after the last contact;
transactional email logs stored by our website: 14 days;
marketing-consent evidence: while we send marketing and normally for six years afterwards where needed to demonstrate compliance;
marketing suppression records: for as long as needed to ensure that we continue to respect an objection or opt-out, using only the minimum information required;
cookie-consent preferences stored in the visitor's browser: 180 days from the most recent choice. We do not currently maintain CookieYes cloud consent logs;
age and research-use confirmation stored in the visitor's browser: for the current tab session, or up to 30 days when “Remember my choice” is selected. The stored value contains only a confirmation flag, statement revision and expiry time; it does not contain a date of birth or identity document;
analytics information: according to the settings described in our Cookie Policy and normally no longer than 26 months;
review-invitation route, status and delivery or error metadata stored with a WooCommerce order: normally for the same six-year order-record period, unless we implement an earlier deletion schedule;
locally submitted review content: for as long as the review remains published or is needed to handle a complaint, with verification and moderation evidence reviewed and minimised after two years;
review opt-out or suppression information: for as long as needed to respect the objection, using the minimum information required; and
affiliate commission, payout, fraud, tax and accounting records, once an affiliate programme launches: normally six years after the end of the relevant company financial year. Unsuccessful affiliate applications are normally retained for 12 months after the decision unless needed for a complaint or fraud prevention.

The applicable period may be longer where information is needed for an active complaint, legal claim, safety incident, recall, regulatory investigation or other legal obligation. When identifiable information is no longer required, we delete or anonymise it. We periodically review retained information and may apply a shorter period where it is no longer necessary.

8. Your rights

Subject to applicable conditions, you may ask us to access, correct, erase or restrict your information, receive portable information, or object to processing. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. You may also object at any time to direct marketing.

Contact info@extolx.co.uk to exercise a right. We may need to verify your identity.

You may complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/. We would appreciate the opportunity to address your concern first.

9. Reviews and public content

Reviews submitted to ExtolX or PeptideReview may be published with the reviewer's chosen display name, rating, review date and review text. We may publish an ExtolX response. Product reviews and aggregate ratings published on our site may also appear in search-engine structured data. We moderate in accordance with our Review Policy. We do not remove a genuine review merely because it is negative, but we may reject, redact or remove content that is fake, incentivised, unlawful, abusive, misleading, contains personal data, or describes prohibited human or veterinary use, dosing or health outcomes. We do not rewrite a review in a way that changes its meaning.

10. Marketing

We will follow UK rules applicable to the recipient and communication method. Marketing emails will identify us and provide an unsubscribe method. Service messages necessary for an order are not marketing, although we will not add promotional content in order to bypass marketing rules.

11. Security and automated decisions

We use proportionate organisational and technical measures to protect information. No internet service is completely secure.

We do not currently make decisions producing legal or similarly significant effects based solely on automated processing.

12. Changes

We may update this notice when our services, suppliers or legal obligations change. The current version will appear on our website with its update date.