Privacy Policy

Effective Date: June 20, 2026

Last Updated: June 20, 2026

1. Introduction

Welcome to PepSmarts ("we," "us," "our," or "Company"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy ("Policy") explains how we collect, use, disclose, and protect information about you when you visit our website at www.pepsmarts.com (the "Site"), create an account, make purchases, or interact with our services.

Please read this Privacy Policy carefully before using our Site or providing any personal information.

By accessing or using our Site, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with this Policy, please do not use our Site.

2. Scope of This Policy

2.1 Applicability

This Privacy Policy applies to:

• All visitors to our Site
• All registered users with accounts
• All customers who make purchases
• All individuals who communicate with us
• All users of our mobile applications (if applicable)

2.2 Third-Party Links

Our Site may contain links to third-party websites, services, or applications. This Policy does not apply to third-party sites, and we are not responsible for the privacy practices of third parties. We encourage you to review the privacy policies of any third-party sites you visit.

3. Information We Collect

3.1 Information You Provide Directly

We collect information you voluntarily provide when you:

Account Registration:

• Full name
• Email address
• Password (encrypted)
• Phone number
• Company or institution name
• Job title or position
• Research affiliation

Orders and Purchases:

• Billing address
• Shipping address
• Payment information (processed through third-party payment processors)
• Order history and preferences
• Products purchased

Communications:

• Messages you send us
• Support requests and inquiries
• Feedback and surveys
• Email correspondence

Verification:

• Research institution verification documents
• Business licenses or credentials
• Age verification information

3.2 Information Collected Automatically

When you visit our Site, we automatically collect certain technical information:

Technical Data:

• IP address
• Browser type and version
• Operating system
• Device identifiers
• Referring website or source
• Pages visited and time spent
• Links clicked
• Search queries
• Cookie data (see Section 10)

Usage Information:

• Access times and dates
• Pages viewed
• Features used
• Preferences set
• Error logs

3.3 Information from Third Parties

We may receive information from third parties:

• Credit card processors (transaction confirmation)
• Shipping carriers (delivery status)
• Fraud detection services
• Business partners and affiliates
• Public databases and directories
• Social media platforms (when you interact with our social media)

4. How We Use Your Information

4.1 Primary Purposes

We use your information for the following purposes:

Service Provision:

• Processing and fulfilling orders
• Managing your account
• Providing customer support
• Sending order confirmations and shipping updates
• Processing payments and refunds

Site Operation:

• Operating and maintaining our Site
• Improving user experience
• Analyzing site usage and performance
• Fixing technical issues and errors
• Ensuring site security

Communication:

• Responding to inquiries and support requests
• Sending important notices and updates
• Providing product information (with consent for marketing)
• Conducting surveys and obtaining feedback

4.2 Additional Purposes

Verification and Compliance:

• Verifying your eligibility and research credentials
• Preventing fraud and unauthorized access
• Complying with legal obligations
• Enforcing our Terms of Service and policies

Marketing (with consent):

• Sending promotional emails and newsletters
• Informing about new products and offers
• Personalizing content and recommendations
• Running contests and special promotions

Analytics and Improvement:

• Analyzing trends and usage patterns
• Developing new products and features
• Improving existing services
• Conducting market research

4.3 Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), we process your personal data based on the following legal grounds:

• Contract performance: Processing necessary to fulfill our contract with you
• Legitimate interests: Processing for our legitimate business interests (fraud prevention, security)
• Consent: Where you have given explicit consent
• Legal obligation: Where processing is required by applicable law

5. Information Sharing and Disclosure

5.1 We Do Not Sell Personal Information

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

5.2 Service Providers

We share information with trusted third-party service providers who assist us in operating our business:

• Payment processors: Stripe, PayPal (for payment processing)
• Shipping carriers: UPS, FedEx, USPS (for order delivery)
• Fulfillment partners: Warehousing and shipping services
• Analytics providers: Google Analytics, Hotjar (for site analytics)
• Customer support: Help desk software providers
• Email service providers: For sending emails (with strict data handling requirements)
• Cloud hosting: AWS, Azure (for data storage)

These providers are contractually bound to:

• Use your information only to provide services to us
• Protect your information with appropriate security measures
• Not disclose your information to others

5.3 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets:

• Your information may be transferred as part of the business transaction
• You will be notified via email or prominent notice on our Site
• Your information will continue to be protected under this Policy (or a successor policy)

5.4 Legal Requirements

We may disclose your information when required by law:

• To comply with valid legal process (subpoenas, court orders)
• To respond to lawful government requests
• To enforce our Terms of Service or policies
• To protect our rights, property, or safety
• To prevent or investigate potential illegal activity
• In emergencies involving immediate danger

5.5 Aggregated Data

We may share aggregated, anonymized data that cannot identify you with:

• Analytics and research partners
• Marketing partners
• Industry associations
• Public reporting (with appropriate safeguards)

6. Data Retention

6.1 Retention Periods

We retain your information for the following periods:

6.2 Deletion Requests

When you request account deletion:

• Most personal information is deleted within 30 days
• Some data may be retained for legal compliance (up to 7 years)
• Payment records retained per financial regulations
• We will confirm deletion in writing

6.3 Automatic Deletion

When you do not log in for an extended period:

• Accounts inactive for 5+ years may be deleted
• You will receive notice before deletion (email to last known address)
• Retained data is limited to order history for warranty/compliance

7. Data Security

7.1 Security Measures

We implement industry-standard security measures:

Technical Safeguards:

• SSL/TLS encryption for data transmission
• Encryption at rest for sensitive data
• Firewalls and intrusion detection systems
• Regular security assessments and penetration testing
• Secure data centers with physical security

Administrative Safeguards:

• Access controls and authentication requirements
• Employee training on data protection
• Security policies and procedures
• Regular audits and compliance reviews
• Background checks for employees with data access

Physical Safeguards:

• Secure server facilities
• Access controls and monitoring
• Video surveillance
• Environmental controls

7.2 Password Security

• Passwords are hashed and salted using industry-standard algorithms
• We recommend using strong, unique passwords
• You should never share your password
• We will never ask for your password via unsolicited communication

7.3 Security Limitations

While we strive to protect your information:

• No security system is 100% impenetrable
• We cannot guarantee absolute security
• You transmit information at your own risk
• You are responsible for maintaining your account security

7.4 Data Breach Notification

In the event of a security breach affecting your personal information:

• We will notify you within 72 hours of discovery (as required by applicable law)
• Notification will include nature of breach, data affected, and remediation steps
• We will take immediate steps to contain and remediate the breach
• Law enforcement will be contacted as appropriate

8. Your Rights

8.1 General Rights

Depending on your location, you may have the following rights:

Access Rights:

• Request a copy of your personal information
• Receive information about how we process your data
• Request details on third parties we share data with

Correction Rights:

• Request correction of inaccurate information
• Request completion of incomplete information
• Request erasure of outdated or unnecessary data

Deletion Rights:

• Request deletion of your personal information
• Request erasure of data shared with third parties
• "Right to be forgotten" where applicable

Restriction Rights:

• Request restriction of processing in certain circumstances
• Object to processing based on legitimate interests

Portability Rights:

• Receive your data in a structured, machine-readable format
• Request transfer of data to another controller

Withdraw Consent:

• Withdraw consent for marketing communications at any time
• Withdraw consent where processing was based on consent

8.2 Exercising Your Rights

To exercise any of these rights:

Email: privacy@pepsmarts.com

Mail: PepSmarts Privacy Department, [Address to be provided]

Requirements:

• Provide sufficient information to verify your identity
• Specify which right you wish to exercise
• Provide any details required to process your request

Response Time:

• We will respond within 30 days
• Complex requests may take up to 90 days
• We will notify you if we cannot fulfill your request

8.3 Verification

To protect your information:

• We may require identity verification before processing requests
• We may request additional information to verify your identity
• False identity claims may result in account termination

8.4 Non-Discrimination

We will not discriminate against you for exercising your privacy rights.

9. Cookies and Tracking

9.1 What Are Cookies?

Cookies are small text files stored on your device when you visit websites. They help websites remember your preferences and improve your experience.

9.2 Types of Cookies We Use

Essential Cookies (Required):

• Session management
• Shopping cart functionality
• Account authentication
• Security features
• Cannot be disabled without affecting site functionality

Performance Cookies:

• Analytics (Google Analytics)
• Site performance monitoring
• Error tracking
• Usage patterns

Functionality Cookies:

• Language preferences
• Region settings
• Theme preferences
• Recently viewed items

Marketing Cookies:

• Advertising and retargeting
• Campaign measurement
• Personalized recommendations
• Used only with your consent

9.3 Cookie Management

You can manage cookies through:

• Our Cookie Consent Banner (appears on first visit)
• Browser settings (disable cookies)
• Opt-out links in marketing emails
• Third-party opt-out tools

9.4 Do Not Track

We honor Do Not Track signals in browsers that support this feature. When detected, we:

• Disable analytics cookies
• Disable marketing cookies
• Continue to use essential cookies

10. Children's Privacy

10.1 Age Restriction

Our Site is not intended for individuals under 21 years of age.

We do not knowingly collect personal information from:

• Children under 13 (US)
• Individuals under 16 (EU/EEA)
• Anyone not meeting our eligibility requirements

10.2 Parental Concerns

If you believe your child has provided us with personal information:

• Contact us immediately at privacy@pepsmarts.com
• We will promptly delete such information
• We recommend supervising children's online activities

10.3 Verification

We reserve the right to:

• Verify age before order processing
• Request additional verification for age-related concerns
• Refuse service if eligibility requirements are not met

11. International Data Transfers

11.1 Data Storage

Your information may be stored and processed:

• In the United States (primary location)
• In other countries where our service providers operate

11.2 International Transfers

When transferring data internationally:

• We ensure adequate safeguards are in place
• Standard Contractual Clauses (SCCs) are used for EU transfers
• Compliance with applicable data protection laws
• Adequate level of protection is ensured

11.3 Your Consent

By using our Site and providing information:

• You consent to international transfer of your data
• You acknowledge that data protection laws may vary by country
• We will take steps to ensure adequate protection

12. Marketing Communications

12.1 Consent

We will only send marketing communications if you:

• Opt-in during registration or purchase
• Explicitly consent to receive marketing
• Have not opted out

12.2 Types of Marketing

• Promotional emails and newsletters
• New product announcements
• Special offers and discounts
• Educational content about peptides and research
• Event invitations

12.3 Unsubscribe

To stop receiving marketing communications:

• Click "Unsubscribe" in any marketing email
• Update preferences in your account settings
• Email unsubscribe@pepsmarts.com

Note: Transactional communications (order confirmations, shipping updates) are not marketing and will continue regardless of preferences.

12.4 Opt-Out Processing

• Opt-out requests are processed within 10 business days
• You may still receive emails during processing
• Some data may be retained for compliance

13. California Privacy Rights (CCPA/CPRA)

13.1 California Consumer Rights

If you are a California resident, you have the right to:

Know What Information We Collect:

• Categories of personal information collected
• Sources of personal information
• Purposes for collection
• Third parties with whom information is shared

Know If Information Is Sold:

• We do not sell personal information
• We do not share information for cross-context behavioral advertising

Request Deletion:

• Request deletion of your personal information
• With certain exceptions (legal obligations)

Correct Inaccurate Information:

• Request correction of inaccurate information

Non-Discrimination:

• Not be discriminated against for exercising rights

13.2 Submitting Requests

Toll-free: [To be provided]

Email: privacy@pepsmarts.com with "California Rights Request" in the subject line

Mail: PepSmarts Privacy Department, [Address to be provided]

13.3 Verification

We will verify your identity before processing requests:

• Matching information on file
• Additional verification may be required
• Authorized agent submissions require written authorization

13.4 Response Time

• Acknowledgment within 10 days
• Response within 45 days
• Extension of 45 days if reasonably necessary (with notice)

14. European Privacy Rights (GDPR)

14.1 GDPR Rights

If you are located in the EEA, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing
• Data portability
• Object to processing
• Not be subject to automated decision-making

14.2 Data Protection Officer

For GDPR inquiries:

Email: dpo@pepsmarts.com

14.3 Supervisory Authority

You have the right to lodge a complaint with:

• Your local data protection authority
• The supervisory authority in your country

15. Changes to This Policy

15.1 Policy Updates

We may update this Privacy Policy periodically:

• Changes are effective upon posting
• Material changes will be notified via email
• We will post a prominent notice on our Site
• The "Last Updated" date will be revised

15.2 Notification

For significant changes:

• Email notification to registered users
• Notice on Site homepage
• 30-day notice period for material changes (where possible)

15.3 Your Responsibility

You are responsible for:

• Reviewing the Privacy Policy periodically
• Checking for updates
• Contacting us with questions

16. Contact Information

For privacy-related questions, requests, or concerns:

General Privacy Inquiries

Email: privacy@pepsmarts.com

Response Time: Within 30 days

Data Deletion Requests

Email: delete@pepsmarts.com

Marketing Opt-Out

Email: unsubscribe@pepsmarts.com

Data Protection Officer (EU)

Email: dpo@pepsmarts.com

Mailing Address

PepSmarts Privacy Department [Address to be provided upon request]

17. Policy Acceptance

By using our Site, you acknowledge that you have:

• Read and understood this Privacy Policy
• Agreed to the collection, use, and disclosure practices described herein
• Consented to international transfer of your data (where applicable)
• Agreed to receive communications as described

If you do not agree to this Policy, please do not use our Site or provide personal information.

18. Effective Date and Version

Effective Date: June 20, 2026

Version: 1.0

Previous Versions: Not applicable (initial version)

This Privacy Policy was last updated on June 20, 2026.

© 2026 PepSmarts. All rights reserved.