Privacy Policy
Version 1.1 · September 14, 2026 · Regulation (EU) 2016/679 (GDPR)1. Who is responsible for your data
TODO S.R.L., TODO Street, no., Bucharest, Romania, CUI TODO, TODO J40/0000/2026, is the data controller.
For any question about your personal data, contact gdpr@peptovitalis.com.
2. What data we collect
| Category | Data | When |
|---|---|---|
| Identity | first and last name | at checkout |
| Contact | phone number, email address (optional) | at checkout |
| Shipping | full address, city or town, county, postal code (optional), delivery notes for the courier | at checkout |
| Order | products, quantities, order total, batch shipped, AWB (tracking) number, delivery status; the IP address and browser used to place the order; the date and time of your eligibility declaration | when you place your order and while we process it |
| Eligibility declaration | confirmation of your age and research purpose, with a timestamp | when you enter the website and at checkout |
| Technical | IP address, browser type and operating system, pages viewed, traffic source (referrer, UTM parameters), a random session ID (pv.sid), store events (add to cart, checkout started, order placed), country derived from your IP address | automatically, while you browse |
We do not collect health data, and we never ask you for it.
3. Why we use your data and on what legal basis
| Purpose | Legal basis | Retention |
|---|---|---|
| Processing and shipping your order, phone confirmation, shipping notification | performance of a contract — art. 6(1)(b) | for the duration of the contract |
| Invoicing and accounting records | legal obligation — art. 6(1)(c) | 10 years |
| Proof of your eligibility declaration | legitimate interests — art. 6(1)(f) | 3 years from your last order |
| Website security, fraud prevention, and traffic statistics (technical data) | legitimate interests — art. 6(1)(f) | 180 days |
| Linking an order to the visit it came from (IP address, traffic source) to prevent cash-on-delivery fraud | legitimate interests — art. 6(1)(f) | for as long as the order is kept, plus 3 years; the IP address is truncated after 12 months |
| Handling complaints | legal obligation / legitimate interests | 3 years |
| Marketing communications | consent — art. 6(1)(a) | until you withdraw consent |
Our legitimate interest in keeping your eligibility declaration is being able to show that we sold only to an adult who confirmed the products were for research. Our legitimate interest in technical data is protecting the website from abuse, spotting fraudulent cash-on-delivery orders (repeatedly refused packages, automated orders), and understanding where our traffic comes from. We do not make automated decisions that have legal effects on you: if our system flags an order as suspicious, a member of our team checks it by phone.
4. If you choose not to provide data
We need your name, phone number, and shipping address to fulfill the contract; without them, we cannot process your order. Your email address, postal code, and delivery notes are optional, and so is all other processing.
5. Who we share your data with
- FAN Courier — to deliver your package and collect cash-on-delivery payment: name, phone number, address, and amount due.
- Resend, Inc. (USA) — the service we use to send your order confirmation and shipping notification emails, if you give us an email address. Resend receives only your name, email address, and the message content (order number, products, total, AWB tracking number), and keeps it for 30 days. It acts as our processor under a data processing agreement (art. 28), the Standard Contractual Clauses, and the EU-U.S. Data Privacy Framework.
- Our hosting provider for the website and ordering system — servers located in the European Union. It has technical access to the data but does not use it for its own purposes. (TODO: add provider name.)
- Our accountant — invoicing data. (TODO: add firm name.)
- Public authorities — only in response to a request with a valid legal basis.
To determine your country from your IP address, we use the DB-IP database (db-ip.com, licensed under CC BY 4.0), installed on our own server, so your IP address never leaves the server for this lookup.
We do not sell or rent personal data.
6. Transfers outside the EU
The only transfer outside the European Economic Area is to Resend, Inc. (USA), for order confirmation and shipping emails. It is covered by the European Commission’s Standard Contractual Clauses and by certification under the EU-U.S. Data Privacy Framework. If you don’t give us an email address, no transfer takes place. All other data stays in the EU.
7. Your rights
Under the GDPR, you have the right to:
- access — find out what data we hold about you;
- rectification — have inaccurate data corrected;
- erasure — subject to our legal record-keeping obligations;
- restriction of processing;
- data portability — receive your data in a structured format;
- object — to processing based on legitimate interests, including traffic measurement;
- withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Send requests to gdpr@peptovitalis.com. We respond within 30 days at the latest. You can also contact the Romanian data protection authority, ANSPDCP (National Supervisory Authority for Personal Data Processing), B-dul G-ral. Gheorghe Magheru 28-30, Bucharest, dataprotection.ro.
8. How we protect your data
We use encrypted connections (HTTPS) and make regular encrypted backups. Orders are stored in our own system, which only authorized staff can access, with two-factor authentication and access logging. Your eligibility declaration is stored locally in your browser and sent to us only with your order. Along with the order, we also record the IP address and browser it was placed from, and the date and time of the declaration.
9. Order emails
If you give us an email address, we send you an order confirmation and a shipping notification with your AWB tracking number. These are transactional messages (art. 6(1)(b)), not marketing: they contain no open or click tracking and do not sign you up for anything. We do not send a newsletter.
10. Minors
This website is not intended for anyone under 18, and we do not knowingly collect data from minors. If you become aware that a minor has given us personal data, email us at gdpr@peptovitalis.com and we will delete it.