Privacy Policy

Effective date: 03 Aug 2026
Last updated: 03 Aug 2026

1. Who we are

Crew Labs Ltd (“Crew Labs”, “we”, “us”, “our”) operates the website at crew-labs.co.uk (the “Site”). We supply research-grade peptides to qualified researchers and institutions.

For the purposes of UK data protection law, Crew Labs Ltd is the data controller of the personal data described in this policy.

Company: Crew Labs Ltd, registered in England and Wales
Company number: 14872213
Registered office: CREW LABS Ltd London United Kingdom

This policy explains what personal data we collect, why we collect it, the legal basis on which we rely, who we share it with, how long we keep it, and the rights available to you.

2. Information we collect

2.1 Information you give us

Identity and contact details — name, email address, telephone number, and the name of your institution or organisation where provided.
Delivery and billing addresses — required to fulfil and invoice orders.
Account information — username, password (stored in hashed form; we cannot read it), saved addresses, and order history if you create an account.
Order information — products purchased, quantities, batch references, currency selected, and order value.
Research-use confirmation — a record that you confirmed, at checkout, that your purchase is for laboratory research use only. We store this confirmation and the date and time it was given.
Age confirmation — a record that you confirmed you are 18 or over before accessing the Site. This is stored in your browser for the duration of your session and is not linked to your identity.
Correspondence — the content of enquiries, support requests, returns claims, and any other messages you send us.
Marketing preferences — whether you have subscribed to our newsletter, and any subsequent changes to that preference.

2.2 Payment information

Payments are processed by our payment providers. Card and bank details are entered directly with the payment provider and are never stored on our servers. We receive only a confirmation of the outcome, the amount, the currency, and a transaction reference.

2.3 Information collected automatically

IP address and approximate location derived from it
Browser type and version, operating system, device type, and screen size
Pages viewed, time spent, referring URL, and navigation path
Cookie identifiers and similar technologies (see section 8)

2.4 Special category data

We do not seek, and ask that you do not send us, special category data — information revealing health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, sex life, or sexual orientation.

Our products are supplied for laboratory research only. Enquiries describing personal medical circumstances cannot be answered, and any health information volunteered will be deleted rather than retained.

3. Why we use your information, and our legal basis

Under UK GDPR we must have a lawful basis for each use of your personal data. Ours are set out below.

We rely on performance of a contract to:

Process, fulfil, and deliver your order, using your identity, contact, delivery, and order data
Take payment and issue receipts
Manage your account and order history
Handle returns, refunds, and exchanges

We rely on legitimate interests to:

Respond to enquiries and support requests you send us
Detect and prevent fraud, misuse, and security incidents, using order data and IP address
Maintain records demonstrating that supply was made on a research-use basis

Where we rely on legitimate interests, we have assessed that our interest does not override your rights and freedoms. You may object to processing on this basis at any time (see section 11).

We rely on legal obligation to:

Keep accounting, invoicing, and tax records
Retain research-use confirmations associated with each order
Respond to lawful requests from regulators, law enforcement, and the courts
Handle statutory complaints and consumer rights claims

We rely on your consent to:

Send you our newsletter and other marketing email
Set analytics and other non-essential cookies, and analyse Site usage to improve performance

You may withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.

4. Marketing communications

We send marketing emails only where you have opted in. We do not add customers to our mailing list automatically as a result of placing an order.

Every marketing email contains a one-click unsubscribe link. You may also withdraw consent at any time by contacting us. Withdrawal takes effect promptly and does not affect the lawfulness of anything sent beforehand.

Unsubscribing from marketing does not stop transactional messages — order confirmations, dispatch notices, and delivery updates. These are necessary to perform our contract with you.

5. Who we share your information with

We share personal data only where necessary to run our business. Our recipients fall into the following categories:

Payment providers — to authorise and settle transactions, and to investigate chargebacks.
Delivery and courier partners — name, delivery address, and contact number, so your order can be delivered and tracked. Our products ship under temperature-controlled conditions, which may require the carrier to hold contact details for delivery coordination.
Email service provider — to send transactional and, where you have consented, marketing email.
Hosting and infrastructure providers — who store Site and order data on our behalf under contract.
Analytics providers — where you have accepted analytics cookies.
Professional advisers — accountants, auditors, insurers, and legal advisers, where required and under a duty of confidentiality.
Regulators, law enforcement, and courts — where we are legally required to disclose, or where disclosure is necessary to establish, exercise, or defend legal claims.
A purchaser or successor — if our business is sold or reorganised, subject to the protections in this policy.

We do not sell, rent, or trade your personal data. We do not share it with third parties for their own marketing purposes.

All processors acting on our behalf are bound by written contracts requiring them to act only on our instructions and to keep your data secure.

6. International transfers

Some of our service providers process data outside the United Kingdom.

Where personal data is transferred outside the UK, we ensure one of the following safeguards applies:

the destination country is covered by UK adequacy regulations; or
the transfer is governed by the International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses together with the UK Addendum; or
another lawful transfer mechanism recognised under UK GDPR applies.

You may request details of the safeguards in place for any specific transfer by contacting us.

7. Data security

We apply technical and organisational measures appropriate to the risk, including:

TLS encryption across the entire Site, including checkout and account areas
Passwords stored using one-way hashing
Access to order and customer data restricted to personnel who need it
Multi-factor authentication on administrative accounts
Regular software, plugin, and platform updates
Routine backups held securely

No method of transmission or storage is entirely secure, and we cannot guarantee absolute security. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours of becoming aware, and will inform you directly where the risk is high.

8. Cookies and similar technologies

We use cookies and comparable technologies for four purposes.

Strictly necessary cookies keep the Site working — cart contents, checkout, login sessions, security, your selected currency, and your age confirmation. These do not require consent, because the Site cannot function without them.

Functional cookies remember preferences such as saved addresses and wishlist items. These are set only with your consent.

Analytics cookies help us understand how the Site is used so we can improve it. These are set only with your consent.

Marketing cookies, where used, measure campaign performance. These are set only with your consent.

Non-essential cookies are set only after you consent. You can change or withdraw your preferences at any time through the cookie settings on the Site, and you can block or delete cookies through your browser — though blocking strictly necessary cookies will prevent the cart and checkout from working.

9. How long we keep your information

We keep personal data no longer than necessary for the purposes set out in this policy. Our standard periods are:

Order, transaction, and invoice records — six years from the end of the relevant accounting period, as required by UK tax law.
Research-use confirmations — six years, retained alongside the associated order.
Account details — for as long as your account is active, then twelve months after your last activity.
Enquiries and support correspondence — twenty-four months from the last message in the thread.
Newsletter subscriber data — until you unsubscribe, then removed within thirty days.
Analytics data — the retention period set by the analytics provider, typically fourteen to twenty-six months.
Server and security logs — twelve months.

Where data no longer needs to be identifiable, we anonymise it instead of deleting it, and may retain the anonymised form indefinitely for statistical purposes.

10. Age restriction

The Site is intended for use by persons aged 18 or over. We do not knowingly collect personal data from anyone under 18.

If you believe a person under 18 has provided us with personal data, contact us at [INSERT EMAIL] and we will delete it promptly.

11. Your rights

Under UK GDPR you have the right to:

Be informed — about how your data is used, which this policy provides.
Access — obtain a copy of the personal data we hold about you.
Rectification — have inaccurate or incomplete data corrected.
Erasure — have your data deleted, where no overriding legal obligation requires us to keep it. Note that order and accounting records must be retained for six years.
Restrict processing — ask us to pause processing while a concern is investigated.
Data portability — receive data you provided to us in a structured, commonly used, machine-readable format.
Object — to processing based on legitimate interests, and to direct marketing at any time.
Withdraw consent — where processing relies on consent, without affecting the lawfulness of prior processing.
Not be subject to automated decision-making — we do not make decisions producing legal or similarly significant effects by automated means.

To exercise any of these rights, contact [INSERT EMAIL]. We will respond within one calendar month. That period may be extended by up to two further months for complex requests, and we will tell you if that applies. There is no charge unless a request is manifestly unfounded or excessive.

We may ask you to verify your identity before disclosing personal data.

12. Third-party links and social media

The Site links to external sites, including our Facebook, Instagram, and TikTok profiles. We are not responsible for the privacy practices of those platforms or of any other site we link to. Their own privacy policies apply once you leave the Site.

13. Changes to this policy

We may update this policy from time to time. The current version is always the one published on this page, with the effective date shown at the top.

Where changes materially affect how we use your personal data, we will notify account holders and newsletter subscribers by email before the change takes effect.

14. Contact and complaints

For any question about this policy, or to exercise your rights:

We would ask that you raise the matter with us first so we have an opportunity to resolve it.

Crew Labs products are supplied strictly for laboratory research purposes. They are not for human or veterinary use, not for diagnostic or therapeutic use, and not for consumption of any kind.