Apexion Biolabs Privacy Policy

1. Who we are

Apexion BioLabs is responsible for the personal information described in this policy and acts as the data controller for the BioLabs shop and website.

Questions or privacy requests can be sent to contact@apexionbiolabs.co.uk.

Apexion One is a separate digital service involving different categories of information. Its processing is explained in the Apexion One Privacy Policy.

2. Information we collect

Depending on how you use the website, we may collect:

• Identity and contact information, including your name, email address, telephone number, billing address and delivery address.
• Account information, including your login details, account preferences and order history.
• Order and transaction information, including products ordered, payment status, refunds, delivery details and communications about an order.
• Support information contained in emails, forms, messages or other enquiries you send to us.
• Marketing preferences, including whether you have subscribed, opted out, opened or interacted with a message.
• Technical and usage information, including IP address, browser, device, approximate location, cookie identifiers, pages viewed and website interactions.
• Fraud-prevention and security information generated when we protect payments, accounts and the website.

Payment providers process card or bank-payment credentials. Apexion BioLabs does not receive or store complete card numbers or online-banking security credentials where payment is handled directly by those providers.

3. How we use your information

We use personal information to:

• Create and manage shop accounts.
• Process payments, prepare orders and arrange delivery.
• Send order confirmations, payment updates, dispatch notices and essential service messages.
• Provide customer support and respond to enquiries.
• Manage cancellations, returns, refunds and disputes.
• Send abandoned-cart reminders where permitted and provide a way to opt out.
• Send product or business updates where you have consented or where electronic-marketing rules otherwise allow us to do so.
• Operate, secure, troubleshoot and improve the website.
• Detect and prevent fraud, misuse, unauthorised access and other security incidents.
• Maintain appropriate tax, accounting and business records and comply with legal obligations.

4. Our lawful bases

We rely on different lawful bases for different activities:

• Contract: where information is necessary to create an account, process an order, take payment, deliver products or provide requested support.
• Legal obligation: where we must keep records, respond to lawful requests or comply with tax, accounting, consumer-protection or other legal duties.
• Legitimate interests: where necessary to operate and secure the business, prevent fraud, improve services, manage enquiries or communicate with existing customers in a proportionate way.
• Consent: where consent is required for marketing, non-essential cookies or another specific activity. You can withdraw consent at any time.

Where we rely on legitimate interests, we consider whether the use is necessary and balance it against your rights and reasonable expectations.

5. Cookies and analytics

Essential cookies support functions such as security, shopping baskets, checkout and account access. We may also use optional analytics, preference or marketing technologies where you have made the relevant choice through our cookie controls.

You can change your cookie choices using the controls available on the website. Blocking some essential technologies may prevent parts of the shop from working correctly.

6. Marketing and cart reminders

We may send marketing messages where you have consented or where the law allows communication with an existing customer about similar products or services.

If you begin checkout but do not complete an order, we may use the contact information supplied during that process to send a limited cart reminder where permitted. Every marketing or cart-recovery email will include an unsubscribe or opt-out method.

Service messages about an order, payment, account security or policy change are not marketing and may still be sent where necessary.

7. Who we share information with

We share only the information reasonably necessary with trusted service providers and other recipients, which may include:

• Payment and pay-by-bank providers.
• WooCommerce, website-hosting, security, backup and technical-support providers.
• Royal Mail and other delivery or fulfilment providers.
• Email, customer-support and customer-relationship-management providers.
• Analytics and cookie providers used in accordance with your choices.
• Professional advisers, insurers, accountants or auditors.
• Regulators, courts, law-enforcement bodies or other parties where disclosure is legally required or necessary to protect rights and security.

We do not sell or rent personal information to third parties.

8. International transfers

Some technology or payment providers may process information outside the United Kingdom. Where this happens, we use an appropriate legal safeguard, such as UK adequacy regulations, an approved transfer agreement or another lawful transfer mechanism.

You may contact us for further information about the safeguards relevant to your personal information.

9. How long we keep information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, tax, accounting, fraud-prevention and dispute-resolution requirements.

• Order and transaction records are normally retained for the period required by applicable tax, accounting and contractual rules.
• Account information is generally retained while the account remains active and for an appropriate period after closure.
• Support and complaint records are retained for as long as necessary to resolve the matter and maintain an appropriate business record.
• Marketing information is retained until you opt out or it is no longer needed, with a minimal suppression record kept where necessary to respect your choice.
• Technical and security logs are retained for limited periods based on operational and security needs.

Information may be retained for longer where required by law, a legal claim, fraud prevention or an active dispute.

10. How we protect information

We use appropriate technical and organisational measures intended to protect personal information from unauthorised access, alteration, disclosure or loss. These measures include access controls, secure connections, account protections, service-provider controls and backups where appropriate.

No online service can guarantee absolute security. You are responsible for choosing a strong, unique password and protecting access to your email account and devices.

12. Children

The BioLabs shop is not intended for anyone under 18. We do not knowingly accept orders from children. If you believe a child has provided personal information, please contact us so that we can investigate and take appropriate action.

13. Changes to this policy

We may update this Privacy Policy when our services, technology, providers or legal obligations change. The latest version will be displayed on this page with its updated date. Where a change materially affects how we use personal information, we will provide an appropriate notice before the new use begins.

14. Contact

For privacy questions, requests or complaints, contact: