Privacy
What we collect, why, how long we keep it, and what you can ask us to do with it.
Last updated 18 August 2026
Who is responsible for your data
JLP Labs Ltd is the data controller for personal data collected through this site. You can reach us via our contact page.
What we collect
- When you place an order
- Your email address, delivery name and address, the name you tell us a payment will come from if you choose to give it, and a record of your 18+ and research-use confirmations with the time you made them.
- When you pay
- Records of payments received against your order, as reported to us by our bank. This includes the payer name and reference shown on the transaction. We never see or hold card details, because we do not accept cards.
- When you ask to be told about restocks
- Your email address, and the product you asked about.
- When you join our email list
- Your email address, where you signed up (the home page or checkout), the exact wording you agreed to, and when you agreed and confirmed.
- When you contact us
- Whatever you choose to put in your message.
You can order as a guest, or create an optional account (email and password) to see your past orders and save a delivery address. We do not use advertising or cross-site tracking cookies, and we never sell or share your data for advertising.
Cookies and analytics
Some storage is strictly necessary and is always on: it remembers your basket, your age confirmation, and — if you have an account — keeps you signed in. This does not require consent.
With your consent we also use Google Analytics to understand how the site is used — which pages are visited, and on what kind of device. This sets analytics cookies and shares that usage data with Google, with IP addresses anonymised. Nothing is set until you accept the cookie banner; you can decline with no loss of function, and change your choice at any time from “Cookie settings” at the foot of any page.
Why we hold it, and on what basis
- To take, fulfil and support your order — necessary to perform our contract with you.
- To match incoming payments to orders and resolve payment problems — necessary for our legitimate interest in being paid correctly, and for our contract with you.
- To keep records of sales and of who received which batch — necessary for our legal obligations, and for product traceability.
- To send restock notifications — with your consent, which you can withdraw at any time.
- To send our email updates about new compounds, restocks and offers — with your consent. A sign-up from the home page only starts once you click the link in the confirmation email we send. Every update has an unsubscribe link that takes you off the list in one click, with no sign-in; you can also contact us to be removed.
How long we keep it
Order and payment records are kept for six years after the end of the financial year they fall in, which is the period UK tax law requires. Batch traceability records are kept for the same period, because being able to identify who received a given lot is the point of holding them. Restock requests are deleted once fulfilled or on request. If you unsubscribe from our email list we keep your address and the date you unsubscribed, so we never add you back by mistake; ask us and we will delete it.
Who we share it with
We share data only with the services needed to run the shop:
- Our bank and payment provider, to receive and match payments.
- Royal Mail, to deliver your order.
- Our hosting and database providers, who store the data on our behalf.
- Our email provider (Resend), which sends our order emails and, if you join our list, our email updates, as a processor acting on our instructions.
We do not sell your data, and we do not share it for marketing.
Your rights
You can ask us for a copy of your data, ask us to correct it, ask us to delete it, object to how we use it, or ask for it in a portable form. Contact us and we will respond within one month. If you are not satisfied you can complain to the Information Commissioner’s Office at ico.org.uk.
Draft for review. To be confirmed before launch: named data-protection contact and the final list of processors. Not reviewed by a solicitor.