Privacy Policy

1. Who We Are (Data Controller)

Apex Biohacks (“Apex Biohacks”, “we”, “us”, or “our”) is the data controller responsible for the processing of your personal data when you use our Website or purchase Products from us.

• Company name: [insert full legal name]
• Registered address: [insert]
• Registration and VAT number: [insert]
• Contact email for privacy matters: [insert privacy email]

If we appoint a Data Protection Officer (DPO), their contact details will be published here.

2. What Data We Collect

We may collect and process the following categories of personal data, depending on how you interact with us:

2.1. Identification and Contact Data

• Name, title
• Billing and shipping address
• Email address
• Telephone number

2.2. Account Data

• Login credentials (hashed password)
• Account preferences and settings

2.3. Order and Transaction Data

• Products ordered
• Order history
• Payment method and transaction information (limited to details we need; full card data is handled by our payment service providers)

2.4. Technical and Usage Data

• IP address
• Browser type and version
• Device identifiers
• Pages visited, time and date of visit, referring URLs
• Cookie identifiers and similar technologies

2.5. Communication Data

• Content of your communications with us (e.g., emails, contact form submissions, chat messages)

2.6. Marketing and Preference Data

• Newsletter subscriptions
• Marketing consent and preferences
• Response to marketing campaigns

We do not intentionally collect special categories of personal data (such as health information) via the Website; please do not submit such data through our contact forms or order notes.

3. For What Purposes We Use Your Data and Legal Bases

We process your personal data only where we have a legal basis under the GDPR.

3.1. To Process and Deliver Your Orders

Purposes: manage orders, payment, shipping, returns, and customer service. Legal bases: performance of a contract (Article 6(1)(b) GDPR); compliance with legal obligations (Article 6(1)(c) GDPR, e.g., accounting and tax).

3.2. To Provide and Manage Your Account

Purposes: register and maintain your account, authenticate log-ins, provide personalized services. Legal bases: performance of a contract; our legitimate interests in providing secure and efficient account functionality.

3.3. To Communicate with You

Purposes: respond to queries, send order updates, handle complaints. Legal bases: performance of a contract; our legitimate interests in good customer service.

3.4. To Send You Marketing Communications

Purposes: send newsletters and offers related to our Products and activities. Legal bases: consent (where required, e.g., email marketing to individuals) or our legitimate interests in promoting our Products, subject to your right to opt out at any time.

3.5. To Operate, Improve, and Secure the Website

Purposes: monitor performance, prevent fraud and misuse, maintain security, and analyze aggregated usage trends. Legal bases: our legitimate interests in operating a secure and reliable Website; in some jurisdictions, consent for non-essential cookies.

3.6. To Comply with Legal Obligations

Purposes: record keeping, tax and accounting, handling legal claims, and responding to requests from authorities. Legal basis: compliance with legal obligations (Article 6(1)(c) GDPR).

4. Cookies and Similar Technologies

4.1. We use cookies and similar technologies on the Website to enable core functionalities (e.g., cart, checkout, log-in), collect analytics on Website usage, and support marketing and advertising, where applicable.

4.2. When required by law, we will present you with a cookie banner at your first visit, explain the categories of cookies used, and obtain your consent for non-essential cookies.

4.3. You can manage your cookie preferences through your browser settings or our cookie management tool (where available).

5. Who We Share Your Data With

We share personal data only with parties who need it to perform services on our behalf or where required by law:

• Payment Service Providers and Banks — to process payments, manage refunds, and prevent fraud. These providers are PCI-compliant and handle your card data securely; we do not store full card numbers.
• Shipping and Logistics Providers — to deliver Products to your specified address and handle returns.
• IT, Hosting, and Technical Service Providers — to host the Website, store data, provide security and technical support.
• Analytics and Marketing Partners — to analyze Website usage and, where applicable, show you relevant adverts (subject to your consent where required).
• Professional Advisers and Authorities — lawyers, accountants, auditors, regulators, law-enforcement agencies, or courts where necessary to comply with legal obligations or defend legal claims.
• Corporate Transactions — in the event of a reorganization, merger, or sale of the business, your data may be transferred to the successor entity, subject to continued protection under this Privacy Policy or equivalent safeguards.

We do not sell your personal data to third parties in the sense of allowing them to use it for their own independent marketing purposes without your consent.

6. International Transfers

6.1. Some of our service providers may be located outside the European Economic Area (EEA).

6.2. Where personal data is transferred outside the EEA, we ensure that an adequate level of protection is in place, for example by using standard contractual clauses approved by the European Commission or transfers to countries recognized as providing an adequate level of data protection.

7. How Long We Keep Your Data

7.1. We keep personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.

Examples (subject to specific national rules):

• Order and invoicing data: typically retained for at least the period required by tax and accounting laws (often 5–10 years).
• Account data: retained while your account is active; deleted or anonymized after a period of inactivity unless we need it for legal reasons.
• Marketing data: retained while you remain subscribed or until you object or withdraw consent.
• Technical/analytics data: retained in aggregate or anonymized form where possible.

8. How We Protect Your Data

8.1. We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or misuse, such as:

• TLS/SSL encryption for data in transit
• Access controls and authentication mechanisms
• Secure hosting environments and regular software updates
• Internal policies and training for staff handling personal data

No system is completely secure; however, we aim to safeguard your data in line with industry standards and applicable law.

9. Your Rights Under GDPR

Subject to conditions and exceptions under applicable law, you have the following rights:

• Right of access: obtain confirmation whether we process your data and receive a copy.
• Right to rectification: have inaccurate or incomplete data corrected.
• Right to erasure (“right to be forgotten”): request deletion of your data where there is no longer a legal basis to keep it.
• Right to restriction: request restriction of processing in certain circumstances.
• Right to data portability: receive your data in a structured, commonly used, machine-readable format and transmit it to another controller where technically feasible.
• Right to object: object at any time to processing based on our legitimate interests, including profiling, and to direct marketing.
• Right to withdraw consent: where processing is based on consent, you can withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise these rights, please contact us using the details in Section 1. You also have the right to lodge a complaint with your local supervisory authority if you believe your data protection rights have been violated.

10. Children’s Privacy

10.1. The Website and Products are not directed to children under 16 years of age, and we do not knowingly collect personal data from children.

10.2. If you become aware that a child has provided us with personal data without appropriate consent, please contact us so that we can delete it.

11. Research Use Only Context

11.1. Our Research Products are supplied exclusively to Professional Customers for laboratory research purposes and are not intended for use by consumers or patients. Therefore, we do not maintain patient medical records or process health data related to treatment outcomes through the Website.

12. Changes to This Privacy Policy

12.1. We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The updated version will be indicated by a revised “Last updated” date and will be effective when posted.

12.2. Where required by law, we will notify you of material changes and, if necessary, seek your consent to updated practices.