Privacy policy

Updated 4 October 2026.

This policy explains which personal data we process when you visit luxpeptides.lt, send an inquiry or write to us, why we do it, and what rights you have under the General Data Protection Regulation (GDPR, EU 2016/679).

Who is responsible for your data

The data controller is LUXPEPTIDES.LT. For any data protection question write to lux@luxpeptides.lt.

What we collect and why

Inquiries and orders. Name, e-mail, phone (optional), organisation (optional), delivery address, comment, the products ordered and your confirmation that you are 18+ and the products are for research use only. We use them to fulfil the inquiry: check the intended use, issue the invoice, deliver and contact you. Legal basis – entering into and performing a contract (GDPR art. 6(1)(b)); for accounting records – a legal obligation (art. 6(1)(c)).

Contact form and e-mails. Name, e-mail, phone (optional) and your message, so we can reply. Legal basis – your request and our legitimate interest in answering it (art. 6(1)(b) and (f)).

Newsletter. E-mail address and language – only if you subscribe yourself. Legal basis – your consent (art. 6(1)(a)). You can unsubscribe at any time – just write to us.

Anonymous visit statistics. We count how many people visit, the device type (computer, phone, tablet), language, the first page opened and whether they came through one of our QR codes or campaigns. No IP address or identifier is stored and no cookies are used – these figures cannot identify you. Legal basis – our legitimate interest in improving the site (art. 6(1)(f)).

Security. To block spam and attacks, our forms run a short computing task in your browser, and your IP address is held briefly in server memory to limit the number of requests. If a submission is rejected as spam, only an irreversibly hashed, shortened IP code is logged (last 200 entries) so we can spot repeated sources. Legal basis – our legitimate interest in keeping the site secure (art. 6(1)(f)).

We do not sell data and do not use it for profiling or automated decisions.

How long we keep it

Inquiries, orders and correspondence – 3 years from the last contact.
Invoices and other accounting records – 10 years, as required by Lithuanian accounting law.
Newsletter subscription – until you unsubscribe.
Anonymous statistics – no longer than 24 months.
Backups – 14 days.

Who we share data with

Our server provider – the website and data are kept on a server we rent in the European Economic Area.
Our e-mail provider – to send inquiry confirmations and replies. If the provider processes data outside the EEA, this is based on a European Commission adequacy decision or standard contractual clauses.
Couriers and parcel-locker networks (e.g. Omniva, LP Express) – only the data needed for delivery.
Our accountant and public authorities – where the law requires it.

Our domain name system (DNS) is run by Cloudflare, but no visitor data is passed to them. Fonts, the 3D library and all other files load from our own server only – the site does not contact Google, Facebook or any other third party.

Cookies and browser storage

The public website does not use cookies. Only these entries are kept in your browser's local storage (localStorage):

luxary-cart-v1 – the products in your inquiry. Necessary for the site to work. Kept until you clear the inquiry or your browser data.
lux-consent – your statistics choice. Necessary. Kept for 12 months.
lux-utm – which QR code or campaign brought you here (e.g. "leaflet"), so we can see which advertising works. Stored only if you agree to statistics. Kept for 30 days.

We use no advertising, tracking or social media tools (no Google Analytics, Facebook Pixel or similar). You can change your choice at any time with "Cookie settings" at the bottom of the site.

Your rights

You have the right to:

access your data and receive a copy;
have inaccurate data corrected;
have your data erased ("right to be forgotten") when it is no longer needed or there is no longer a basis for processing it;
restrict processing, or object to processing based on legitimate interest;
receive your data in a structured format and transfer it to another controller;
withdraw consent at any time (this does not affect processing carried out before the withdrawal).

Send your request to lux@luxpeptides.lt. We reply within one month. If you believe your data is processed unlawfully, you can complain to the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, Vilnius, vdai.lrv.lt) or the authority in your country.

How we protect data

All traffic is encrypted (HTTPS), the administration system requires a personal account (two-factor authentication available), access is limited to those who need it for their work, and daily backups are kept on the same secured server.

Minors

Our products are for adults (18+) and for research use only, so we do not knowingly collect data from anyone under 18.

Changes

If our processing changes, we will update this policy and the date at the top. Significant changes will also be announced on the site.