What peptide suppliers do with your data: privacy policy, retention and deletion requests compared

Why this matters for a research-chemical order

An order record ties your name, address, payment details and the product names together. Who holds that record, who they share it with and for how long is set out in each supplier's privacy policy. Policies vary widely in detail, and the gaps are as informative as the content. The comparison below uses each supplier's privacy policy as fetched on 30 October 2026.

Policy comparison

'Not stated' means the policy text is silent on the point.

Your access right: what GDPR Article 15 gives you

Article 15 of the UK GDPR, as published in the UK government legislation database, entitles you to access to your personal data plus specific information: the purposes, the categories of data, the recipients or categories of recipient, where possible the envisaged retention period, the existence of rights to rectification, erasure, restriction and objection, any available information about the source, and the existence of automated decision-making including profiling. [1] The controller must provide a copy of the personal data and may charge a reasonable fee only for further copies; providing a copy must not adversely affect the rights of others. [1]

Article 12 says information and action on requests are provided free of charge, that a controller may charge a reasonable fee or refuse a manifestly unfounded or excessive request, and that a controller with reasonable doubts about identity may ask for more information to confirm it. [3] The ICO's guidance for the public says organisations usually have one month to respond. [4] Peptides EU, which relies on the GDPR article numbers in its own policy, commits to respond within 30 days. [6]

Your erasure right: what Article 17 does and does not cover

Article 17 gives a right to erasure without undue delay on listed grounds, including that the data are no longer needed for their purpose, that consent has been withdrawn with no other legal basis, that you have objected and there are no overriding grounds, or that processing was unlawful. [2] It does not apply to the extent processing is necessary for compliance with a legal obligation, or for the establishment, exercise or defence of legal claims, among other exceptions. [2]

That exception matters for an order history. Peptides EU says order and transaction data are retained as required for tax, accounting and legal compliance, and account data are deleted on verified request where the law no longer requires retention. [6] Expect a deletion request to remove marketing and account data while invoices and order records stay until their legal retention period ends.

US buyers: CCPA rights and when they apply

The California Attorney General's CCPA page lists rights to know, delete, opt out of sale or sharing, correct, limit use of sensitive personal information, and non-discrimination. [5] The law applies to for-profit businesses doing business in California that meet at least one threshold: gross annual revenue above $25 million, buying, selling or sharing personal information of 100,000 or more California residents or households, or deriving 50 percent or more of annual revenue from selling personal information. [5] Businesses must respond within 45 calendar days, extendable by another 45 days with notice. [5]

Whether any of these suppliers meets a threshold is not public. Omni's policy lists California rights regardless; Evolve's policy does not mention CCPA or any state law. [7] [8]

Template: access and deletion request

Send from the email address used on the order, keep a copy, and note the date sent. Adapt the law cited to your location.

Subject: Subject access request (and erasure request) - order [number]. Under Article 15 GDPR [or: under the CCPA right to know], please confirm whether you process my personal data and provide a copy, together with the purposes, categories of data, recipients or categories of recipient including payment, shipping and analytics providers, the retention period or the criteria used to set it, and the source of any data not collected from me. Separately, under Article 17 [or: the CCPA right to delete], please erase my account and marketing data and tell me which records you must retain, the legal basis and for how long. Identifiers: name, email, order numbers. Please respond within the statutory period.

• Record the date sent; for Peptides EU the stated response time is 30 days. [6]
• Use the subject line the supplier asks for, such as 'GDPR Request' for Peptides EU. [6]
• Expect an identity check; Article 12 allows a controller with reasonable doubts to ask for more information. [3]
• Withdraw optional cookie consent separately where the site offers it. [6]
• Keep the request, any acknowledgement and the reply together; you will need them if you escalate.