Legal
Privacy Policy
What we collect, why we collect it, who handles it and what rights you have. We do not sell your data and we send no marketing without your consent.
Last updated 30 October 2026
Who we are
LABS PTG is the controller of the personal data described in this notice. Contact us at hello@labsptg.com for anything about your data.
What we collect
- Your name, email address and phone number.
- Your delivery and billing addresses.
- Your orders: the products and lots, amounts, dates, order numbers and payment status.
- Payment details as they appear to us when a bank transfer arrives, such as the name on the paying account, the amount and the reference. We never see card details, because we do not take cards.
- Your account details. Your sign-in is handled by our authentication provider.
- Your confirmations at checkout: that you are 18 or over, that you are buying for research use, and when you agreed.
- Messages you send us through the contact form or by email.
- Basic technical data such as your IP address, which our hosting provider records when you visit.
How we use it, and why
| What we do | Lawful basis |
|---|---|
| Take, match payment for, dispatch and support your orders, and run your account | Contract |
| Keep tax and accounting records | Legal obligation |
| Check eligibility, prevent fraud and misuse, and enforce our research use policy | Legitimate interests |
| Answer your questions and handle returns or quality concerns | Contract, or legitimate interests |
| Keep the site secure and working | Legitimate interests |
| Send marketing, if you ever choose to receive it | Consent |
Where we rely on legitimate interests, those interests are keeping our products out of misuse, protecting our business and customers from fraud, and giving you a prompt reply. You can object at any time.
Who we share it with
We use a small number of service providers, who handle data only on our instructions:
- Firebase and Google Cloud, for hosting, our database and sign-in. Your data is stored in the UK region europe-west2 (London).
- Royal Mail, for delivery. They receive your name and delivery address, and contact details where needed for delivery.
- Our email provider, which sends and receives our email.
- Our bank, which receives your bank-transfer payment.
We may also share data with our accountants and advisers, and with the authorities where the law requires it. We do not sell your personal data and we do not share it for advertising.
Transfers outside the UK
We keep your data in the UK. If a provider’s staff or systems outside the UK ever handle it, we rely on UK adequacy regulations or the UK approved contract terms to protect it.
How long we keep it
- Orders, payment records and eligibility confirmations: 6 years, as tax and accounting law requires.
- Your account: until you ask us to close it. We then delete it, except for order records we must keep.
- Messages and enquiries: 12 months after the last contact, unless they relate to an order.
- Hosting and security logs: short periods set by our hosting provider.
Your rights
Under UK GDPR you can ask us to:
- give you a copy of your personal data;
- correct anything that is wrong;
- delete your data, where we are not required to keep it;
- restrict how we use your data;
- give you your data in a portable format;
- stop using your data where we rely on legitimate interests; and
- withdraw your consent at any time, where we rely on it.
Email hello@labsptg.com. We normally reply within one month and do not charge a fee. We may need to confirm your identity first.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk. We would appreciate the chance to put things right first.
Cookies and storage
We store only what the site needs to work, in your browser. See our cookies page.
Security
This website is served over an encrypted connection and runs on Google’s secure infrastructure. We limit access to personal data to the people who need it. No system is perfectly secure, so please tell us at once if you think your account has been misused.
Children
This website is for people aged 18 and over. We do not knowingly collect data from anyone younger.
Changes to this notice
We may update this notice from time to time. The date at the top shows the latest version.