Privacy Policy

1. Scope & Research Entity Data Collection

We collect information necessary to authenticate scientific credentials, verify compliance with laboratory chemical distribution regulations, process temperature-sensitive cold-chain orders, and maintain analytical lot traceability records. Categories of data collected include:

• Institutional Identification: University, biotechnology firm, research hospital, or private laboratory facility name, laboratory shipping address, institutional domain email, and department contact.
• Principal Investigator & Purchaser Verification: Name, professional title, academic or institutional credentials, telephone number, and age verification affirmation (minimum 21 years of age).
• Transaction & Logistics Data: Encrypted payment confirmations (processed via PCI-DSS Level 1 compliant tokenized gateways), billing addresses, cold-chain carrier routing information, and batch delivery confirmations.
• Batch Lookup & Analytical Query Logs: Certificate of Analysis (COA) lookup history, batch number verifications, and technical support inquiries regarding compound solubility and storage.
• Automated Telemetry & Cookies: IP addresses, browser fingerprint telemetry, session tokens, and security monitoring logs to defend against automated bot exploitation and unauthorized inventory scraping.

2. Method & Purpose of Data Processing

All collected information is utilized strictly in service of lawful chemical distribution, cold-chain fulfillment, and regulatory compliance, specifically:

• Fulfilling, packaging, and dispatching temperature-sensitive research orders under strict cold-chain protocols.
• Maintaining immutable lot-traceability records linking shipped vial serial numbers to third-party HPLC and MS analytical certificates.
• Conducting mandatory compliance screening to ensure orders originate from legitimate scientific researchers and qualified laboratory facilities.
• Issuing critical safety bulletins, technical specification updates, or lot-specific retest notifications.
• Fulfilling accounting, tax, and federal commercial chemical supply reporting obligations.

3. Data Security & Cryptographic Standards

Club Pep implements enterprise-grade physical, electronic, and procedural safeguards to protect all scientific accounts and order data:

• Transport Layer Security: All web traffic, login sessions, and checkout submissions are encrypted using 256-bit TLS/SSL encryption with strict transport security (HSTS).
• Zero Raw Payment Storage: We do not store raw credit card numbers, CVVs, or bank account credentials on our web servers. All payment transactions are tokenized and processed directly by certified PCI-DSS Level 1 payment processors.
• Restricted Access & Audit Logs: Access to institutional customer records is restricted to authorized laboratory compliance and fulfillment personnel on a least-privilege basis with multi-factor authentication (MFA) and immutable access logging.

4. Disclosure to Authorized Service Providers

Club Pep discloses information only to verified operational partners essential for laboratory commerce:

• Cold-Chain Logistics Carriers: Expedited freight and express courier services (e.g., FedEx, UPS Priority) tasked with urgent temperature-controlled parcel delivery.
• Analytical Testing Laboratories: Anonymized batch performance queries and quality audit verification partners.
• Regulatory & Legal Authorities: Disclosures strictly mandated by federal subpoenas, court orders, or statutory chemical enforcement investigations under United States law.

5. Cookies & Digital Tracking Technologies

Our platform uses functional session cookies and minimal analytical trackers to provide essential services, including cart persistence, user session security, and COA lookup session states. You may disable cookies through your browser settings, though certain interactive features such as the batch verification tool and secure checkout may become restricted.

6. Researcher Data Rights & Retention

Subject to regulatory retention mandates governing chemical supply records (which require sales logs to be retained for statutory audit periods), researchers and institutions possess the following rights:

• Access & Portability: The right to request an electronic copy of all personal and institutional data associated with your laboratory account.
• Rectification: The right to correct inaccurate billing, contact, or facility credentials.
• Erasure / De-identification: The right to request deletion of marketing records and non-statutory account data upon conclusion of active research procurement.

7. Data Protection Office Contact

For inquiries concerning this Privacy Policy, scientific data protection, or to exercise your rights under GDPR, CCPA, or applicable data protection regulations, please contact our compliance office: