1. Introduction & Scope of Policy

At Apex Pure Pep (“Company”, “we”, “us”, or “our”), we place the highest priority on preserving the confidentiality, integrity, and security of our researchers’ personal data. This Privacy Policy details how we collect, process, store, disclose, and safeguard personal information obtained when you visit our website (https://apexpurepep.com), purchase research chemicals, or communicate with our scientific and logistics teams.

This policy applies universally to visitors, registered researchers, institutional buyers, and business partners globally, with specialized disclosures set forth for data subjects residing within the European Economic Area (EEA), the United Kingdom (UK), and California (USA).

2. Data Controller & Data Protection Officer (DPO)

For the purposes of the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the UK Data Protection Act 2018 (“UK GDPR”), the designated Data Controller is:

3. Categories of Personal Information We Collect

We collect personal data only to the minimum extent necessary to process high-purity research chemical transactions, comply with statutory customs regulations, prevent fraud, and optimize our digital portal.

4. Lawful Bases for Processing (Under GDPR & UK GDPR)

In accordance with Article 6 of the GDPR, we process your personal data only when substantiated by one of the following legal grounds:

• Contractual Necessity (Art. 6(1)(b)): To execute and deliver on our contractual obligations—namely, accepting orders, processing payments, arranging cold-chain or discreet logistics, and delivering research chemicals to your designated address.
• Compliance with Legal Obligations (Art. 6(1)(c)): To fulfill mandatory statutory accounting requirements, tax filings, anti-fraud verifications, export trade restrictions, and lawful governmental regulatory inquiries.
• Legitimate Interests (Art. 6(1)(f)): To maintain web platform cybersecurity, detect and prevent chargeback fraud, defend against legal claims, and improve our chemical synthesis and shipping infrastructure, provided such interests are not overridden by your fundamental privacy rights.
• Explicit Consent (Art. 6(1)(a)): For non-essential analytics tracking or voluntary scientific newsletter subscriptions, which you may revoke at any time.

Special Categories of Data: Apex Pure Pep does NOT knowingly solicit or process sensitive personal data (e.g., biometric, genetic, philosophical, or medical/health information). As our products are strictly Research Use Only (RUO) and not for medical application, we maintain zero medical records.

5. California Consumer Privacy Act (CCPA / CPRA) Special Notice

This section provides specific supplemental notices for residents of California pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CCPA/CPRA”).

A. Strict “Do Not Sell or Share” Statement

B. Consumer Rights Under CCPA/CPRA

California residents are afforded specific statutory rights:

• Right to Know / Access: You may request disclosure of the specific pieces and categories of personal information collected, the business sources, and third parties with whom data is shared over the preceding 12 months.
• Right to Delete: You may demand the permanent deletion of personal data collected, subject to statutory exemptions (e.g., maintaining transaction records for tax, legal, or fraud defense).
• Right to Correct: You have the right to request rectification of inaccurate personal details maintained in our active systems.
• Right to Non-Discrimination: We will never deny services, adjust pricing, or degrade service quality for consumers exercising their CCPA rights.

6. Cookies, Analytics & Tracking Technologies

Our digital infrastructure uses industry-standard cookies, local storage objects, and secure session identifiers. Cookies are classified into:

• Strictly Necessary Cookies: Essential for platform security, user login authentication, cart state retention, and cryptographic checkout security. These cannot be disabled.
• Functional & Analytical Cookies: Anonymized telemetry (e.g., session durations, load performance, error diagnostics) used to refine our site. Personal IP addresses are anonymized prior to analytical processing.

Researchers can manage cookie preferences via browser settings (e.g., disabling third-party cookies or clearing local storage).

7. Third-Party Service Providers & Data Transfers

Apex Pure Pep never sells your data. We disclose personal data solely to trusted third-party service providers bound by strict confidentiality and Data Processing Agreements (DPAs):

• Logistics & Freight Forwarding Partners: Global couriers (e.g., specialized private express networks, regional post authorities, customs brokers) receive recipient names, destination addresses, and customs values solely to ensure safe transit and clearance.
• PCI-DSS Payment Gateways & Banking Networks: Encrypted financial conduits processing authorized payments under industry-standard cryptographic vaulting.
• Cybersecurity & Anti-Fraud Providers: Automated threat detection systems monitoring for distributed denial of service (DDoS) attacks, brute-force intrusions, and card-testing syndicates.

Cross-Border International Transfers: Where data originating from the EEA or UK is transferred to infrastructure located in other countries, we ensure appropriate safeguards are implemented, specifically European Commission-approved Standard Contractual Clauses (SCCs) and UK International Data Transfer Addendums.

8. Cryptographic Data Security & Storage Standards

Apex Pure Pep implements multi-tiered administrative, physical, and technical defenses engineered to protect against unauthorized access, loss, or alteration:

• Transport Layer Security (TLS 1.3) with 256-bit AES encryption across all digital interfaces;
• Database encryption at rest for sensitive credential hashes and address archives;
• Strict Least-Privilege Access Controls (RBAC) restricted solely to authorized compliance officers;
• Continuous automated vulnerability scanning and server penetration audits.

9. Data Retention Schedule

We retain personal data only for as long as necessary to fulfill the purposes for which it was gathered:

• Transaction & Invoicing Records: Preserved for seven (7) years to satisfy statutory tax, auditing, and corporate regulatory mandates.
• Active Customer Account Data: Maintained until account closure is requested by the researcher or following 24 months of total account inactivity.
• Security & Access Logs: Automatically purged or anonymized on a 90-day rolling cycle, unless required for ongoing fraud or intrusion investigations.

10. Exercise of Data Subject Rights

Whether you are an EU citizen exercising rights under GDPR or a California resident acting under CCPA, you may initiate a formal Data Subject Request (DSR) by submitting an email to [email protected] with the subject line “Data Subject Request – [Your Full Name]”.

To prevent identity theft, we require identity verification (e.g., confirming order history or verifying from the registered purchase email address). We respond to all verified requests within thirty (30) days (extendable by an additional 30 days for complex matters in accordance with statutory rules).

11. Protection of Minors (COPPA Policy)

The Platform and our chemical catalog are strictly restricted to verified researchers aged twenty-one (21) or older. We do not knowingly solicit or collect personal information from individuals under the age of 21 (or 18 in jurisdictions where minor age limits differ). Any account detected belonging to a minor will be terminated immediately and all associated data permanently erased.

12. Privacy Policy Updates & Amendments

We reserve the right to amend this Privacy Policy at our discretion to reflect technical, legal, or operational adjustments. Any revised policy will be posted on this page with an updated “Effective Date.” Continued use of the Platform after amendments constitutes acceptance of the revised terms.