Privacy Policy
This Privacy Policy outlines how Ligaya Labs collects, uses, and safeguards personal data obtained from visitors to our website and laboratory research clients in compliance with the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018.
Jump to Section (9)↓
Who we are and scope
Ligaya Labs operates as the data controller for personal data processed through this website. We are a UK supplier of analytical reference materials, laboratory reagents, and in-vitro research peptides. All compounds catalogued are intended strictly for in-vitro research and laboratory analysis, not for medicinal, clinical, therapeutic, human or veterinary use.
Fulfilment and dispatch are restricted exclusively to the United Kingdom. This privacy notice applies to visitors browsing our catalogue, individuals making research enquiries, and subscribers registering for product restock notifications.
For any enquiries regarding this policy or the processing of your personal information, please contact our data compliance point of contact directly at sales@ligayalabs.co.uk.
What data we collect
We collect and process personal data depending on how you interact with our website. Because products are currently in pre-launch status and direct online purchasing is coming soon, our current collection is focused on technical enquiries and notification requests:
- Contact form and email enquiries: Your name, email address, message body, research focus or reference numbers, and any accompanying technical specifications or data you choose to send to us.
- Restock alert sign-ups: Your email address and the specific peptide lot or reference catalogue item for which you requested availability notifications.
- Website usage data through cookies: Standard internet log metrics including pages viewed, visit timestamps, referring URL, browser user agent, device operating system, and approximate geographic location derived from IP address.
- Future order and delivery details (when online ordering opens): Customer name, shipping address within the UK, email address, telephone contact number, order line items, and payment gateway confirmation tokens. We never see, receive, or store raw credit or debit card numbers; all payment transactions are routed directly through PCI-DSS Level 1 compliant payment service providers.
Why we use it and our lawful basis
Under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, we must identify a valid lawful basis for each processing purpose. Our processing activities and their corresponding legal bases are outlined below:
| Purpose / Activity | Data Types | Lawful Basis under UK GDPR |
|---|---|---|
| Answering technical enquiries & customer communication | Name, email address, message content, technical requirements | Legitimate interests: Necessary to respond to your specific enquiries, supply Certificates of Analysis (COA), and manage customer relationships. |
| Restock alerts & product availability notifications | Email address, product preference | Consent: You provide explicit opt-in consent when requesting an alert. You can withdraw your consent at any time via an unsubscribe link or by contacting us. |
| Running, optimising & securing the website | IP address, session logs, browser information, error reports | Legitimate interests: Maintaining platform stability, preventing fraudulent requests, ensuring network security, and debugging. |
| Non-essential analytics cookies | Aggregated usage metrics, click journeys | Consent: Enabled only where you have permitted non-essential performance tracking. |
| Order fulfilment & commercial record keeping (once orders open) | Order details, delivery address, confirmation tokens, billing records | Performance of a contract: Necessary to deliver research materials you order. Legal obligation: Retaining statutory VAT, accounting, and HMRC financial audit records. |
How long we keep it
Personal data is retained only for as long as necessary to fulfil the operational purposes for which it was gathered, in line with the following retention schedules:
- Technical and general enquiries: Kept for up to 24 months following the last documented contact, enabling follow-up verification regarding chemical lots and enquiry history.
- Restock notifications: Retained until the relevant product is back in stock and the alert has been dispatched, or until you exercise your right to unsubscribe.
- Order, invoice, and delivery records: Kept for 6 years following the conclusion of the relevant tax year to comply with UK statutory accounting, VAT, and HMRC obligations.
- Cookie and analytics logs: Stored according to predefined cookie lifespans (session cookies expire upon browser termination, while persistent analytics cookies expire after a maximum of 12 months).
Your rights under UK GDPR
Under UK data protection legislation, you hold specific statutory rights regarding how your personal information is collected and used:
- Right of access: Request confirmation and a copy of the personal data we hold concerning you.
- Right to rectification: Request correction of any incomplete or inaccurate data.
- Right to erasure (right to be forgotten): Request deletion of your personal data where there is no ongoing legal ground for retention.
- Right to restriction: Request that processing be paused while data accuracy or lawful basis objections are assessed.
- Right to object: Object to processing carried out under our legitimate interests.
- Right to data portability: Request transfer of your data in a structured, machine-readable format to yourself or a third party.
- Right to withdraw consent: Where processing relies on your consent (such as restock notifications), you may withdraw consent at any time without affecting past processing.
To exercise any of these rights, please contact us by email at sales@ligayalabs.co.uk. We do not charge a fee for standard requests and will respond within one calendar month.
If you have concerns about our data handling, you also have the right to lodge a complaint with the UK supervisory authority: the Information Commissioner's Office (ICO). You can submit a report online via the ICO Make a Complaint portal or by telephoning 0303 123 1113.
Security and international transfers
We implement appropriate technical, operational, and physical security measures to safeguard personal data against unauthorised access, alteration, accidental loss, or unlawful disclosure. Access is strictly restricted to personnel who have an operational requirement to view it.
Our core systems and storage are situated within the United Kingdom and European Economic Area (EEA). Where technical service providers process data outside the UK or EEA, we ensure appropriate transfer safeguards are maintained—such as the UK International Data Transfer Agreement (IDTA), standard contractual clauses, or adequacy regulations—ensuring an equivalent standard of protection.
Changes to this policy and contact
We review and update this privacy policy periodically to reflect statutory changes, operational revisions, or new website capabilities. Any revisions will be published immediately on this page with an updated revision date.
If you have questions, feedback, or requests regarding this Privacy Policy, please contact our team:
Ligaya Labs Data Protection Team
Email: sales@ligayalabs.co.uk
Subject line: UK GDPR Privacy Enquiry