Privacy Policy

1. Introduction

Orcatech Bio-Peptides (“Orcatech,” “we,” “us,” or “our”) operates orcatechbio.com (the “Website”). This Privacy Policy describes how we collect, use, store, share, and protect information about visitors to our Website and purchasers of our research compounds, in compliance with applicable United States federal privacy law, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), and the European Union General Data Protection Regulation (GDPR) where applicable to users in the European Economic Area.

By accessing our Website or placing an order, you acknowledge that you have read, understood, and agree to the terms of this Privacy Policy. This policy should be read together with our Terms of Service and Compliance Statement.

2. Information We Collect

2.1 Account and Order Information

When you create an account or place a research compound order, we collect:

• Full name and institutional affiliation (where provided)
• Email address
• Billing and shipping address
• Phone number (if voluntarily provided)
• Order history and purchase records
• Research credentials or verification documentation (where requested)

2.2 Payment Information

Payment card details are processed exclusively by our PCI-DSS-compliant third-party payment processor. We do not store full payment card numbers on our servers. We retain only truncated card data (last four digits) and transaction reference identifiers for order management and financial record-keeping purposes.

2.3 Communications

If you contact us via email, website contact forms, or other channels, we retain records of those communications including your email address, message content, and any attachments, for the purpose of responding to inquiries and maintaining service records.

2.4 Automatically Collected Information

When you visit our Website, we automatically collect certain technical information including:

• IP address and general geographic location (country/region level)
• Browser type, version, and operating system
• Pages visited, time spent on pages, and navigation path
• Referring URLs and search terms
• Device type and screen resolution

This information is collected through server logs, cookies, and analytics tools and is used in aggregate, anonymized form to improve Website performance and functionality.

2.5 Newsletter and Research Updates

If you voluntarily subscribe to research updates or our email list, we collect your email address for the purpose of delivering relevant research notifications. Subscription is entirely voluntary and separate from the order process.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Processing and fulfilling research compound orders
• Sending order confirmations, fulfillment updates, and shipping notifications
• Responding to customer service inquiries and technical questions
• Verifying purchaser eligibility and research credentials as required by our research-use policy
• Preventing fraud, unauthorized access, and misuse of our products or Website
• Complying with applicable legal obligations, including financial record-keeping and regulatory compliance
• Improving Website functionality and user experience through aggregate analytics
• Sending research-relevant updates to subscribers who have provided explicit consent

We do not use personal information for: third-party advertising, sale to data brokers, profiling for commercial purposes unrelated to order fulfillment, or any purpose not listed above without prior notice and, where required, consent.

4. Legal Bases for Processing (GDPR)

For users located in the European Economic Area (EEA) or United Kingdom, we process personal data under the following lawful bases as defined under GDPR Article 6:

• Contractual Necessity (Art. 6(1)(b)): Processing required to fulfill your order and provide related services
• Legal Obligation (Art. 6(1)(c)): Processing necessary to comply with applicable law, including financial record-keeping and regulatory obligations
• Legitimate Interests (Art. 6(1)(f)): Fraud prevention, website security, aggregate analytics, and service improvement, where such interests are not overridden by your rights
• Consent (Art. 6(1)(a)): Where you have provided explicit, freely given consent, such as newsletter subscription or non-essential cookie placement

Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

5. Data Sharing and Third Parties

We share personal information only in the following limited circumstances:

• Payment Processors: Transaction data is shared with our PCI-DSS-compliant payment processor solely for the purpose of processing payments
• Shipping Carriers: Name, address, and order details are shared with shipping carriers for the purpose of order delivery
• Analytics Providers: Anonymized, aggregate usage data is shared with analytics tools (e.g., Google Analytics) to improve Website performance
• Email Service Providers: Email addresses of newsletter subscribers are shared with our email delivery provider solely for the purpose of delivering authorized communications
• Legal and Regulatory Authorities: We disclose information to law enforcement, regulatory agencies, or courts where required by applicable law, valid legal process, or to protect the safety or rights of third parties

All third-party service providers who process personal data on our behalf are contractually bound by data processing agreements requiring them to handle data securely and in accordance with applicable privacy law. We do not sell personal information to any third party under any circumstances.

6. Cookies and Tracking Technologies

We use cookies and similar technologies on our Website. Cookies are small text files stored on your device by your browser. We use the following categories of cookies:

• Strictly Necessary Cookies: Required for core Website functionality including login session management, shopping cart persistence, and secure checkout. These cookies cannot be disabled without impairing Website function.
• Functional Cookies: Enable the Website to remember your preferences such as currency, language, and saved addresses.
• Analytics Cookies: Collect anonymized, aggregate data about how visitors use the Website (e.g., Google Analytics). These help us understand usage patterns and improve performance.

You may control non-essential cookies through your browser settings or a cookie consent tool. Disabling strictly necessary cookies will impair your ability to place orders. For information about opting out of Google Analytics, visit tools.google.com/dlpage/gaoptout.

7. Data Retention

We retain personal information for the following periods:

• Order and transaction records: 7 years from the date of transaction, in accordance with US financial record-keeping requirements
• Account information: For the duration of the account, plus 2 years following account closure or last activity
• Customer service communications: 3 years from the date of the communication
• Credential verification records: 5 years from the date of verification, for compliance and audit purposes
• Newsletter subscriber data: Until unsubscription, after which it is deleted within 30 days
• Analytics data: Retained in anonymized, aggregate form in accordance with our analytics provider's data retention policies

Upon expiration of the applicable retention period, personal data is securely deleted or anonymized. Certain data may be retained beyond these periods where required by applicable law or for the establishment, exercise, or defense of legal claims.

8. Your Privacy Rights

8.1 GDPR Rights (EEA and UK Residents)

If you are located in the European Economic Area or United Kingdom, you have the following rights under GDPR:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal data
• Right to Erasure (Art. 17): Request deletion of your personal data, subject to applicable exceptions
• Right to Restriction (Art. 18): Request that we restrict processing of your data in certain circumstances
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format
• Right to Object (Art. 21): Object to processing based on legitimate interests
• Right to Withdraw Consent: Withdraw consent at any time where processing is consent-based
• Right to Lodge a Complaint: File a complaint with your national data protection supervisory authority

8.2 CCPA / CPRA Rights (California Residents)

California residents have the following rights under the CCPA and CPRA:

• The right to know what personal information is collected, used, shared, or sold
• The right to delete personal information, subject to applicable exceptions
• The right to correct inaccurate personal information
• The right to opt out of the sale or sharing of personal information (we do not sell or share personal information for cross-context behavioral advertising)
• The right to limit the use of sensitive personal information
• The right to non-discrimination for exercising your privacy rights

8.3 Submitting a Request

To exercise any of the rights above, submit a request via our contact page or email privacy@orcatechbio.com. We will respond within the timeframe required by applicable law (typically 30 days). We may need to verify your identity before processing your request.

9. Security

We implement industry-standard technical and organizational security measures to protect personal information against unauthorized access, alteration, disclosure, or destruction. These measures include SSL/TLS encryption for data in transit, access controls and authentication requirements for data access, regular security reviews and monitoring, and contractual security obligations imposed on third-party processors.

While we take reasonable precautions, no data transmission over the internet or electronic storage system is 100% secure. In the event of a data breach that affects your personal information, we will notify you and relevant regulatory authorities as required by applicable law.

10. Children's Privacy

Our Website and services are not directed to, and we do not knowingly collect personal information from, individuals under 18 years of age. All purchasers must confirm they are at least 18 years old. If we become aware that we have inadvertently collected personal information from a minor, we will delete it promptly. If you believe a minor has submitted personal information to us, please contact us immediately at privacy@orcatechbio.com.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or operational needs. When we make material changes, we will notify you by updating the “Last Updated” date at the top of this policy and, where appropriate, by email notification to registered account holders or by a prominent notice on our Website.

Your continued use of our Website or services following notice of material changes constitutes your acceptance of the updated Privacy Policy. We encourage you to review this policy periodically.

12. Contact and Data Requests

For privacy inquiries, data access requests, or to exercise any of your rights under applicable law, please contact us through any of the following channels:

• Website: orcatechbio.com/contact/
• Email: privacy@orcatechbio.com
• Mail: Orcatech Bio-Peptides, Privacy Department, United States

We will acknowledge your request promptly and respond within the timeframe required by applicable law. Where required, we may ask you to verify your identity before processing your request.