Privacy Policy

This policy explains what personal data Richmond Biolabs collects when you visit this website, buy from us or get in touch, what we do with it, and what rights you have over it. We are a small laboratory supplier, not an advertising business — we collect what an order needs and little else.

Last updated: 29 September 2026

1. Who we are

Richmond Health & Biolabs LTD is the data controller for the personal data described here. We are registered in England and Wales under company number 17365208.

For anything to do with your data — a question, a request, a complaint — email [email protected], marking it “Data Protection”. We do not have a statutory obligation to appoint a Data Protection Officer and have not appointed one; enquiries are handled by our management.

We process personal data in accordance with the UK GDPR and the Data Protection Act 2018.

2. What this policy covers

It covers this website and the orders, accounts and enquiries that run through it. It does not cover other websites we link to — including literature databases, carrier tracking pages and payment providers’ own pages — which have their own policies and which we do not control.

3. The data we collect

When you place an order or create an account: your name, billing and delivery address, email address, telephone or mobile number, the organisation or institution you give us, your order history, and the confirmations you make at checkout, including your acknowledgement that the products are for research use only.

Payment data: we do not see or store your full card number. Card payments are handled by our payment provider on a PCI-DSS compliant gateway, and we receive only a confirmation, the last digits of the card and the transaction reference. For bank transfers we see the account name and reference that reaches our bank. For cryptocurrency payments we hold the transaction hash and the wallet address the payment came from.

When you contact us: your name, email address, organisation, any order or product reference you quote, the subject you choose and whatever you write in your message, plus our replies.

When you browse: your IP address, the pages you look at, the currency you select, what is in your basket, and basic technical information about your browser and device. Some of this sits in cookies — see section 6.

We do not ask for and do not want health data, and you should not send us any. If you tell us about a medical condition in an enquiry we will not act on it, and we will delete it when the enquiry is closed. We do not knowingly collect data from anyone under 18; this site is not intended for them.

4. Why we use it, and our lawful basis

• To take and fulfil your order — processing payment, dispatching goods, arranging carriage, sending order and tracking updates by email and SMS, and handling returns. Lawful basis: performance of a contract with you.
• To run your account and let you see your order history. Lawful basis: performance of a contract.
• To answer enquiries and provide support, including technical and documentation questions. Lawful basis: performance of a contract, or our legitimate interest in responding to people who contact us.
• To keep accounting, tax and sales records, and to respond to regulators or law enforcement where we are required to. Lawful basis: compliance with a legal obligation.
• To prevent fraud and misuse, to check that orders are genuine, and to enforce the research-use and age restrictions in our terms. Lawful basis: our legitimate interest in protecting the business and in supplying our products responsibly.
• To keep the site secure and working, including server logs, spam filtering on our contact form, and diagnosing faults. Lawful basis: our legitimate interest in a secure, functioning website.
• To send marketing about restocks, batch releases and offers, where you have asked for it or are an existing customer buying similar products. Lawful basis: consent, or our legitimate interest in marketing to existing customers.

Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and you can object at any time — see section 9.

5. Marketing

We only send marketing email to people who have opted in, or who have bought from us and have not opted out. Every message carries an unsubscribe link, and you can also stop it by emailing us. Unsubscribing from marketing does not stop transactional messages about an order you have placed — those are part of fulfilling the contract.

We do not sell, rent or otherwise make your details available to third parties for their own marketing.

6. Cookies and similar technologies

We use a small number of cookies and browser storage entries, and no advertising or cross-site tracking cookies.

• Strictly necessary — shopping basket and session cookies set by WooCommerce, the login cookie that keeps you signed in, a cookie remembering which currency you have selected, and security tokens that protect forms against cross-site request forgery. These are needed for the site to work and are set without consent, as the law permits.
• Local storage — your acknowledgement of the entry notice confirming you are 18 or over is stored in your browser so that you are not asked on every page. It stays in your browser and is not sent to us.

You can block or delete cookies in your browser settings, but the basket, checkout and login will not work properly without the necessary ones. If we later add analytics or marketing cookies, we will ask for your consent first and update this policy.

7. Who we share it with

We share personal data only where we need to, and only with organisations that are bound to keep it confidential and to use it on our instructions:

• Carriers — DHL, UPS, Deutsche Post and Royal Mail receive the recipient’s name, address, and contact details for delivery notifications.
• Payment providers — our card gateway and our bank, who process your payment under their own terms and as controllers in their own right for fraud prevention and regulatory purposes.
• Our hosting and IT providers, who host this website and our email and therefore store data on our behalf.
• Our accountants and professional advisers, where there is a proper need.
• Government, regulators, law enforcement and customs authorities, where we are legally obliged to disclose, or where disclosure is needed to establish or defend legal claims. For international shipments, the recipient’s details appear on the customs documentation that accompanies the parcel.
• A buyer or successor, if the business is sold or reorganised.

Fonts on this website are served by Google Fonts, which means your IP address is disclosed to Google when a page loads. That is a technical consequence of requesting the font file; no cookie is set by it.

8. Where your data is held, and for how long

Our website and systems are hosted within the United Kingdom and the European Economic Area. Where a provider processes data outside the UK, we rely on UK adequacy regulations or on the International Data Transfer Agreement or Addendum, so that your data keeps an equivalent level of protection.

We keep:

• order, payment and accounting records for 6 years after the end of the financial year they relate to, which is the period HMRC requires;
• account details for as long as your account is open, and for 6 years after your last order;
• enquiries and support correspondence for 2 years after the matter is closed;
• marketing consents and opt-outs for as long as we need to honour them;
• server and security logs for up to 12 months.

After that we delete the data or anonymise it so that it can no longer identify you.

9. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• ask us to delete data where we no longer have a reason to keep it;
• ask us to restrict how we use it while a dispute is resolved;
• object to processing we carry out on the basis of legitimate interests, and to object to direct marketing at any time, which we will always honour;
• receive data you gave us in a portable, machine-readable form, where we hold it on the basis of consent or contract;
• withdraw consent at any time, where consent is what we rely on. That does not affect anything done beforehand.

Email [email protected] to exercise any of these. We will respond within one month, and will tell you if we need longer because the request is complex. There is no charge unless a request is manifestly unfounded or excessive. We may ask you to confirm your identity before we release data.

Some rights are qualified — for example we cannot delete an invoice we are legally obliged to retain. If we cannot do what you ask, we will explain why.

10. How we protect your data

The site is served over HTTPS, access to our systems is restricted to the people who need it and protected by strong authentication, card details never reach our servers, and our hosting is kept patched. No transmission over the internet is completely secure, and we cannot guarantee absolute security, but we will notify you and the ICO where the law requires it if a breach occurs that is likely to affect you.

11. Automated decision-making

We do not make decisions about you by automated means that produce legal or similarly significant effects. Payments may be screened for fraud by our payment provider’s automated systems; if a payment is declined that way, you can contact us and we will review it.

12. Complaints

If you are unhappy with how we have handled your data, please tell us first — most things are quickest to fix directly. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

13. Changes to this policy

We may update this policy as our business or the law changes. The current version is always the one on this page, and the date at the top tells you when it last changed. If a change materially affects how we use your data, we will tell you directly.