Bank payments are temporarily pausedWe apologise for the inconvenience. Crypto payments are working as normal, and bank transfer will be back shortly.Laboratory research only. Not for human consumption.
The short version: we collect what we need to take your order and deliver it, we email you about our own products until you tell us to stop, we count page views in a way that cannot identify you, and we do not sell your data to anybody. Sections 1 to 13 apply to everyone. Sections 14 to 17 apply only to trade accounts, where we ship to your customers on your behalf.
1.1Zenic Labs Ltd is a United Kingdom supplier of research compounds, registered in England and Wales with company number 17495907. Our registered office is 2a Connaught Avenue, London, E4 7AA. Our website is zeniclabs.co.uk and we can be contacted at hello@zeniclabs.co.uk. For the personal data described in this notice, Zenic Labs Ltd is the data controller.
1.2This notice explains how we handle personal data under the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003. Sections 1 to 13 apply to everyone who uses this site or buys from us. Sections 14 to 17 apply only if you hold a trade account and we dispatch to your customers on your behalf.
1.3If anything here is unclear, or you think we have got something wrong, email us. We would rather answer it properly than quote the policy back at you.
2.1When you create an account we collect your email address, the name you give us, and a password, which is stored only as a cryptographic hash that we cannot reverse or read.
2.2When you place an order we collect your delivery address, your contact details, what you bought, and a record of payment. We do not receive or store card numbers. Where you pay by bank transfer we see the payment reference and the account name shown on it; where you pay in cryptocurrency we see the wallet transaction.
2.3If you apply for a trade account we also collect your business name, website address and details of how you intend to sell, so that a person can assess the application.
2.4If you message us on WhatsApp — including through the chat button on this site — we receive your phone number, the name on your WhatsApp profile and whatever you send us. We use it only to answer you and to deal with your order, and we don't add your number to any marketing list.
2.5If you write to us we keep the correspondence. If you send us labelling artwork we keep that too, so repeat orders can be labelled without asking you for it again.
2.6We do not ask for and do not want special category data — anything about health, biometrics, beliefs or sex life. Please do not send it to us. Nothing we sell is for human use, and we have no reason to hold health information about anybody.
3.1To operate your account, take payment, fulfil and deliver orders and answer support enquiries. Our lawful basis is performance of a contract with you.
3.2To meet our legal and accounting obligations, including keeping transaction records for the period UK tax law requires. Our lawful basis is compliance with a legal obligation.
3.3To assess trade applications, keep the site secure, prevent fraud and misuse, evidence what was reviewed and when if a compliance question arises, and to market our own similar products to existing customers as described in section 4. Our lawful basis is our legitimate interests in operating and protecting the business.
3.4Where we rely on legitimate interests you have the right to object, and we will consider that objection on its merits. Where the objection is to marketing we simply stop — there is no balancing exercise for that one.
3.5We keep a record of trade application decisions, including declined applications and the reason, for two years, so we can apply consistent standards and explain a decision if it is challenged.
4.1When you create an account your email address is added to our mailing list — the sign-up form tells you so, and how to opt out — and we may send you occasional email about our own products, stock and dispatch changes.
4.2We do this under the soft opt-in at regulation 22 of PECR: we obtained your details in the course of a sale or negotiations for a sale, we market only our own similar products, and every marketing message carries a one-click unsubscribe. Our lawful basis under UK GDPR is legitimate interests.
4.3You can unsubscribe from any message, or by emailing us, and we act on it immediately. Unsubscribing removes you from marketing only — you will still get the email needed to run your order: confirmation, dispatch, and replies to anything you ask us.
4.4After an order is dispatched we may send one email inviting you to review what you bought. You are never obliged to, and unsubscribing from marketing stops these as well.
4.5We do not sell, rent or share your email address with anyone for their own marketing, and we never will.
5.1If you leave a review, the display name you choose and the text you write are published on this website where anyone can read them. Choose a name you are comfortable being public — it does not have to be your full name.
5.2Every review is read by a person before it appears. We publish genuine reviews including critical ones. We do not write reviews ourselves, invent reviewers, or pay for them, and we do not publish a review under a name the reviewer did not give us.
5.3The “verified purchase” label is applied automatically by checking whether the account leaving the review has a dispatched order containing that compound. That check looks only at your own order history, and it decides nothing beyond how the review is labelled.
5.4Where a customer sends a review to us by email and asks us to publish it, we add it under the name they give and label it in the same way as any other. We do not add a review unless we have been asked to.
5.5You can have your review amended or removed at any time by emailing us, and we will not ask you to justify why.
6.1We use cookies that are strictly necessary to run the site, principally to keep you signed in once you log in. These are exempt from the consent requirement in PECR, because the service you asked for cannot work without them.
6.2We also store a small amount of information in your own browser: the contents of your basket, and whether you have dismissed a site notice. That information stays on your device, is not transmitted to us, and exists only so the site does not forget what you were doing. You can clear it at any time through your browser settings.
6.3We use Vercel Web Analytics to count page views and see which pages get used. It sets no cookies, stores nothing on your device, does not follow you across other websites and does not identify you. Because of that it requires no consent under PECR — which is why this site does not put a cookie banner in front of you before you can read it.
6.4We do not use advertising cookies, remarketing pixels, session recording or any third-party tracking. There is no Meta pixel, no Google Ads tag and no cross-site advertising identifier anywhere on this website.
7.1Supabase, which provides the database and sign-in system holding accounts, orders and reviews.
7.2Vercel, which hosts this website and provides the aggregated analytics described above.
7.3Resend, which sends our transactional and marketing email.
7.4Royal Mail, and any other carrier we use, which receives the name and delivery address needed to deliver your order.
7.5Our payment providers: Wallid, for Pay by Bank (Open Banking) payments, which receives your email address and the payment amount and order reference, and your bank's confirmation of the payment; NOWPayments, for cryptocurrency payments; and our bank, for transfers.
7.6WhatsApp (operated by WhatsApp Ireland Ltd, part of Meta), which carries any messages you choose to send us on WhatsApp. WhatsApp processes that data under its own terms and privacy policy as well as ours.
7.7Our accountant and professional advisers where necessary, and law enforcement or a regulator where we are legally required to disclose.
7.8Each of these is engaged under a written contract that permits them to use the data only to provide their service to us. We do not sell personal data and we do not share it for anyone else's marketing.
8.1Some of the providers named above are based outside the United Kingdom, principally in the United States, and personal data may be processed there.
8.2Where that happens, the transfer is made under UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework where the provider is certified under it, or the UK International Data Transfer Agreement or Addendum — so the data keeps a standard of protection equivalent to the one it has here.
8.3You can ask us which mechanism applies to a particular provider and we will tell you.
9.1Order and transaction records are kept for six years from the end of the relevant accounting period, because UK tax law requires it. This is the one thing we cannot delete on request while that period is running, and we would rather say so than pretend otherwise.
9.2Account details are kept while your account is open. Close your account and we delete it, other than anything caught by the accounting period above.
9.3Published reviews are kept until you ask us to remove them.
9.4Marketing contact details are kept until you unsubscribe, after which we keep the minimum record needed to make sure we do not email you again.
9.5Trade application records, including declined applications, are kept for two years. Correspondence is kept for as long as needed to deal with the matter and a reasonable period afterwards.
10.1Passwords are stored only as hashes. Access to customer data is restricted to those who need it to run the business, systems are protected by access controls, and credentials are not shared.
10.2No system is entirely secure. Where a breach occurs that is likely to result in a risk to people's rights, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and tell the people affected where the law requires it.
11.1You have the right to be told what we hold about you and to get a copy of it, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to data portability, and to object to direct marketing at any time.
11.2To exercise any of these, email hello@zeniclabs.co.uk. We respond within one month and we do not charge for it. We may ask you to confirm your identity first, so that we are not handing your data to somebody else.
11.3If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. You do not need our permission to do that, but we would rather you raised it with us first so we have the chance to put it right.
12.1This website and everything on it is intended for people aged 18 or over. Our products are supplied for laboratory research use only and are not for human consumption.
12.2We do not knowingly collect data about anyone under 18. If you believe a child has given us personal data, tell us and we will delete it.
13.1We do not make decisions about you by solely automated means that produce legal effects or similarly significantly affect you. Trade applications are read by a person.
13.2The only automated decision on this site is the verified purchase label on reviews, described in section 5, which affects nothing other than how a review is labelled.
14.1This section and the three that follow apply only to trade accounts. If you hold an ordinary account and buy for your own research use, none of them apply to you.
14.2As set out in our terms, we review the public websites and marketing of trade accounts periodically. That review looks at published business content, not at personal data, and we record only what is necessary — typically the date, the page, and any issue identified.
14.3Where we ask for access to a restricted area of your site, we use that access only to review how products are presented and for no other purpose.
14.4Our lawful basis is legitimate interest: making sure products supplied by us are presented lawfully protects us, our other trade customers, and the public.
15.1Where you hold a trade account and place a dropship order, you supply us with the name and delivery address of your customer, and sometimes their contact details for carrier purposes. In respect of that data you are the controller and we act as your processor on your documented instruction. This section, together with section 14 of our terms, forms the processing agreement required by Article 28 UK GDPR.
15.2Subject matter and duration: fulfilment and delivery of the order you place, for as long as necessary to complete it and handle any delivery enquiry.
15.3Nature and purpose: receiving the delivery details, labelling and packing the order, and passing address details to the carrier.
15.4Types of data and categories of data subject: name, delivery address, and where provided email address or telephone number, relating to your retail customers. We do not ask for and do not want any special category data.
15.5We will process end-customer data only on your documented instructions unless required otherwise by law, in which case we will tell you unless legally prevented from doing so.
15.6We will not use end-customer data for our own marketing, will not add your customers to our mailing list, will not contact them other than where necessary to deliver the order, and will not disclose it to any party other than the carrier.
16.1We ensure that anyone authorised to process end-customer data is subject to a duty of confidentiality.
16.2We apply appropriate technical and organisational measures to protect the data, taking account of the risk to the individuals concerned.
16.3We will not engage another processor without informing you. We currently use the providers named in section 7, and we remain liable to you for their acts and omissions in relation to your data.
16.4Taking account of the nature of the processing, we will assist you in responding to requests from individuals exercising their rights, and in meeting your obligations in relation to security, breach notification and data protection impact assessments.
16.5We will notify you without undue delay on becoming aware of a personal data breach affecting end-customer data you have supplied to us.
16.6On termination of the trading relationship we will delete end-customer data, except where we are required to retain it by law or where it forms part of a transaction record we must keep for accounting purposes.
16.7We will make available the information reasonably necessary to demonstrate compliance with these obligations, and will allow for and contribute to audits on reasonable notice.
17.1You warrant that you have a lawful basis for collecting your customers' personal data and for passing it to us, and that your own privacy notice tells them their data may be shared with a fulfilment provider.
17.2You are responsible for responding to requests from your own customers about their data. We will assist where the request concerns data you have supplied to us.
17.3You must not supply us with more personal data than is necessary to deliver the order, and must not supply special category data.
18.1We may update this notice. The version published at the time governs, and the date it was last changed is shown at the top of this page.
18.2Where a change materially affects how we use your data, or how we process end-customer data on your behalf, we will tell you rather than quietly republish.