This notice covers two different things. Sections 2 and 3 concern your own data as a customer, where we are the controller — that is the part that applies to everyone. Sections 4 to 6 set out the processing terms that apply only to trade accounts, where we ship to your customers on your behalf; in that arrangement you are the controller and we act as your processor. Those sections form part of our terms and should be read alongside them.
1.1Zenic Labs is a United Kingdom supplier of research compounds. Our website is zeniclabs.co.uk and we can be contacted at hello@zeniclabs.co.uk.
1.2This notice explains how we handle personal data under the UK General Data Protection Regulation and the Data Protection Act 2018. It covers two distinct relationships: data about you as a customer, where we are the controller, and — where you hold a trade account and we dispatch to your customers on your behalf — data about those customers, in which case you are the controller and we are your processor. If you hold an ordinary account and buy for your own research use, only the first of those applies to you.
2.1When you open an ordinary account we collect your email address, and the delivery address and contact details you give us when you order. Business name, website address and details of your intended sales are collected only where you apply for a trade account.
2.2When you trade with us we hold your order history, delivery addresses, correspondence, labelling artwork and payment records.
2.3We use this to assess your application, operate your account, fulfil orders, provide support, meet our legal and accounting obligations, and — where a compliance issue arises — to evidence what was reviewed and when.
2.4Our lawful bases are performance of a contract with you, compliance with legal obligations, and our legitimate interests in operating and protecting the business. Where we rely on legitimate interests you may object, and we will consider that objection on its merits.
2.5We keep a record of application decisions, including declined applications and the reason, for two years. This is a legitimate interest: it lets us apply consistent standards and explain a decision if challenged.
3.1As set out in our terms, we review the public websites and marketing of trade accounts periodically. That review looks at published business content, not at personal data, and we collect only what is necessary to record the outcome — typically the date, the page, and any issue identified. It does not apply to ordinary accounts.
3.2Where we ask for access to a restricted area of your site, we use that access only to review how products are presented and for no other purpose.
3.3Our lawful basis is legitimate interest: ensuring products supplied by us are presented lawfully protects us, our other trade customers, and the public.
4.1Where you hold a trade account and place a dropship order, you supply us with the name and delivery address of your customer, and sometimes their contact details for carrier purposes. In respect of that data you are the data controller and we act as processor on your documented instruction. This section, together with section 14 of our terms, forms the processing agreement required by Article 28 UK GDPR.
4.2Subject matter and duration: fulfilment and delivery of the order you place, for as long as necessary to complete it and handle any delivery enquiry.
4.3Nature and purpose: receiving the delivery details, labelling and packing the order, and passing address details to the carrier.
4.4Types of data and categories of data subject: name, delivery address, and where provided email address or telephone number, relating to your retail customers. We do not ask for and do not want any special category data.
4.5We will process end-customer data only on your documented instructions, unless required otherwise by law, in which case we will tell you unless legally prevented from doing so.
4.6We will not use end-customer data for our own marketing, will not contact your customers other than where necessary to deliver the order, and will not sell, rent or disclose it to any party other than the carrier.
5.1We ensure that anyone authorised to process end-customer data is subject to a duty of confidentiality.
5.2We apply appropriate technical and organisational measures to protect the data, taking account of the risk to the individuals concerned.
5.3We will not engage another processor without informing you. We currently use a delivery carrier and an email service provider, both of which are necessary to fulfil orders, and we remain liable to you for their acts and omissions in relation to your data.
5.4Taking account of the nature of the processing, we will assist you in responding to requests from individuals exercising their rights, and in meeting your obligations in relation to security, breach notification and data protection impact assessments.
5.5We will notify you without undue delay on becoming aware of a personal data breach affecting end-customer data you have supplied to us.
5.6On termination of the trading relationship we will delete end-customer data, save where we are required to retain it by law or where it forms part of a transaction record we must keep for accounting purposes.
5.7We will make available the information reasonably necessary to demonstrate compliance with these obligations, and will allow for and contribute to audits on reasonable notice.
6.1You warrant that you have a lawful basis for collecting your customers' personal data and for passing it to us, and that your own privacy notice tells them their data may be shared with a fulfilment provider.
6.2You are responsible for responding to requests from your own customers in relation to their data. We will assist where the request concerns data you have supplied to us.
6.3You must not supply us with more personal data than is necessary to deliver the order, and must not supply special category data.
7.1Order and transaction records are retained for six years from the end of the relevant accounting period, as required by UK tax law.
7.2End-customer delivery details supplied for dropship orders are retained only as long as necessary to fulfil the order and resolve any delivery enquiry, after which they are removed from active systems. Where they appear within a retained transaction record, they are held only as part of that record.
7.3Application records, including declined applications, are retained for two years.
7.4Correspondence is retained for as long as necessary to deal with the matter and for a reasonable period afterwards.
8.1Delivery carriers, in order to deliver orders.
8.2Our email service provider, which handles transactional and account correspondence.
8.3Our payment providers, which handle bank and cryptocurrency transactions. We do not receive or store card details.
8.4Our accountant and professional advisers, where necessary.
8.5Law enforcement or regulators, where we are legally required to disclose.
8.6We do not sell personal data and we do not share it for third-party marketing.
9.1Some of our service providers process data outside the United Kingdom. Where that happens, transfers are made under UK adequacy regulations or an International Data Transfer Agreement or Addendum, so that the data receives an equivalent standard of protection.
10.1Access to trade customer and end-customer data is restricted to those who need it to operate the business. Systems are protected by access controls and credentials are not shared.
10.2No system is entirely secure. Where a breach occurs that is likely to result in a risk to individuals, we will notify the Information Commissioner's Office within 72 hours of becoming aware, and will notify affected controllers and individuals as required.
11.1In respect of data where we are the controller — that is, your own trade account data — you have the right to access it, to have inaccurate data corrected, to request erasure, to restrict or object to processing, and to data portability where applicable.
11.2Where you are the controller and we are your processor, requests from your customers should be directed to you. We will assist you in responding.
11.3To exercise any right, contact hello@zeniclabs.co.uk. We respond within one month.
11.4If you are unhappy with how we have handled your data you may complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would ask that you raise it with us first so we have the chance to put it right.
12.1We use only cookies necessary for the website to function. We do not use advertising or third-party tracking cookies.
12.2You can block or delete cookies through your browser settings, though parts of the site may not work correctly if you do.
13.1We may update this notice. The version published at the time governs. Where a change materially affects how we process end-customer data on your behalf, we will tell you.