Privacy policy
Version 11 of 6 Nov 2026
Privacy Policy
This version applies to the English-language website. The Polish version is the original; all language versions have the same content.
1. Controller and contact
Armin Wincek, trading as Taurus Peptides, ul. Warszawska 40/2A, 40-008 Katowice, Poland, NIP 9542909711, REGON 544930367 ("we").
Data protection enquiries: support@taurus-peptides.com or by post to the above address.
2. Legal bases
Art. 6(1) GDPR: (a) (consent), (b) (contract and pre-contractual steps), (c) (legal obligation), (f) (legitimate interests).
3. Processing in detail
3.1 Visiting the website and security
We process IP address, date and time, requested address, referrer, browser and device identifier (user agent) and status codes. The website is provided via a delivery and security service provider that protects it against attacks and abuse. Purpose and legitimate interest: provision, stability and security of the Shop. Legal basis: Art. 6(1)(f) GDPR. Retention: server logs 14 days; at the service provider according to its own rules.
3.2 Bot protection for forms
For forms such as sign-in, waitlist and checkout, this service provider checks technical characteristics of your browser and your IP address to confirm that the input comes from a human. Legal basis: Art. 6(1)(f) GDPR (protection against automated abuse). Retention: we do not store the result of the check.
3.3 Access confirmation and RUO declaration
On your first visit you confirm that you are of age and have a research purpose and select your field of research. When ordering you make an RUO declaration. We store time, type of declaration, text version, field of research, language, a hash of your IP address and user agent and, for orders, the link to the order. Purpose and legitimate interest: proof that we sell only to adults and only for research purposes. Legal basis: Art. 6(1)(f) GDPR and, where required by law, (c). Retention: for orders as for order data (3.4), otherwise 12 months.
3.4 Orders and performance of the contract
We process name, e-mail address, delivery and billing address, telephone number (optional), company and VAT ID where applicable, pickup point, order contents, prices, payment and shipping status, your messages, withdrawals and complaints, and voucher and partner codes. Purpose: conclusion and performance of the purchase contract, customer service, invoicing, accounting and tax, withdrawals and complaints, batch recalls. Legal bases: Art. 6(1)(b) GDPR; (c) (accounting and tax obligations); (f) (legitimate interest in defending against claims and preventing abuse). Retention: invoices and accounting records 5 years from the end of the calendar year in which the deadline for paying the tax expired (Art. 86 and Art. 70(1) of the Polish Tax Ordinance). We pseudonymise other order data after 60 months: name, address, telephone and e-mail are removed.
3.5 Payment
Depending on the payment method, we pass amount, currency, order number, name, e-mail and, for some providers, the IP address for fraud prevention to the payment service provider.
- Bank transfer: we retrieve incoming payments on our business account via an account information service (payer's name and account, amount, reference, booking date) and match them to the order.
- Card: you pay on the card payment service provider's page, which shows its name and privacy information. Card data are received only by that provider and the card schemes.
- Cryptocurrency: via BTCPay Server, operated by us or by a hosting provider on our behalf. Payment goes directly to our wallet, without a payment service provider. Transactions remain permanently visible on the public blockchain.
- Cash on delivery: the carrier collects the amount and the shipping intermediary pays it out to us.
Payment service providers partly process data as independent controllers (e.g. for anti-money-laundering purposes). Legal bases: Art. 6(1)(b), (c) and (f) GDPR. We delete raw payment notification data after 180 days; payment records are kept like invoices.
3.6 Shipping and pickup point
For shipping we pass name, delivery address or parcel locker, e-mail address, phone number if given and parcel weight to a shipping intermediary and the carrier so that they can deliver the parcel and notify you. If you choose the pickup point on the map, the shipping intermediary's map service is loaded in a separate frame and receives your IP address and technical browser data. You can also enter the pickup point manually. Legal basis: Art. 6(1)(b) GDPR. Retention: as for order data.
3.7 Customer account
We store e-mail address, language, currency, saved addresses, orders and sign-in times. You sign in via a link sent by e-mail; we do not store a password. With the optional sign-in with Google, we receive from Google your e-mail address, confirmation that it is verified and a Google identifier; Google learns that you are signing in to our Shop. Legal basis: Art. 6(1)(b) GDPR. Retention: until the account is deleted. Accounts without activity for 24 months and without an open order are anonymised automatically. In your account you can download your data as a file and delete the account.
3.8 Waitlist
After you confirm by e-mail, we store your e-mail address and the product to inform you when it is available again. Legal basis: Art. 6(1)(a) GDPR. You can unsubscribe at any time via the link in every e-mail. Retention: until you unsubscribe, at most 12 months from confirmation or from the last notification.
3.9 Contact
If you write to us, we process your details to handle your enquiry. Legal basis: Art. 6(1)(b) GDPR where related to an order, otherwise (f) (handling your enquiry). Retention: until the matter is resolved, for order-related matters as for order data. We keep copies of e-mails we send for 90 days. We do not collect health data. Please do not send us information about your health; we delete such information unless we are legally required to keep it.
3.10 Audience measurement and partner attribution
We measure ourselves, without third parties and without cookies, which pages and products are viewed and from which source visitors arrive. We store page views, cart and purchase events, source, referrer (domain and path only), country (derived from the IP address), a hash of the IP address and a daily identifier derived from IP address and user agent. The key for this exists only in memory and is generated anew every day. We do not build profiles across several days or other websites. Orders are attributed to partners by their code, which you enter at checkout. Partners receive only aggregate figures and anonymised order data. Legal basis: Art. 6(1)(f) GDPR. Legitimate interest: data-minimised in-house audience measurement and correct accounting of the partner programme. Retention: events 90 days, clicks and daily identifiers 13 months; the attribution recorded with an order (partner, source) as for order data.
3.11 Partner programme (for partners)
We process name, e-mail, address, company and VAT ID where applicable (checked via the European Commission's VIES system), bank details (encrypted), sign-in data including two-factor settings, codes, click and commission data and statements. Legal bases: Art. 6(1)(b) GDPR; (c) (tax and accounting obligations); (f) (legitimate interest in abuse prevention, e.g. detecting self-referrals). Retention: duration of the partnership, statements as for invoices (3.4).
3.12 Error monitoring
We send technical error reports to an error monitoring service provider. We remove e-mail addresses, IP addresses, bank details and access tokens beforehand and do not send user or request data. Legal basis: Art. 6(1)(f) GDPR (error detection). Retention: 30 days.
3.13 Backups
We back up the database and product images in encrypted form with a storage service provider (storage location in the EU). Legal basis: Art. 6(1)(c) and (f) GDPR (Art. 32 GDPR). Backups are overwritten after at most 35 days; deleted or anonymised data disappear from the backups at the latest then.
4. Cookies
| Name | Purpose | Duration |
|---|---|---|
| __Host-tauvon_sid | session: cart, sign-in, security | from last activity: guests 7 days (at most 30), customer account 30 days (at most 90) |
| __Host-tauvon_ml | securing the sign-in link | duration of the sign-in |
| locale | language | 1 year |
| tauvon_cur | currency (only after you choose one) | 90 days |
| ruo_gate | access confirmation (age, research purpose) | 30 days |
| __cf_bm, cf_clearance | bot and abuse protection | up to 30 minutes or as set by the service provider |
We set only strictly necessary cookies (Art. 399 of the Polish Electronic Communications Law, in Germany § 25(2) TDDDG). Consent is therefore not required.
5. Recipients
We share data only to the extent necessary for the purposes stated. Processors are bound by contract under Art. 28 GDPR. Categories of recipients:
- hosting (data centre in the EU)
- hosting of the crypto payment server (only for payment by cryptocurrency)
- website delivery and security, including bot protection
- storage service provider for backups
- e-mail sending and mailbox
- error monitoring
- shipping intermediaries and carriers (carriers as independent controllers)
- payment service providers and banks (partly as independent controllers)
- account information service for payment matching
- sign-in service, only if you choose sign-in with Google
- European Commission (VIES, partners only)
- accounting firm
- authorities and courts where we are legally required
On request we will tell you the specific recipients.
6. Transfers to third countries
Some service providers are based in the USA or belong to companies based in the USA (delivery and security, backups, error monitoring, sign-in with Google). We base transfers on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR). You can obtain a copy on request at support@taurus-peptides.com.
7. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). You can withdraw consent at any time with effect for the future; processing carried out before withdrawal remains lawful.
Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation. You can object to processing for direct marketing at any time without giving reasons. A message to support@taurus-peptides.com is sufficient.
You can lodge a complaint with a supervisory authority, in particular the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, www.uodo.gov.pl) or the supervisory authority in the member state of your place of residence.
8. Obligation to provide data, automated decisions
Providing the data marked as mandatory in the order form is necessary to conclude the contract; without it we cannot carry out the order. All other information is voluntary.
We do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22 GDPR). We check orders according to fixed rules (e.g. payment discrepancies, self-referrals via partner codes, uncollected cash-on-delivery parcels); conspicuous cases are reviewed by a human. Protection against non-payment with cash on delivery: we count uncollected cash-on-delivery parcels and orders not paid within the payment period. From currently 3 such orders within 30 days with the same e-mail address or the same customer account, cash on delivery is no longer available; other payment methods remain available. We compare phone number, delivery address and a hash of the IP address only to flag conspicuous orders for review by a human. Legal basis: Art. 6(1)(f) GDPR (protection against non-payment and misuse). You can request a review.