Privacy policy

Last updated: 1 October 2026

1. Who we are

This Privacy Policy explains how Thistle BioLabs (“we”, “us”, “our”) collects, uses and protects your personal information when you use this website or place an order.

Thistle BioLabs is a trading name of a UK sole trader, who is the data controller for the personal data described here. Our trading name and postal address are published on our Legal & contact page. For any privacy question or request, email support@thistlebiolabs.co.uk.

2. Information we collect

Information you provide

• Name, email address, phone number (if given) and delivery address
• Order details
• Your research-use declaration: organisation or trading name, research application, any description you add, and the time you completed it
• Identity or verification information, if we ask for it before dispatching an order
• Messages you send us by email, the contact form or Telegram

Technical information

• IP address, browser type and device information
• Website usage data, collected through cookies and analytics tools where you have allowed them

We do not ask for, and you should not send us, medical or health information.

3. How we use your information

• To process, review and deliver orders
• To check that orders meet our research-use terms and to keep records of that check
• To respond to enquiries and provide support
• To keep accounting and tax records
• To operate, secure and improve the website
• To send you marketing emails, only if you have opted in; you can unsubscribe at any time

4. Lawful basis (UK GDPR)

• Contract – to process and deliver your order
• Legal obligation – to keep accounting records and meet other legal duties
• Legitimate interests – to review orders against our research-use terms, prevent misuse and fraud, and run our business
• Consent – for marketing emails and non-essential cookies

5. Who we share it with

• Our e-commerce platform (Shopify) and website hosting providers
• Payment providers, such as Fena for bank payments
• Delivery providers, such as Royal Mail
• Email and analytics providers, where used
• Legal or regulatory authorities, where required by law

Some providers may process data outside the UK. Where they do, we rely on the safeguards they provide under UK data protection law. We do not sell or rent your personal data.

6. How long we keep it

• Order, payment and declaration records: six years, to meet accounting and legal obligations
• Identity or verification documents: deleted once the check is complete, unless needed for a dispute or legal reason
• Support messages: up to two years
• Marketing preferences: until you unsubscribe

7. Security

We use reasonable technical and organisational measures to protect your personal data. No system can be guaranteed completely secure.

8. Your rights

You have the right to access, correct or delete your personal data, to object to or restrict certain processing, to data portability, and to withdraw consent at any time. To make a request, email support@thistlebiolabs.co.uk.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ico.org.uk).

9. Cookies

We use essential cookies to run the shop and, with your permission, analytics cookies. You can change your choice at any time using the cookie settings link in the footer.

10. Third-party services

If you contact us through Telegram, Telegram’s own privacy policy also applies to that conversation. Orders are only placed through our website checkout.

11. Changes to this policy

We may update this policy. The date at the top shows when it was last changed.