Privacy policy
Last updated: 24 August 2026
This policy explains what personal data Alphex Limited collects, why we hold it, how long we keep it, who processes it for us, and what you can do about it. It covers alphex.co.uk and everything we do with data that comes from it.
1. Who controls your data
The controller is Alphex Limited, a company registered in England and Wales, company number 16674899, registered office 28 Links Road, West Wickham, BR4 0QW, United Kingdom. For any privacy question, or to exercise any right described here, email lewis@alphex.co.uk.
We are not required to appoint a Data Protection Officer and have not appointed one. Enquiries go to the address above.
2. What we collect
| Category | What it includes |
|---|---|
| Contact details | Name, email, billing address, delivery address, phone number |
| Order and payment | What you bought, order value, delivery method, payment confirmation and the last four digits of a card. We never see or store full card numbers. |
| Account details | Username, password (stored hashed by Shopify), saved addresses, preferences |
| Researcher confirmation | The confirmation you give at checkout that you are 18 or over and a qualified researcher, tied to the order |
| Verification material | Anything you send us when we check an order: institutional affiliation, purchase order, correspondence |
| Correspondence | Emails, contact form messages, back-in-stock requests, support history |
| Device and usage | IP address, browser and device type, pages viewed, referring site, a first-party session identifier |
We collect it directly from you, automatically as you use the site, and from our service providers (payment processors confirming a payment, carriers confirming delivery).
We do not collect special category data, we do not buy personal data from brokers, and we do not knowingly collect data from anyone under 18. Our products cannot lawfully be sold to them.
3. Why we process it, and on what basis
| What we do | Lawful basis (UK GDPR Article 6) |
|---|---|
| Take and fulfil your order, take payment, deliver, handle returns | Contract, Article 6(1)(b) |
| Record your researcher and age confirmation | Legal obligation and legitimate interests, 6(1)(c) and (f): we must be able to show we supply for research use only |
| Verify age, identity, affiliation or intended use where an order needs checking | Legitimate interests, 6(1)(f): supplying restricted materials responsibly |
| Screen orders against sanctions and restricted party lists | Legal obligation, 6(1)(c) |
| Keep accounting and tax records | Legal obligation, 6(1)(c) |
| Send marketing email and the back-in-stock alerts you asked for | Consent, 6(1)(a). Withdraw any time via the unsubscribe link or by emailing us |
| Measure how the site is used and how visitors arrive | Consent for the storage and reading of the identifier, then legitimate interests for the analysis, 6(1)(f) |
| Detect and prevent fraud | Legitimate interests, 6(1)(f) |
| Defend legal claims and deal with complaints | Legitimate interests, 6(1)(f) |
Where we rely on legitimate interests you may object, and we will stop unless we have compelling grounds to continue. Where we rely on consent you may withdraw it at any time, and withdrawing does not affect anything done before you withdrew.
We do not use your data for automated decision-making that produces legal or similarly significant effects, and we do not profile you in a way that does.
4. Cookies and similar technologies
Storage that is not strictly necessary is set only where you have consented, through the cookie banner on this site.
| What | Purpose | Lifetime | Category |
|---|---|---|---|
| Shopify store and checkout cookies | Keeping your cart, session and checkout working, and fraud prevention | Session to 2 years | Strictly necessary |
ax_sid, plus a matching entry in your browser's session storage |
A first-party identifier we generate so we can join a visit to an order and see which campaigns and pages lead to sales. Sent to a service we run ourselves on Cloudflare. It is not sold, and not shared for anyone else's advertising. | 30 days | Analytics, consent needed |
| GoAffPro | Attributing an order to the affiliate who referred it | 7 days | Functional and marketing, consent needed |
| Omnisend | Email marketing, back-in-stock alerts, abandoned cart reminders | Varies, see Omnisend | Marketing, consent needed |
| TikTok pixel, and other advertising pixels where we run campaigns | Measuring advertising and building audiences | Varies by platform | Marketing, consent needed |
You can change your choice at any time through the cookie preferences control on this site, and you can block or delete cookies in your browser. Blocking strictly necessary cookies will stop the cart and checkout working.
5. Who we share it with
We do not sell your personal data, and we do not share it for anyone else's independent marketing.
| Who | What for |
|---|---|
| Shopify | Store, checkout and hosting |
| Payment providers | Taking payment and preventing fraud. They are controllers in their own right for that part |
| Royal Mail | Delivery. A carrier is a controller in its own right for the delivery data |
| Omnisend | Email marketing and back-in-stock alerts |
| GoAffPro | Affiliate attribution |
| Cloudflare | The first-party analytics service we run |
| Our accountants | Statutory accounts and tax |
Each acts on our written instructions as a processor, except where noted above. We may also disclose data where the law requires it, to establish or defend legal claims, or to a buyer if the business is sold.
6. International transfers
Some of our providers process data outside the UK. Where personal data leaves the UK we rely on a recognised safeguard: an adequacy decision covering the destination, or the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses. You can ask us which applies to a given provider.
7. How long we keep it
| Record | Kept for |
|---|---|
| Order, payment and delivery records, and the researcher confirmation attached to them | 7 years from the end of the accounting period, as tax law requires |
| Customer account details | While the account is open, then 12 months |
| Marketing and back-in-stock subscriptions | Until you unsubscribe, then a suppression record so we do not email you again |
| Verification material for an order we checked | 2 years from the order |
Site analytics tied to ax_sid
|
Aggregated after 14 months; the raw identifier is not retained beyond that |
| Emails and support correspondence | 3 years from the last message |
8. Your rights
You have the right to be informed, and rights of access, rectification, erasure, restriction, portability and objection, including the right to object to direct marketing at any time. You also have the right to withdraw consent where we rely on it.
Tell us at lewis@alphex.co.uk and we will respond within one month. There is no charge. We may ask for enough information to be sure of your identity.
Some rights are qualified. We cannot delete an order record we are required to keep for tax, for example, but we can restrict what else it is used for.
9. How to complain
If you are not satisfied with how we have handled your data, you can complain to the UK supervisory authority:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint
Please raise it with us first if you can, so that we have the chance to put it right.
10. Security and breaches
We keep personal data on services that encrypt it in transit and at rest, and we limit access to the people who need it. Payment card details are handled by our payment providers and are never stored on our systems. If a breach is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours and tell you where the risk is high.
11. Changes to this policy
We may update this policy to reflect changes in what we do or what the law requires. The date above shows when it last changed, and we will give notice where the law requires it.