Privacy

The German version of this page is legally authoritative.

1. Controller

The controller for data processing on this website within the meaning of the General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) and the Cypriot data protection law (Law 125(I)/2018) is THALION LTD, Neofytou Nikolaidi & Theodorou Kolokotroni, Onisiforou Center, 2nd floor, Agios Theodoros, 8011 Paphos, Cyprus, registered with the Registrar of Companies and Intellectual Property, Nicosia, under company registration number HE 498421. The shop is operated under the brand GPeptides. E-mail: support@gpeptides.net.

2. What data we process

When visiting the website: server log data (IP address, time, page accessed) for technical provision and security. When ordering or using the account: name, email, delivery and billing data, order history. Contact form: the data you provide. Legal bases: Art. 6(1)(b) GDPR (contract), (f) (legitimate interest in security) and (c) (legal obligations, e.g. retention).

3. Cookies & local storage

We use technically necessary cookies and local storage required to operate the shop: for the login session, your cart, your language choice, a partner code and your cookie decision. Under applicable EU data protection and ePrivacy rules (ePrivacy Directive 2002/58/EC as implemented in Cyprus, Law 112(I)/2004) no consent is required for such technically necessary storage. We use Google Analytics and Google Ads conversion measurement only if you give your consent in the cookie banner. There you can choose ‘Decline’ (neither service), ‘Statistics only’ (Google Analytics only) or ‘Accept all’ (Google Analytics and Google Ads conversion measurement); declining is as easy as accepting. Without your consent, no analytics or advertising cookies are set. Details are set out in sections 4 and 5.

Name	Purpose	Duration
PHPSESSID	Login session / cart assignment (technically necessary)	Session
gp_cart	Stores your cart in the browser (localStorage)	until cleared
gp_lang	Remembers your language choice (localStorage + cookie)	until cleared
gp_creator	Assigns a discount/partner code (localStorage)	until cleared
_ga, _ga_Z9601QSL5S	Statistical analysis of website usage with Google Analytics (only after your consent)	up to 2 years
_gcl_au, _gcl_aw	Google Ads conversion measurement: whether clicks on our adverts lead to a purchase (only after your consent via ‘Accept all’)	up to 90 days
gp_conv_…	Prevents a purchase from being reported twice (localStorage, only after consent)	until cleared
gp_consent	Stores your cookie decision (localStorage, technically necessary)	until cleared

4. Web analytics with Google Analytics

This website uses Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

We use it for statistical analysis of website usage to improve our website. Data processed: pages visited, time spent on a page, device and browser type, approximate location (country/city level) and the referring page. Once Stripe has confirmed payment for an order, a purchase event (‘purchase’) is also sent, with order value, currency and a pseudonymous order reference (payment session ID).

Legal basis: your consent under Art. 6(1)(a) GDPR; for storing and reading information on your device, your consent under Art. 5(3) of the ePrivacy Directive 2002/58/EC as implemented in Cyprus (Law 112(I)/2004) and, for visitors in Germany, § 25(1) TDDDG.

Google Analytics is loaded only after you choose ‘Statistics only’ or ‘Accept all’ in the cookie banner. Without consent, no Analytics script is loaded and no Analytics cookie is set. You can withdraw your consent at any time, with future effect, using the ‘Cookie settings’ link in the footer of every page.

After consent, the cookies _ga and _ga_Z9601QSL5S are set; their lifetime is up to 2 years. Google Analytics 4 does not log or store IP addresses. Advertising features, Google signals and ad personalisation are not used in Google Analytics; Google Ads conversion measurement is described in section 5.

Data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023, Art. 45 GDPR).

Analytics event data is deleted after 14 months at the latest. Further information: Google Privacy Policy.

5. Google Ads conversion measurement

This website uses Google Ads conversion measurement (conversion ID AW-18469069081), provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The controller is THALION LTD (section 1).

Purpose: to measure whether clicks on our Google ads lead to purchases, and so to evaluate the effectiveness of our adverts. We do not use remarketing, personalised advertising, enhanced conversions (no email addresses, phone numbers or hashed customer data are sent) or Google signals.

After your consent, the first-party cookies _gcl_au and _gcl_aw may be set on our domain for up to 90 days. If you reach our website via one of our Google ads, these cookies store the click ID (gclid) that Google adds to the page address. Once Stripe has confirmed payment, the order confirmation page sends the conversion ‘Kauf’ (purchase) to Google with order value, currency and a pseudonymous order reference (payment session ID). Google also processes technical data such as IP address, browser/device information and time of access. We only see aggregated reports (number and value of conversions), which do not identify individuals.

Legal basis: your consent under Art. 6(1)(a) GDPR; for storing and reading information on your device, your consent under Art. 5(3) ePrivacy Directive 2002/58/EC as implemented in Cyprus (Law 112(I)/2004) and, for visitors in Germany, § 25(1) TDDDG. Google partly acts as an independent controller (Google Ads Controller-Controller Data Protection Terms).

Conversion measurement is loaded only after you choose ‘Accept all’ in the cookie banner (not with ‘Decline’ or ‘Statistics only’). You can withdraw your consent at any time, with future effect, by opening ‘Cookie settings’ in the footer of every page and choosing ‘Statistics only’ or ‘Decline’. Data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission of 10 July 2023, Art. 45 GDPR).

6. Payment provider

We use Stripe (Stripe Payments Europe, Ltd.) for payment processing. The data required for payment is transmitted to Stripe. Stripe's privacy policy applies in addition.

7. Hosting

This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. On our behalf, STRATO processes the data generated on the web server when the website is visited and used, in particular the server log data listed in section 2 (Art. 6(1)(f) GDPR, legitimate interest in the secure and stable operation of the website), the account and order data required to run the shop (Art. 6(1)(b) and (c) GDPR) and the information submitted via the contact form, the online withdrawal form and partner applications. For this, STRATO uses further sub-processors, including IONOS SE, Montabaur (Germany), to operate the platform and servers and, by default, SiteLock, LLC, Scottsdale (USA), to detect and remove malware; the transfer to the USA is based on EU standard contractual clauses (Art. 46(2)(c) GDPR). The shop's emails (e.g. order and shipping confirmations) are also sent via STRATO's mail servers. A data processing agreement under Art. 28 GDPR is in place with STRATO.

8. Storage period

We store personal data only as long as necessary for the stated purposes or as required by statutory retention periods (e.g. commercial and tax law).

9. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to lodge a complaint with the competent data protection authority. In Cyprus this is the Office of the Commissioner for Personal Data Protection.

10. Contact

For privacy requests: support@gpeptides.net

Last updated: September 2026