08 — Privacy

What we hold, and for how long.

This site sells to laboratories, so it collects what a laboratory purchase needs and nothing beside it: what you ordered, who to invoice, and where the box goes. There are no analytics, no advertising tags and no third-party trackers anywhere on it — your basket is written to your own browser and stays there until you confirm an order.

Last updated

19 August 2026

Written against the General Data Protection Regulation and the Bundesdatenschutzgesetz. Where the two differ, the stricter reading is the one we work to.

Who is responsible

The controller is
GpharmaBio itself.

Nothing on this site is collected on behalf of anyone else. The company that synthesises the material, raises the invoice and packs the box is the same company that decides what is held and why, which is what makes it the controller under Art. 4(7) GDPR. Write to the address below and it reaches the people who can actually act on it.

Gpharma Laboratories GmbH

Gpharma Laboratories

BioTech Park, Freiburg

Engesserstraße, 4a-4b

79108, Breisgau

Germany

Data protection enquiries: Sales@GpharmaLab.com
Telephone: +49 40 797172-0
Register entry: Amtsgericht Freiburg · HRB 712486
Responsible officer: Dr. H. Reinhardt, Geschäftsführer

Mark data protection correspondence for the attention of the managing director. We are not required to appoint a designated data protection officer at our size and have not appointed one; the enquiries above are answered by the office rather than by an unread mailbox.

Surface by surface

Everything this site collects, and what it is for.

Six things, listed in the order you would meet them. Each one says what it is, the lawful basis we hold it on, where it physically sits and when it goes.

Your basket, before you confirm it

What it is: The pens and catalogue lines you have added, the box counts, the currency you have picked, and the name, telephone number and delivery address you have typed at the checkout.
Why we may hold it: No basis is needed, because we do not have it. It is written to your own browser under three keys beginning gpharmabio., and nothing about it is sent anywhere while you are still deciding.
Where it sits: Your browser only. Clearing your site data removes it, and it is not readable by us or by anyone else.
How long it is kept: Until you clear it or empty the basket.

The order you confirm

What it is: The order reference, the lines and their prices, the totals and carriage, the currency you are settling in, and your name, telephone number and postal address.
Why we may hold it: Performance of a contract and the steps taken before entering one — Art. 6(1)(b) GDPR. We cannot raise a proforma invoice without a name to invoice, a number to call about it and somewhere to send the parcel.
Where it sits: One record in our order table, hosted in the EU by Netlify. It is reachable at a link carrying a 128-bit token, which is issued to you and to GpharmaBio and to nobody else.
How long it is kept: Ten years from the end of the year the invoice was raised in, which is what §257 HGB and §147 AO require of an invoice. Orders that never become invoices are cleared by GpharmaBio.

A card payment against your invoice

What it is: That the invoice was settled, when, the amount captured and its currency, and the identifier of the Stripe checkout it was settled at. Not the card — no card number, expiry, security code or cardholder name reaches this site or our record at any point.
Why we may hold it: Performance of a contract — Art. 6(1)(b) GDPR — and, for the record of the payment itself, the legal obligation to keep books under Art. 6(1)(c). Whatever Stripe collects on its own checkout page it holds as its own controller, under its own notice.
Where it sits: The card details are entered on a page hosted by Stripe and are held by Stripe. What sits in our order table beside the document is the fact of the payment, its amount and its Stripe reference.
How long it is kept: With the invoice, for the same ten years §257 HGB and §147 AO require of it. Stripe keeps its own record on its own terms.

The message you send on WhatsApp

What it is: Whatever the confirmation message carries — the reference, the lines, the totals and the delivery block — together with your WhatsApp number and profile name.
Why we may hold it: Consent, in the plainest form there is: the message is composed in front of you and you press send. Art. 6(1)(a) GDPR.
Where it sits: Your device and ours, and WhatsApp Ireland Ltd. in between. Message contents are end-to-end encrypted; the fact that you messaged us is not.
How long it is kept: On the GpharmaBio handset for as long as the order is live. The invoice record is the copy we keep.

A certificate request from the contact page

What it is: Your name, email address, organisation, the lot number you are asking about and your message.
Why we may hold it: Answering a question you asked us — pre-contractual steps under Art. 6(1)(b), or our legitimate interest in replying to correspondence under Art. 6(1)(f).
Where it sits: Netlify Forms, and the mailbox the analytics laboratory answers from.
How long it is kept: Twelve months, after which the submission is deleted. A certificate is published on its product page in any case, so the request itself has no further use.

The GpharmaBio session

What it is: One signed cookie, gpb_admin, set when a member of staff enters the GpharmaBio passcode.
Why we may hold it: Strictly necessary to operate GpharmaBio — it is what keeps order documents from being open to the internet. It is set for staff only and never for a customer.
Where it sits: The staff browser. It is httpOnly and signed, holds no personal data of yours, and identifies nobody.
How long it is kept: Twelve hours, then it expires.

Server logs

What it is: The ordinary record any web server keeps of a request: IP address, time, the path asked for, and the browser string.
Why we may hold it: Our legitimate interest in serving the site and seeing that it is not being attacked — Art. 6(1)(f) GDPR.
Where it sits: Netlify, as our hosting processor.
How long it is kept: A short retention set by the platform, measured in days rather than months. We do not export them or join them to anything else.

Cookies and tracking

There is no
cookie banner
because there is
nothing to consent to.

A banner is required where a site reads or writes something that is not strictly necessary — §25 TTDSG in Germany. This one does not. Your basket is stored in your own browser so that it survives a reload, which is the function you asked for by putting something in it, and the only cookie the site ever sets is GpharmaBio's own session.

Not present on any page

No analytics — no Google Analytics, no page-view counter, no heatmap or session recorder.
No advertising or remarketing tags, and no conversion pixels of any kind.
No social embeds, no chat widget, no comment system.
No profiling and no automated decision-making under Art. 22 GDPR.
No selling, renting or sharing of anything held here with a third party for their own purposes.
No newsletter list. We write back about your enquiry and nothing else.

One thing that is

The typefaces are requested from Google Fonts rather than served from our own host, so loading a page tells Google's font servers your IP address and which browser asked. No cookie is set by it and nothing identifies you by name, but it is a third party your browser contacts and we would rather say so here than leave you to find it in the source. It is on the list to be brought in-house.

Who else sees it

Four recipients, each of them necessary.

An order cannot be delivered without a carrier or booked without an accountant, so these are the parties an order passes through. No other party receives anything from an order, and none of them receives it for their own purposes.

Netlify

Hosting, forms and the order table

The site, the order endpoints and the order record all run on Netlify. The database sits in the European Union. Netlify is a processor under a data processing agreement and does not use anything held here for its own purposes.

Stripe

Card payments

Where an invoice is settled by card, the checkout is hosted by Stripe Payments Europe, Ltd. and the card details are entered there rather than here. Stripe is told the invoice number, the amount due and the currency, and it tells us the invoice has been paid; it is its own controller for what it collects on that page, including whatever it needs for fraud screening and for the card scheme. This site holds no card details at any stage, and there is nothing to settle by card unless you choose that route.

WhatsApp Ireland Ltd.

The order channel

Orders are confirmed over WhatsApp, so a message you send reaches us through Meta’s infrastructure under their own terms. If you would rather not use it, GpharmaBio will take the same order by email or telephone and nothing is lost by doing so.

The carrier

Delivery

The name, address and telephone number on the order go on the consignment note, because that is what a parcel is delivered against. Nothing about what is in the box beyond its customs description travels with it.

Our bank and our accountants

Settlement and statutory books

An invoice and its payment are entered in the books, and the books are seen by our accountants and, on request, by the tax authority. This is a legal obligation under Art. 6(1)(c) GDPR rather than a choice we make.

Transfers outside the EEA

The order table sits in the European Union and stays there. Two of our processors are US-headquartered, so a transfer can occur in the course of support or operations; those are covered by the European Commission's standard contractual clauses and, where the processor is certified, by the EU–US Data Privacy Framework. A parcel to an address outside the EEA necessarily carries that address to the carrier and to the receiving customs authority — that is Art. 49(1)(b), a transfer necessary to perform the contract you asked us to perform.

How it is protected

The site is served over TLS throughout. Order documents are reachable only at a link carrying a 128-bit token, which is neither guessable nor indexed; GpharmaBio's own view of them is behind a passcode and a signed, httpOnly session cookie, and every endpoint checks that session for itself rather than trusting the page in front of it. Certificates are published data and carry their own security code, which is a check on the document rather than on you.

Your rights

Ask, and we
answer in a month.

Write to the office at Sales@GpharmaLab.com with the order reference if there is one. We answer within one month, free of charge, and we will ask you to confirm who you are before we send anything — an order record posted to whoever asked for it would be the breach, not the service.

Write to the office

Access: A copy of everything we hold about you, and confirmation of what it is used for — Art. 15.
Rectification: Correction of anything wrong. An address typed in error is the common one, and GpharmaBio can change it on a proforma up to the point the parcel is picked — Art. 16.
Erasure: Deletion, except where an invoice has to be kept for the statutory retention period — Art. 17.
Restriction: A hold on processing while a correction or an objection is being resolved — Art. 18.
Portability: The order record in a machine-readable form — Art. 20.
Objection: An objection to anything we do on the legitimate-interests basis — Art. 21.
Withdrawal: Consent withdrawn at any time, with no effect on what was done before you withdrew it — Art. 7(3).

Complaints

You may complain to a supervisory authority at any time, without going through us first. Ours is the Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg, in Stuttgart. You may also complain to the authority where you live or work.

Changes to this policy

Dated, and
not backdated.

If what we collect changes, this page changes with it and the date at the top moves. We do not rewrite it quietly: where a change affects an order already placed, GpharmaBio writes to the address on that order rather than relying on you to re-read a page. The wording here describes the site as it stands on 19 August 2026 — the surfaces listed above are the whole of it, and if you find something collecting anything else, tell the office and it is a fault to be fixed.

For laboratory research use only. Not a drug, food or cosmetic. Not for human or veterinary consumption, diagnostic or therapeutic use.