Legal
Privacy Policy
Last updated: 17 October 2026
Who we are
WorldwideBioResearch Ltd (company number 17362128), registered office 124 to 128 City Road, London, EC1V 2NX, United Kingdom, is the controller of the personal data described in this policy. Our registration with the Information Commissioner’s Office (ICO) is in progress. The registration number will be published here once it is confirmed.
You can contact us about anything in this policy at support@worldwidebioresearch.com.
Everything we sell is for laboratory research only. It is not for human consumption and not for veterinary use, and our customers are researchers and businesses. This policy explains what personal data we collect from you in that context, why, who we share it with, and what your rights are.
Age
Our products and services are for adults. When you register you tell us where you are based, the United States, an EU country or Australia, and give your date of birth. You must be 21 or over if you are based in the United States, and 18 or over if you are based in an EU country or in Australia. Whatever region you registered under, an order delivered to a United States address can only be placed by an account holder who is 21 or over, which we check against the date of birth on your account when the order is placed.
We do not knowingly hold data about anyone below these ages. If you believe we have, contact us and we will delete it.
What we collect and why
Account and registration. To open an account we collect your first and last name, email address, a password (stored only in a scrambled form we cannot read), your date of birth, where you are based (the United States, an EU country or Australia), your industry, your professional position, whether you are purchasing as an individual researcher, an academic institution, a company or a laboratory, the intended use (in vitro or laboratory research), and, if you give it, the name of your company or institution. If you enter a Partner Program code or arrive through a partner’s link, we record that code. Before you can order you sign our Registration Agreement, and we keep a record of that: the version of the agreement, the date and time, the IP address and browser (user agent) you signed from, and the signature you drew or typed. If we update the agreement, we ask you to confirm the new version once at your next checkout and record that confirmation the same way. Once your email address is confirmed we email you a copy of the agreement, including a PDF attachment of the signed document showing your signature, the date and time you signed, the IP address you signed from, and the region and age you confirmed. You can download that same PDF at any time from My Account under Account Settings; it is generated for your own account only and is never shared with anyone else. We also copy to your account the shop region you chose on this device and, if you confirmed your age and research-use purpose when you first visited, the region, the wording you confirmed and the date and time you confirmed it, with the IP address your registration came from, so you are not asked again. We use all of this to run your account, to apply the age rule above, to check you are a qualified researcher, and to evidence the terms you agreed to (contract, legal obligation and legitimate interests). Each agreement, confirmation and order confirmation is also written to a tamper-evident compliance record, in which every entry is linked to the one before it so that none can be changed or removed unnoticed; we keep it for as long as we keep the account and order records it relates to, to show our products are sold for research use only and to meet our obligations to payment providers (legal obligation and legitimate interests).
Orders and delivery. When you order we record your name, email address, phone number, billing address, a separate delivery address if you give one, the country of delivery, what you bought, the amounts, the payment method, the time you confirmed the order terms, and the status of the order through to dispatch and delivery, including the carrier and tracking number. We use this to fulfil the order, send you order and shipping emails, and keep the records the law requires (contract and legal obligation). You can also save a delivery address and a billing address in My Account so they are filled in for you at checkout; we keep them until you change or remove them or close your account, and each order keeps its own copy of the address it was sent to (contract).
Research-use confirmation and order review. Each order carries your confirmation that it is for laboratory research use only and that you meet the age for the delivery country. We store it with the order: the wording you confirmed, the time, your account, the IP address and browser (user agent) the order was placed from, and the version of our terms in force. If you leave a delivery note we keep it with the order. Our systems check the note and the delivery details for language suggesting personal, human or animal use, and look for unusual quantities sent to one address, and flag such orders for a member of staff to review before dispatch; nothing is decided automatically. We keep these records with the order for as long as we keep the order, to show our products are sold for research use only, to answer card disputes and to meet our obligations to payment providers (legal obligation and legitimate interests).
Cryptocurrency payments. If you pay in cryptocurrency, our payment provider generates a payment address for your order. We send the provider only the order number and the amount, never your name, email or address, and we record the payment address, the transaction reference and the amount received (contract and legal obligation).
Card payments. If you pay by card, the payment is taken on the hosted page of our card payment provider, PayZentric. Basalt is the merchant of record for card payments: it is the party that sells you the payment transaction, its name (BasaltHQ) is what appears on your card statement and on the separate receipt you are sent, and any card dispute or chargeback is handled by Basalt under its own process rather than by us. Contact us first and we will help you resolve it. To open that page we send PayZentric your order number, the currency, the items and prices on the order, the amount due, your email address, first and last name, phone number, and billing address (address line, city, state or county, postcode and country), plus the address of the page to return you to. You enter your card number on PayZentric’s page and it never reaches us. We receive back a payment reference, the payment status, the amount and currency, a transaction reference and, if the payment fails, a failure code and reason. PayZentric is based in the United States and may run automated fraud checks on a payment, which can include asking you to confirm your name and address, and which may decline the payment. Those checks are carried out by PayZentric under its own privacy policy (contract and legal obligation). We also note, against your order, when you reached each step of a card checkout (our secure-checkout step shown, the payment page opened, your return to our site), with the time, so we can see where card checkouts stop and improve them (legitimate interests).
Card payments by MGPay. Card payments may instead be taken on the hosted checkout page of MGPay, a card payment gateway, opened in a separate window on a computer, or in place of our checkout page on a phone; your bank statement then shows PAY-ZEN. To open that page our server sends MGPay your order number, a short product name and description, the quantity, the amount due, your first and last name, email address, phone number with country code, billing address (address line, city, state or county, postcode and country) and the IP address of the device you are ordering from, plus the addresses of the pages to return you to. You enter your card details on MGPay’s page and they never reach us. MGPay sends us back the payment result: a payment reference, the amount and currency, the status and response code, the card brand, the last four digits and expiry of the card, the card’s country, an authorisation code, and the name, email and phone number given on its page; we keep the reference, amount, response, card brand, last four digits and authorisation code with your order. MGPay’s page also offers to save your card with MGPay for future purchases: if you leave that ticked, MGPay keeps the card and may show it to you, with your name, the next time you pay us by card; we never receive or store it. MGPay may decline a payment on its own fraud and risk checks, including against its list of blocked cards and customers, under its own privacy policy (contract and legal obligation).
Bank transfers. If you pay by bank transfer, you send the money from your own bank to our business account with Revolut (Revolut Ltd and its group companies), using local account details for your region (an IBAN for the European Union, a US routing and account number, or an Australian BSB and account number), in your region’s currency, with your order number as the payment reference. We do not send Revolut anything about you. When the money arrives, Revolut gives us what your bank sent with it: the amount and currency, the date, the reference you entered, and the sender’s name as your bank passed it on. We use them to match the payment to your order, to deal with a payment that is short, over or unmatched, and to return money where needed, and we keep them with the order for the same period as other payment records (contract and legal obligation). While a bank transfer order is unpaid we email you the bank details when you order, and reminders on the second and fourth day; the reminders follow the same switch as the saved-cart reminders. An unpaid order expires after five days.
Zelle. If you pay by Zelle (offered for US deliveries only), you send the money from your own US bank to the Zelle recipient we show you after you order, with your order number as the memo. Our bank shows us the amount, the date, the memo and the sender’s name of each payment we receive, and we check them against your order by hand. We keep them with the order for the same period as other payment records (contract and legal obligation). The items in a Zelle order are held for you until it is paid or its payment window ends. While it is unpaid we email you the Zelle details when you order and one reminder, which follows the same switch as the saved-cart reminders; if the window ends without payment the order is cancelled and we email you to say so.
Crypto paid to our own address. When our crypto payment provider is unavailable, you may pay in crypto straight to a wallet address of ours shown after you order. We keep the coin, network, address, amount and the transaction id you give us with the order, and check the transaction on the public blockchain by hand. Blockchain transactions are public by design. We keep these with the order for the same period as other payment records (contract and legal obligation). The items are held for you for 48 hours, or until you tell us you have paid.
Cash App. If you pay by Cash App (offered for US deliveries only), you send the money from your own Cash App account to the $cashtag we show you after you order, with your order number as the note. Cash App shows us the amount, the date, the note and the sender’s $cashtag and name of each payment we receive, and we check them against your order by hand. We keep them with the order for the same period as other payment records (contract and legal obligation). As with Zelle, the items are held for you until the order is paid or its payment window ends, we email you the payment details when you order and one reminder, and if the window ends without payment the order is cancelled and we email you to say so.
Store credit and refunds. If an order is refunded we record the amount as store credit on your account, when it expires, and how it is later used (contract).
Emails and preferences. We send transactional emails about your account, orders, deliveries and any deletion request; these have no switch. If you leave an unpaid checkout we may send you a reminder with a link to your saved cart, 24 hours and 72 hours after the order was started (legitimate interests); every reminder carries a one-click link that switches them off, and that link is the way to stop them (there is no switch in My Account). We only send stock alerts if you ask for them (consent). Research updates are described in the next paragraph. Stock alerts and research updates can each be switched off in My Account or with the link in the email.
Research updates and new arrivals. A checkbox reading “Send me research updates and new arrivals” appears when you register, when you join the waitlist, in the welcome announcement on our home page (until you have chosen research updates) and at checkout. Whether it starts ticked depends on where you are. At registration it starts ticked if you choose the United States and unticked if you choose a country in the European Union or Australia. On the waitlist it starts ticked if you have chosen the United States on our region picker, and unticked if you have chosen the European Union or Australia or have not chosen a region yet. Anywhere we do not yet know where you are, it starts unticked. At checkout it starts ticked in every region. For customers in the European Union and Australia that is a soft opt-in: you are buying from us, we would only write about similar products, and the line under the box says you can untick it or unsubscribe from any email. We record your choice only if the box is ticked when you submit the form, and we store where you gave it (registration, waitlist, welcome announcement, checkout, checkout soft opt-in, or My Account) and the date and time you did. We keep it until you tell us to stop, which you can do in My Account or with the unsubscribe link in any email we send. Leaving the box unticked never cancels a choice you made earlier. When a new compound or strength goes on sale in your region, research updates may include an email announcing it; it goes only to account holders who chose research updates and whose account is registered in that region, and when it is sent we keep a short record of it (the announcement, the time, our email provider’s message reference and a shortened form of your address such as j•••@gmail.com), which is deleted with your account. Research updates also include a monthly email, Research notes, sent on the first Tuesday of the month to account holders who chose research updates (customers and partners alike, in every region), listing the articles we have published and the certificates of analysis we have added since the last one; we keep the same short record of each send, deleted with your account. Every research update and every waitlist email carries an unsubscribe link that works in one click without signing in, and your email program’s own Unsubscribe button does the same. Using it turns research updates off, removes your address from the waitlist and from any list for a region we have not opened yet, and we keep the date and time you unsubscribed and how (the link or your email program’s button) on the record of your choice, so we can show we respected it. We rely on your consent, except for the soft opt-in at checkout in the European Union and Australia, where we rely on legitimate interests (our interest in telling existing customers about similar products).
Shop announcements in the United States. Occasionally we email every account holder whose account is registered in the United States about a change to how they can buy from us, such as a new way to pay, together with the offers that go with it (for example our first-order discount), even if they have not chosen research updates. These emails carry the same one-click unsubscribe, and once you have unsubscribed or switched research updates off you do not receive them. We keep the same short record of each send (the announcement, the time, our email provider’s message reference and a shortened form of your address), deleted with your account. We rely on legitimate interests (telling customers in the United States how they can buy from us). Accounts outside the United States never receive them.
Partner Program. If you apply, we collect your preferred code, where you plan to share your link, any social media accounts or website you choose to give us (TikTok, Instagram, YouTube, X, Telegram, website), and later the wallet address you want commissions paid to and, if your tier lets you choose, the payout method (asset and network) it is on. That address and the transaction reference of each payout are public on the blockchain it is paid on. We record which accounts registered or ordered using your code, clicks on your link, and your commission and payout history (contract). Partners can see how many researchers are connected to their code and, for each commission, a masked reference such as R-7F3A2C, the order date, the order subtotal and the commission earned. Partners never see a customer’s name, email address or delivery address. When you accept the Partner Program Terms, at application or on your dashboard after the terms change, we record which version you accepted, when, and the IP address it came from, as evidence of the agreement (contract). If we invite you to the Program, the invitation records the name we addressed it to and the rates offered, and, once used, which account used it.
Partner profile. An approved partner can add a display name, a profile photo and a short bio in the partner dashboard. The photo is resized and stored with our database provider at a public web address, so it can be shown without a sign-in; the display name and bio are stored with the partner record. Today they appear only in the partner’s own dashboard. We plan to show them on a partner leaderboard visible to other partners; we will update this policy when that launches. A partner can change or remove them at any time in the dashboard, and the photo is deleted with the account (contract).
If you are a customer and you enter a partner code, or register through a partner’s link, that partner is saved to your account and their code is applied to every order by default. You can remove it at any time in My Account under Account Settings, or at checkout. When you follow a partner link we record the click with a scrambled (hashed) version of your IP address and your browser’s user agent string, so we can tell real clicks from automated ones, and, if you are outside the EU, the EEA, the UK and Switzerland or you choose “Accept all” in our cookie banner, we set the wbr_ref cookie described below for 30 days so the code is still there if you register later (legitimate interests, or your consent where we ask for it). Without the cookie the partner still gets the referral: the link puts their code in the registration form, and you can enter a code at registration or checkout.
Welcome offer and first-order discounts. The welcome offer (15% off your first order) applies automatically. When we announce it on our home page we record that you were shown it and how you closed it, with the date and time, so it is shown only once. If you have not already chosen research updates, that announcement also carries the optional “Send me research updates and new arrivals” box, ticked if you are based in the United States and unticked in the European Union and Australia; we record your choice only if the box is ticked when you press Shop, with the place (welcome popup) and time. A first-order discount (the welcome offer or a partner code’s first-order rate) can go to at most two accounts per household. To apply that limit, when you place an order we keep a normalised form of its delivery address and phone number with the order and compare it with earlier paid orders from other accounts. If it matches paid orders from two other accounts, the order is priced as a reorder and a note is kept on it for our staff. We use your address and phone number this way only to apply the limit, not to contact you (legitimate interests: preventing the same discount being claimed repeatedly).
Waitlist and stock alerts. If you join the registration waitlist we keep your email address and where you told us you are based (the United States, the European Union, Australia, Canada or other) only to tell you when registration opens for you: we email you when it does and, if you have not registered a week later, send one reminder, then delete the address. If you arrived through a partner’s referral link, we also keep that partner’s code with your signup and apply it if you register with the same email address and do not enter a code yourself. If the box for research updates and new arrivals is ticked when you join (see Research updates and new arrivals above), or you choose them from the link in one of those emails, we keep your email address for that purpose instead, with where and when you agreed, until you tell us to stop (consent). If you ask to be told when a compound is available or back in stock we keep your email address, the compound and the region you asked about, and delete the alert once it has been sent or when you remove it (consent). When we send that email we keep a short record of it (the product, region and time, our email provider’s message reference and a shortened form of your address such as j•••@gmail.com) so we can check it was delivered; it is deleted with your account.
Contact form. If you use our contact form we collect your name, your email address, the topic you choose, an order number if you give one, your message and, if you attach one, a photo. If you are signed in we also note your account, and the order list you choose from shows only your own orders. We email your message to our support inbox and send you a copy, and keep it in our admin area with the date, whether it has been dealt with, and whether it was flagged because its wording suggested personal or animal use, so we can reply, deal with any follow-up and keep our products to research use. A photo is resized and re-saved before it is kept, which removes the information a camera stores in the file (including its location); it is attached to the email to our support inbox and stored privately with our database provider, where only our staff can open it. To stop the form being misused we count the messages sent from each email address and each network in the last hour; for this we store a scrambled code made from your IP address, not the address itself. We keep messages and photos for as long as we need them to deal with your request and any follow-up, and delete them sooner if you ask (legitimate interests, and contract where the message is about an order).
Regions we have not opened yet. We currently sell to the United States, the European Union and Australia. Where a region picker shows a country we have not opened yet (currently Canada and the United Kingdom), you can leave your email address to be told when we do. We keep that address and the region you asked about (for example “ca”), and we use it only to tell you when we open there, after which we delete it. The same optional box for research updates and new arrivals applies; it starts unticked there, and a tick is recorded with where and when you gave it and kept until you tell us to stop (consent). Leaving your email is never required to use the site, and the form is protected by the same bot check as the waitlist form.
Orders placed through our Telegram channel. If you order through our Telegram channel we collect the name, delivery address and Telegram username needed to fulfil the order, and handle them under this same policy. Messages you send on Telegram are also subject to Telegram’s own privacy policy.
Security and site operation. We keep the server logs our hosting provider produces, and the records needed to keep the site secure: one-time sign-in codes and backup codes for staff accounts, the result of the bot check on the waitlist, region-interest and contact forms, and records of failed sign-in attempts (legitimate interests).
Who we share data with
We do not sell personal data. We share it only with the service providers we need to run the business, each of which processes it on our instructions under a written contract, and with authorities where the law requires:
Hosting: our website runs on Vercel, which also holds the server logs. Our server’s requests to our card payment providers, PayZentric and MGPay, are sent through a relay server we rent from LunaNode, so that they come from one fixed address. They stay encrypted end to end on the way: the relay cannot read them and keeps only a log of when it connected to PayZentric or MGPay.
Analytics: Vercel Web Analytics counts visits and page views so we can see which pages are used. It sets no cookies and stores nothing on your device. It records the page address, the referring site, your country (worked out from your IP address, which is not stored), and your browser, operating system and device type. Visits are told apart by a scrambled value that changes every day, so you cannot be followed from one day to the next (legitimate interests).
Database and sign-in: your account, orders, Partner Program records and sign-in are stored with Supabase.
Email delivery: every email we send goes through Resend.
Cryptocurrency payments: payment addresses and transaction confirmations are provided by BlockBee, which receives only the order number and amount. Crypto paid to our own address involves no third party; the coin amount for Bitcoin and Ether is worked out from CoinGecko’s public price, which receives nothing about you or your order.
Bitcoin payments through BTCPay Server: the payment page, addresses and confirmations are provided by the BTCPay Server instance we use, which receives only the order number and amount.
Card payments: card payments are processed by PayZentric on its hosted payment page, which receives the order and billing details listed above and collects your card details directly. Basalt is the merchant of record for those payments and handles card disputes and chargebacks. Card payments may instead be processed by MGPay on its hosted checkout page, as described above.
Bank transfers: received into our Revolut Business account. Revolut provides us with the payment details listed above and processes them under its own privacy policy as a regulated financial institution.
Zelle: payments are sent through the Zelle network (Early Warning Services, LLC) from your bank into our US bank account. Zelle and the banks involved process the payment under their own privacy policies; we send them nothing about you.
Cash App: payments are sent through Cash App (Block, Inc.) from your Cash App account into ours. Cash App processes the payment under its own privacy policy; we send it nothing about you.
Bot protection: the registration waitlist form, the coming-soon region form and the contact form use Cloudflare Turnstile, which processes your IP address and browser details to tell people from automated traffic, under Cloudflare’s privacy policy.
Delivery: your name, delivery address and phone number are passed to the people who pack your order and to the carrier that ships it from the warehouse in your region (for example USPS, UPS or DHL in the US, Correos, SEUR or GLS in Europe, Australia Post or Sendle in Australia). For orders delivered in the US and Australia this goes through our fulfilment software provider and warehouse staff. Orders delivered in the European Union are packed by our European fulfilment partner from their own stock: the order number, the items, your name, delivery address and phone number, and whether you added shipping protection are sent to them by our bot in a private Telegram group, so those details also pass through Telegram’s service. Your email address and payment details are not sent to them.
Telegram: the delivery details of European orders pass through Telegram’s service on their way to our European fulfilment partner (see Delivery above), and if you order through our Telegram channel, your messages pass through Telegram’s service too.
Some of these providers operate in the United States or elsewhere outside the UK and the EU. Where personal data leaves the UK we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision; where it leaves the EU we rely on the EU Standard Contractual Clauses or an adequacy decision, so that it stays protected to UK and EU standards.
How long we keep it
Order and payment records, including refunds and store credit, are kept for 6 years after the end of the financial year of the order, as UK tax and accounting rules require.
Registration Agreement records (your acceptance, the date, IP address and signature) are kept for 6 years after your account is closed, as evidence of the terms you agreed to at the time of any order.
Partner Program commission and payout records are kept for 6 years for the same accounting reasons.
Contact form messages and photos are kept for as long as we need them to deal with your request and any follow-up, and deleted sooner if you ask. The scrambled code used to count messages per hour is kept with the message.
Account and profile details, email preferences, stock alerts and any partner profile (display name, photo and bio) are deleted when you close your account, unless we have to keep them for one of the reasons above. One-time codes and similar security records are deleted within days. Partner link clicks are kept for 12 months and then deleted.
Waitlist email addresses, with the region and any partner code stored with them, are deleted once the reminder that registration has opened has been sent, about a week after the opening notice for your region, or once you have registered after that notice, or when you close your account. Until registration opens for your region they are kept for that notice. If you asked for research updates and new arrivals, your email address and the date you agreed are kept for that purpose until you tell us to stop.
Email addresses left for a region we have not opened yet are deleted once we have told you we are open there. If you asked for research updates and new arrivals, your email address and the date you agreed are kept for that purpose until you tell us to stop.
Unpaid checkouts are kept for 7 days so you can complete them, and are then no longer used.
If you ask us to delete your account we keep a record of the request and when we completed it, so we can show we acted on it.
Deleting your account
You can ask us to delete your account from My Account under Account Settings. Before you confirm, we show you what will be lost: any store credit on the account and any Partner Program commission not yet paid out cannot be restored or paid out afterwards, and order and payment records are kept for 6 years as UK law requires, no longer linked to an active account. You confirm with your password.
We email you straight away to confirm we received the request, complete the deletion within 30 days, and email you again when it is done. To cancel a request, contact support@worldwidebioresearch.com before it is completed.
Your rights
Under UK data protection law (the UK GDPR and the Data Protection Act 2018), and if you are in the EU under the EU GDPR, you can ask us to: give you access to the personal data we hold about you; correct anything that is wrong; delete it (subject to the retention periods above); restrict or object to how we use it; and provide a copy in a portable format. Where we rely on your consent, for research updates and stock alerts, you can withdraw it at any time in My Account or with the link in the email, without affecting anything done before. Where we rely on legitimate interests, for example the soft opt-in to research updates at checkout in the European Union and Australia, saved-cart reminders and partner link records, you can object: untick the box, use the unsubscribe link in any research update, or switch the reminders off with the link in any reminder email.
To exercise any of these rights email support@worldwidebioresearch.com from the address on your account. We respond within one month; for complex requests we may take up to two further months and will tell you if so.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. If you are in the EU you can instead complain to the data protection supervisory authority in your own country. We would appreciate the chance to resolve it first.
Changes to this policy
We will update this page when our processing changes, for example when a new payment method or provider is introduced, and change the date at the top. Significant changes will also be flagged in your account or by email.
For research purposes only. Not for human consumption. Not for veterinary use.