Privacy Policy

Last updated: September 21, 2026

This Privacy Policy explains how KQ LAB LTD, trading as King & Queen Lab (“we”, “us”, “our”), collects, uses, stores, and protects personal data when you access or make a purchase from https://kqlab.co.uk/ (the “Site”), create an account, or communicate with our team.

KQ LAB LTD is the designated data controller responsible for your personal information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

  • Registered Company Name: KQ LAB LTD

  • Company Registration Number: 17321958 (Incorporated in England & Wales)

  • Registered Office Address: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ

  • Trading / Brand Name: King & Queen Lab

  • Data Protection & Compliance Email: support@kqlab.co.uk

We operate under strict data minimization principles: we only collect the personal data required to fulfill orders, process card payments, facilitate laboratory customer service, and comply with mandatory United Kingdom statutory obligations.

1. The Categories of Personal Data We Collect

We collect and process personal data in the following distinct categories:

  • Identity & Contact Information: Full name, institutional or company affiliation, billing address, delivery address, professional email address, and telephone number provided during checkout or account registration.

  • Transaction & Purchase Records: Records of research-grade biochemicals and laboratory materials purchased, order values, currency amounts, VAT/tax breakdowns, delivery preferences, fulfillment timelines, and historical order records.

  • Payment Settlement Data: Authorization tokens, transaction identification numbers, and settlement confirmations issued by our licensed, PCI-DSS compliant payment acquirers and payment gateways. We do not process, collect, store, or view full credit or debit card primary account numbers (PANs), card expiration dates, CVVs, or online banking passwords. All cardholder information is transmitted through our gateway provider’s bank-grade encrypted channels.

  • Customer Support & Communications: Inquiries, technical Certificate of Analysis (COA) lookup requests, email correspondence sent to support@kqlab.co.uk, and internal customer service notes.

  • Technical & Usage Information: IP addresses, operating system specifications, browser user agents, referring URLs, and aggregated interaction timestamps captured via essential system logs and privacy-focused site metrics.

We do not collect or solicit any special category data (such as health, medical, genetic, or biometric information). Please do not submit any clinical, patient, or medical data in your communications.

2. Lawful Bases and Purposes for Data Processing

In accordance with Article 6 of the UK GDPR, KQ LAB LTD processes personal data exclusively under the following lawful bases:

  • Performance of a Contract (Article 6(1)(b)):

    • Verifying buyer information and fulfilling orders for research chemicals.

    • Dispatching automated transactional notices (order confirmations, dispatch notices, tracking codes).

    • Processing approved refunds, addressing damaged consignments, and facilitating customer support.

  • Compliance with Legal & Regulatory Obligations (Article 6(1)(c)):

    • Retaining commercial financial records, purchase orders, and sales receipts under the Companies Act 2006 and HM Revenue & Customs (HMRC) statutory regulations.

    • Ensuring statutory compliance with UK chemical supply requirements and verifying the minimum age threshold (18+).

  • Legitimate Interests (Article 6(1)(f)):

    • Protecting our technical infrastructure from denial-of-service (DDoS) events, brute-force attacks, and malicious intrusion.

    • Identifying and preventing fraudulent card transactions or unauthorized merchant exploitation.

    • Monitoring anonymized navigation flows to improve catalog discoverability and server loading speeds.

  • Consent / Soft Opt-in (Article 6(1)(a)):

    • Delivering opted-in newsletters regarding restocks, new compound availability, or technical characterization updates. Every promotional email provides an immediate, one-click unsubscribe mechanism.

3. Data Sharing and Third-Party Disclosures

We do not sell, rent, lease, or monetize customer personal information. Disclosures are limited to vetted third-party service providers operating under binding Data Processing Agreements (DPAs):

  • Payment Gateways & Acquiring Banks: Regulated financial service organizations and payment gateways to process card payments, execute settlements, and prevent fraud. Transactions take place via 256-bit TLS/SSL encrypted channels.

  • Logistics & Postal Carriers: Regulated UK and international parcel couriers (e.g., Royal Mail, DPD, UPS) receive recipient delivery names, delivery addresses, and dispatch contact details solely for carriage and real-time transit tracking.

  • Server Hosting & Web Infrastructure: Cloud infrastructure providers, Content Delivery Networks (CDNs), and enterprise Web Application Firewalls (WAFs) based in the United Kingdom or EEA to secure site availability and database storage.

  • Email & Customer Support Software: Secure email hosting and transactional transmission software to deliver order invoices, batch COA notifications, and direct customer support replies.

  • Regulatory & Legal Authorities: Law enforcement agencies, HM Revenue & Customs, the Information Commissioner’s Office, or legal advisers if mandated by applicable United Kingdom law, court order, or formal statutory obligation.

4. International Data Transfers

Whenever third-party IT or logistical services store or transfer data outside the United Kingdom, we ensure equivalent legal protection through:

  • Transfers to jurisdictions confirmed under UK Adequacy Regulations;

  • Implementation of the UK International Data Transfer Agreement (IDTA); or

  • The UK Addendum to the European Commission’s Standard Contractual Clauses (SCCs).

5. Data Retention Schedule

In alignment with our dedicated Data Retention Policy, KQ LAB LTD does not hold personal data indefinitely:

  • Invoices, Orders, & Financial Settlements: Retained for a mandatory statutory period of 6 years from the end of the relevant financial tax year, as prescribed by Section 386 of the Companies Act 2006, the Limitation Act 1980, and HMRC rules.

  • Routine Customer Correspondence: General pre-order technical inquiries and email records are removed within 12 months (and purged after 6 months once resolved).

  • Active User Accounts: Account credentials and addresses remain on record while your account remains open, and will be deleted within 30 days of an account closure request.

  • Marketing Lists: Contact details are deleted immediately upon opting out or unsubscribing, with a suppressed record maintained solely to prevent accidental re-contact.

  • Web Server Security Logs: Firewalls and network connection logs overwrite on an automated 90-day rolling deletion schedule.

6. Technical and Organizational Data Security

We maintain comprehensive physical, electronic, and procedural safeguards to preserve data integrity and prevent unauthorized access:

  • TLS 1.3 / HTTPS Encryption: All communications between your browser and our servers are encrypted using 256-bit Transport Layer Security certificates.

  • PCI-DSS Compliance: Card payment details are collected via hosted fields or tokenized gateways that meet PCI-DSS Level 1 compliance. Payment card numbers never touch, pass through, or reside on our hosting servers.

  • Access Governance: Access to customer records, shipping registries, and invoice management databases is restricted to authorized personnel who require it for operational duties.

7. Cookie and Tracking Policy

Our website utilizes minimal, essential cookies necessary for functionality:

  • Essential Operational Cookies: Required to maintain secure browsing sessions, manage active shopping carts, and preserve security integrity during checkout. The site cannot function properly without these cookies.

  • Anonymized Analytical Cookies: Configured strictly to gather aggregated, non-personally identifiable traffic metrics to help us understand site performance and identify broken links.

  • Managing Cookies: You can adjust your browser settings to alert you to, or disable, non-essential cookies. Disabling essential cookies may impair shopping cart and checkout performance.

8. Your Legal Rights Under UK GDPR

As a data subject located in the United Kingdom, you hold statutory rights regarding your personal information:

  • Right of Access (Article 15): Request written confirmation and an unredacted copy of all personal data held about you.

  • Right to Rectification (Article 16): Request correction of inaccurate, incomplete, or out-of-date personal information.

  • Right to Erasure (“Right to Be Forgotten”) (Article 17): Request the permanent erasure of your personal data where processing is no longer necessary, subject to mandatory 6-year statutory tax and financial retention laws.

  • Right to Restrict Processing (Article 18): Request that we suspend processing while data accuracy or lawful basis objections are formally verified.

  • Right to Data Portability (Article 20): Request receipt of your submitted data in a structured, commonly used, machine-readable format.

  • Right to Object (Article 21): Object to data processing predicated upon legitimate interests or direct marketing communications.

  • Right to Withdraw Consent (Article 7(3)): Withdraw previously granted marketing consent at any time.

To exercise any of these statutory rights, please submit a written request to support@kqlab.co.uk. We verify and respond to all requests within one calendar month, without administrative fees (unless requests are manifestly unfounded or repetitive).

If you believe our processing violates data protection legislation, you maintain the right to lodge a formal complaint with the UK supervisory authority:

  • Information Commissioner’s Office (ICO)

    Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

    Website: https://ico.org.uk/ | Helpline: 0303 123 1113

9. Age Eligibility Restriction

The catalog and services operated by King & Queen Lab are restricted to persons aged 18 years and older. We do not knowingly market to, collect, or store personal data from minors. If we discover that personal details from an individual under 18 have been provided, they will be deleted from our systems immediately.

10. Modifications to This Privacy Policy

We may update this Privacy Policy to maintain alignment with operational workflows, technical security updates, or relevant UK legislation. Any modifications will be posted directly to this page along with a revised “Last updated” date. Continued access to the website following the publication of changes signifies your acknowledgment of the updated policy terms.

11. Company Registration & Compliance Contacts

For all inquiries concerning data privacy, data deletion requests, or regulatory disclosures, contact:

  • Data Controller: KQ LAB LTD

  • Company Registration Number: 17321958

  • Registered Office Address: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ

  • Trading / Brand Name: King & Queen Lab

  • Website Domain: https://kqlab.co.uk/

  • Compliance & Support Desk: support@kqlab.co.uk