Privacy Policy
Last updated: 28 August 2026
At Biocol Labs we work to ensure your privacy is protected when you use our website and services. This policy explains what personal data we collect, why we collect it, who we share it with, and the rights you have over it. We keep it in plain language on purpose — if anything is unclear, write to us at hello@biocollabs.com.
1. Who is responsible for your personal data?
The Post-Chemical Society Lda, trading as Biocol Labs, is the controller of the personal data you submit to us:
The Post-Chemical Society Lda
R. Nova da Piedade 21, 1200-420 Lisboa, Portugal
2. What personal data do we collect?
Data you give us. When you place an order, create an account, subscribe to a protocol, sign up to our newsletter, leave a review or contact our support team, we collect what you submit: your name, email address, shipping and billing address, phone number, and the contents of your messages and reviews.
Payment data. Payments are processed directly by our payment providers (for example Shopify Payments or PayPal). We never see or store your full card number — we receive only a confirmation of payment and the last digits needed to reference the transaction.
Data collected automatically. When you browse the site we receive technical data such as your IP address, device and browser type, and the pages you view. We derive your approximate location (country level only) from your IP address at our hosting provider's network edge — this decides which currencies we offer, which consent choices we must show you, and which legal notices apply to you. It is not stored with any profile of you.
Data from cookies and similar technologies — see section 4, which also explains how to control them.
3. Why do we use your personal data, and on what legal basis?
Under the EU General Data Protection Regulation (GDPR), every use of personal data needs a legal basis. Ours are:
To perform our contract with you — creating and managing your account, processing your orders, payments, subscriptions and returns, delivering your products, sending order and delivery notifications, and answering your support requests.
To comply with legal obligations — keeping invoicing and transaction records for tax and accounting law, verifying eligibility to purchase (our products are sold to adults aged 18 or over), and honouring your privacy rights.
Our legitimate interests — preventing fraud and misuse of our services, keeping the site secure, understanding at an aggregate level how the site is used, and improving our products and services. Where we rely on legitimate interests you can object at any time (section 8).
Your consent — sending you marketing such as our newsletter, and setting analytics, marketing or personalization cookies in regions where consent is required. You can withdraw consent at any time, as easily as you gave it.
4. Cookies and similar technologies
We keep cookies to a minimum and group them the way our consent banner presents them:
Strictly necessary — the cookies that make the shop work: your cart and checkout session, your consent decision itself (the _tracking_consent cookie, which travels with you into checkout so you are never asked twice), and — when we run a price or content experiment — a first-party cookie that keeps the version of the site you see consistent between visits. These do not track you across other websites and cannot be switched off.
Analytics — measurement tools that help us understand how the site is used. Loaded only with your consent where consent is required.
Marketing — advertising and retargeting tools of ad platforms. Loaded only with your consent where consent is required.
Personalization — tools that remember choices you have made so the site can adapt to you. Loaded only with your consent where consent is required.
If you are in a region where consent is required (such as the EU/EEA or the UK), none of the optional categories load until you make a choice in the banner, and every category starts switched off. You can change your mind at any time via the Cookie settings control in the footer, which reopens the banner and its preferences dialog.
Our own store analytics (provided by Shopify as part of running the shop) and the technical logs of our hosting are handled under our legitimate interest in operating and securing the service.
5. Who do we share your personal data with?
We never sell your personal data for money. We share it with a small set of service providers who process it on our instructions, each for a specific job:
Shopify — runs our store, checkout, payment infrastructure and hosting. Order, account and browsing data is processed on Shopify's platform.
Payment providers (Shopify Payments, PayPal and the payment methods offered at checkout) — process your payment.
Shipping carriers — receive your name, delivery address and, where the carrier offers delivery updates, your email or phone number.
Klaviyo — sends our newsletter and marketing emails to subscribers.
Skio — manages subscriptions: renewal schedules, billing dates and your subscription preferences.
Junip — collects and displays product reviews you choose to leave.
Gorgias — our customer-support helpdesk, where your messages to us and our replies are managed.
Intelligems — runs our price and content experiments using the first-party cookie described in section 4.
We may also disclose personal data where the law requires it — for example to tax authorities, or in response to a valid legal request — and, in the event of a merger or sale of our business, to the parties involved under confidentiality obligations.
6. Where is your personal data processed?
Your data is stored and processed primarily within the European Economic Area (EEA). Some of the providers in section 5 process data in the United States or other countries outside the EEA. Where that happens, the transfer is protected by an adequacy decision of the European Commission (including, for certified US providers, the EU–US Data Privacy Framework) or by the Commission's Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for details of the safeguard applying to a specific provider.
7. How long do we keep your data?
Only as long as the purpose it was collected for requires:
Orders and invoices — kept for the period Portuguese tax and accounting law requires (in general ten years).
Your account — kept while it is active; deleted or anonymised when you ask us to close it, except what we must keep under the point above.
Marketing data — kept until you unsubscribe or object; an unsubscribe takes effect immediately.
Support conversations — kept while we need them to help you and to document how an issue was resolved.
Consent records — kept as evidence of the choices you made for as long as those choices remain relevant.
8. What are your rights?
Under the GDPR you can, at any time and free of charge:
Access the personal data we hold about you, and receive a copy;
Correct data that is inaccurate or incomplete;
Delete your data ("right to be forgotten"), where no legal obligation requires us to keep it;
Restrict or object to processing based on our legitimate interests, including profiling;
Take your data with you — receive it in a portable, machine-readable format;
Withdraw consent you gave earlier, without affecting the lawfulness of what happened before;
Object to direct marketing — we stop immediately, no justification needed.
To exercise any of these, email hello@biocollabs.com. We answer within one month. If you believe we have not handled your data lawfully, you can complain to the Portuguese supervisory authority — Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt — or to the authority of the EU country where you live or work.
9. Privacy rights in the United States
If you live in California or another US state with a consumer privacy law, you have similar rights to know, correct and delete the personal information we hold about you, and the right not to be discriminated against for exercising them. We do not sell personal information for money. Where state law treats sharing data with advertising partners as a "sale" or "sharing", you can opt out with the Sale of data switch in our cookie preferences (footer → Cookie settings), which we honour through our platform's consent system. You can also email hello@biocollabs.com with any request.
10. Marketing communications
You only receive our newsletter if you've subscribed to it. Every marketing email includes an unsubscribe link that takes effect immediately, and you can opt out of marketing texts at any time by replying "STOP." Order confirmations, delivery updates and replies to your support requests aren't marketing; you receive them because they're part of the service you asked for.
11. Children
Our website is not directed at children, and our products are sold to adults aged 18 or over. We do not knowingly collect personal data from anyone under 16; if you believe a child has provided us data, contact us and we will delete it.
12. How do we protect your personal data?
All traffic to the site is encrypted (TLS). Payment processing is handled by PCI-DSS-compliant providers. Access to personal data inside our organisation and at our providers is limited to the people who need it for the jobs described in this policy, under confidentiality obligations. No method of transmission or storage is perfectly secure, but we choose providers and safeguards accordingly.
13. Changes to this policy
When we change this policy we update it here and adjust the date at the top. If a change meaningfully affects your rights — a new purpose, a new category of recipient — we will draw attention to it on the site or by email rather than change it silently.
14. Contact us
Questions, requests, doubts: hello@biocollabs.com, or by post to The Post-Chemical Society Lda, R. Nova da Piedade 21, 1200-420 Lisboa, Portugal.