Privacy Policy

APEX Pharma (“APEX Pharma”) is the controller of the personal data described in this notice, under the Personal Data Protection Law (Royal Decree M/19 of 1443H, as amended) and its Implementing Regulations. APEX Pharma is an online retailer of research-grade peptides in prefilled pens, supplied strictly for in vitro laboratory research, serving customers in Saudi Arabia. Privacy questions and requests go to the contact channel shown in the footer of this site.

We collect only what is needed to run the store. The legal basis for each purpose is shown in brackets.

• Orders — your name, delivery address, phone number, email address and the items ordered, to take, confirm, dispatch and track your order and to keep the records tax law requires (performance of a contract; legal obligation).
• Payment — we never see card details. After your order is checked we email you a secure payment link; the payment provider that hosts that link processes your payment details under its own privacy notice, and tells us only whether the payment succeeded (performance of a contract).
• Accounts — your email address and a password (stored only as a one-way hash), plus your order history and loyalty points (performance of a contract).
• Newsletter — your email address, with the date and IP address of your confirmation, so we can prove consent (consent — withdraw at any time with the unsubscribe link).
• Affiliate applications — the name, contact details and channel information you submit, and referral statistics if you are accepted (steps at your request before a contract; performance of that contract).
• Messages — the content of any email or messaging conversation you have with us about an order (our legitimate interest in answering you and keeping a record of what was agreed).
• Site analytics — pages viewed, device and approximate location, collected by Google Analytics only after you accept analytics cookies (consent — see Cookies below).
• Research-use acknowledgement — the date you confirmed the research-use notice, stored in your browser only (legal obligation and legitimate interest in supplying these materials lawfully).

Providing order and account data is necessary to buy from us; without it we cannot accept an order. Everything else is optional. We do not make automated decisions with legal effects about you, and we do not sell personal data.

Only the services needed to operate the store, each bound by a contract that limits what it may do with the data:

• Delivery carriers receive your name, address and phone number to deliver the parcel.
• The payment provider that hosts the payment link we send you processes your payment; we receive confirmation of payment, not your card details.
• Our email provider sends order and newsletter email on our behalf.
• Our hosting provider stores this website and its database.
• Google Analytics processes site-usage data, only with your consent, as described under Cookies.

We will also disclose personal data where the law requires it or where a competent authority lawfully asks for it.

This website is hosted on servers located outside Saudi Arabia, so your personal data is stored and processed abroad. Where personal data leaves the territory in which the Personal Data Protection Law (Royal Decree M/19 of 1443H, as amended) and its Implementing Regulations applies, we rely on the conditions and safeguards set out in the Personal Data Transfer Regulations issued under the PDPL. You may ask us for details of the safeguard that applies to a specific transfer.

This site uses a small number of essential browser-storage items — your basket, your sign-in session, your language choice, your cookie choice and your acknowledgement of the research-use notice. These are needed for the site to work and do not require consent. Google Analytics measurement cookies are set only if you accept them in the cookie banner; analytics data is aggregated and is not used to identify you. You can change your choice at any time: cookie settings. We do not use advertising pixels.

Data is transmitted over HTTPS and stored on access-controlled servers. Passwords are hashed and cannot be read by us. We keep order and invoice records for at least 6 years, as Saudi VAT and commercial record-keeping rules require; keep newsletter unsubscribe records so your choice is honoured; keep account data while the account is open and for a short period afterwards; and delete or de-identify other information when it is no longer needed. No transmission over the internet is completely secure, and we cannot guarantee absolute security; if a breach affects you we will tell you and the authority as the Personal Data Protection Law (Royal Decree M/19 of 1443H, as amended) and its Implementing Regulations requires.

Under the Personal Data Protection Law (Royal Decree M/19 of 1443H, as amended) and its Implementing Regulations you have the right to:

• be told how your personal data is used — this notice;
• access the personal data we hold about you and receive a copy of it in a readable format;
• have inaccurate or incomplete data corrected;
• have your data erased or destroyed when it is no longer needed for the purpose it was collected for, or when you withdraw consent;
• withdraw consent at any time, without affecting processing that took place before you withdrew it;
• complain to the competent authority, Saudi Data & AI Authority (SDAIA), if you believe we have not handled your data lawfully.

To exercise a right, contact us at the contact channel shown in the footer of this site. We may ask you to confirm your identity first. We respond within the time the Personal Data Protection Law (Royal Decree M/19 of 1443H, as amended) and its Implementing Regulations allows and will explain if we cannot do something.

Privacy questions: the contact channel shown in the footer of this site. We may update this notice from time to time; the date below shows the current version, and we will flag significant changes on the site. Our Terms and Research-Use Disclaimer apply alongside this notice.