1. Who we are
NMChem Ltd is the data controller for personal data collected through this website. We are registered with the Information Commissioner's Office (ICO) under the UK GDPR. Our registered address is in the United Kingdom. For data protection queries, contact us at [email protected].
2. Data we collect
We collect the following categories of personal data:
- Account and order data — name, email, delivery address, order history, and a payment method reference. We do not store card numbers; these are handled directly by the payment processor.
- Technical data — IP address, browser type, device type, pages visited, time on site, and referral source.
- Communication data — emails and messages you send to us.
- Research profile data — institutional affiliation if provided, and intended use confirmations recorded at the access gate or at checkout.
- Cookie data — see our Cookie Policy for details of cookies and similar technologies.
We do not collect sensitive personal data such as health information, biometric data, or political opinions.
3. Why we process your data
We rely on the following legal bases for processing personal data:
| Purpose | Legal basis |
|---|---|
| Order fulfilment | Performance of contract |
| Sending order confirmations and dispatch notifications | Performance of contract |
| Fraud prevention and security | Legitimate interests |
| Responding to enquiries | Legitimate interests |
| Sending marketing emails (where opted in) | Consent |
| Compliance with legal obligations | Legal obligation |
| Website analytics | Legitimate interests |
Where we rely on legitimate interests, we have assessed that our interests in operating, securing, and improving our service do not override your rights and freedoms.
4. How long we keep your data
- Order records — 6 years from the date of the order, in line with Companies Act and tax obligations.
- Account data — for the duration of the account, plus 2 years after last login.
- Marketing preferences — until you withdraw consent.
- Technical logs — 90 days.
- Communications — 3 years from the date of the last message in a thread.
5. Who we share data with
We share personal data only with the following categories of recipient, and only to the extent necessary for the purposes described above:
- Payment processor — card data is handled directly by the processor; we receive only a transaction reference.
- Delivery carriers — name and address for dispatch.
- Email service provider — for transactional and marketing emails.
- Analytics provider — anonymised data only.
- Cloud hosting provider — server infrastructure.
We do not sell personal data to any third party. All processors are bound by data processing agreements that meet the requirements of the UK GDPR.
6. International data transfers
Where any personal data is transferred outside the UK, we ensure adequate protections are in place through standard contractual clauses or the UK adequacy framework. Where possible, we use UK or EU-based service providers.
7. Your rights
Under the UK GDPR, you have the following rights in relation to your personal data:
- Right of access — you can request a copy of the data we hold about you.
- Right to rectification — you can ask us to correct inaccurate data.
- Right to erasure — you can ask us to delete your data, subject to our legal retention obligations.
- Right to restriction — you can ask us to limit how we use your data while a dispute is resolved.
- Right to data portability — you can receive your data in a structured, machine-readable format.
- Right to object — you can object to processing based on legitimate interests.
- Right not to be subject to automated decision-making — we do not make automated decisions that significantly affect you.
- Right to withdraw consent — where processing is based on consent, you can withdraw it at any time.
To exercise any of these rights, email [email protected] with your name and a description of your request. We respond within one calendar month.
8. Complaints
You have the right to complain to the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113. We would prefer to resolve any issue directly — please contact us first.
9. Changes to this policy
We will update this page when our practices change. Material changes will be notified by email to registered account holders. The last updated date at the top of this page reflects the current version.