Privacy
Policy

Uptide is a Dutch-registered company supplying COA-verified research compounds to qualified researchers and scientific institutions. This Privacy Policy explains how we collect, use, store, and protect personal data in connection with your use of our website and services, in accordance with the General Data Protection Regulation (GDPR / AVG) and applicable Dutch law.

For all privacy-related enquiries: team@uptide.eu.

We act as the data controller for all personal data collected through uptide.eu.

When you create an account, place an order, or contact us, we collect:

• Identity data: full name, email address
• Delivery data: shipping address, billing address
• Order data: products ordered, quantities, transaction amounts, order history
• Payment data: payment confirmation references from our payment processor (Mollie). We do not store card numbers, bank account numbers, or full payment credentials.
• Account data: hashed password, saved addresses (if you create an account)
• Technical data: IP address, browser type, pages visited, session duration, referring URL
• Verification data: age confirmation and research-use declaration at registration

When you apply to and participate in the Uptide Affiliate Programme, we collect additional personal data required for identity verification, tax compliance, and payment processing:

• Full legal name and email address
• Home address (street, city, postal code, country) — required for payout administration
• Date of birth — required for identity verification and Dutch tax reporting obligations
• Bank account number (IBAN) or PayPal email address — required for payout processing
• Tax identification number / VAT number (optional, used where applicable for tax reporting)
• Platform information: content channels and estimated audience size
• Motivation statement provided at application
• Commission and payout records: amounts earned, order counts, payout periods, payment references

Affiliate financial data (IBAN, payout amounts, tax ID) is processed exclusively for the purpose of administering and paying commissions, and for compliance with Dutch tax and bookkeeping obligations. This data is retained for 7 years in accordance with Dutch tax law (Belastingdienst bewaarplicht).

Affiliate personal data is not shared with third parties beyond what is strictly necessary to process payments (e.g. our payment platform or bank). Payout summaries may be shared with our bookkeeper for administrative purposes, bound by confidentiality obligations.

We use minimal, functional cookies and browser local storage only:

• Shopping cart persistence across pages and sessions
• Authentication session tokens (if logged in)
• Display preferences

We do not use advertising cookies, retargeting pixels, or third-party tracking technologies. We do not share browsing data with advertising networks. We may introduce optional analytics in the future, at which point this policy will be updated and consent obtained where required.

We share personal data with the following trusted third-party service providers, solely to the extent necessary to operate our service:

Where personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission. We do not sell personal data to any third party for commercial purposes.

For bookkeeping purposes, payout summaries for affiliates may be shared with our contracted bookkeeper, who is bound by a confidentiality agreement and processes data solely on our behalf.

We retain personal data only as long as necessary for the purpose it was collected or as required by applicable law:

Under the GDPR (AVG), you have the following rights regarding your personal data. You can exercise these rights at any time by contacting team@uptide.eu.

We will respond to all requests within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), reachable at autoriteitpersoonsgegevens.nl.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Measures include:

• All data is transmitted over encrypted HTTPS connections (TLS)
• Passwords are stored using one-way cryptographic hashing
• Access to personal data is limited to authorised personnel only
• Financial data (IBAN, tax IDs) is accessible only to administrators for payout administration
• We conduct periodic reviews of our data processing practices

No method of transmission over the internet is completely secure. While we take every reasonable precaution, we cannot guarantee absolute security. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens within 72 hours and inform affected individuals without undue delay.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The current version is always available at this URL. The date of the most recent update is shown at the top of this page. For material changes affecting your rights, we will notify registered account holders by email at least 14 days before the change takes effect.