Privacy.

Information lifecycle

Collected only where the service needs it.

Information collected

• Account email, organisation and account dates.
• Name, email, organisation, delivery address and order contents.
• Order, payment, fulfilment, support and batch-document records.
• Limited technical and security records needed to operate and protect the service.

IP addresses are not added to account or order records. An IP address may be processed transiently for short-duration abuse prevention, and a network provider may supply a country code so checkout can suggest a delivery country. That suggestion is not saved as the purchaser’s decision; the country selected at checkout is saved with the order. Infrastructure or security providers may retain limited technical records under their own controlled retention arrangements.

The browser stores the shopping cart locally. Bear Biotech does not receive that cart until checkout.

How information is used

Information is used to create and fulfil orders, prevent fraud or misuse, calculate destination availability and delivery charges, maintain required account and order records, provide support, associate documentation with a batch, comply with applicable obligations and protect the service.

Payments and service providers

The Bitcoin invoice service creates and tracks the payment request. Bear Biotech records invoice identifiers and payment status but does not receive wallet passwords, private keys or recovery phrases.

Limited information may be disclosed to infrastructure, payment, delivery, professional or regulatory service providers where reasonably required. Information is not sold as an advertising list.

Security, retention and requests

Reasonable technical and organisational safeguards are used, but no online service can promise absolute security. Email-based secure sign-in creates a server-side account session; appropriate security records are retained to protect account access. At checkout, the purchaser can choose either to remove the completed order from their online account 7 days after delivery or cancellation, or to keep it in their account history. The account email and account record remain while the account is active.

Removing an order from the online account does not erase transaction information that must still be retained for fulfilment, tax, accounting, disputes, security or another legal requirement. Personal information that is no longer needed and is not required to be retained is destroyed or de-identified in accordance with the applicable retention process.

Requests to access, correct or delete personal information will be assessed against identity, security and record-retention requirements.