How we use your information.

Who we are

Direct Lab Supplies Ltd is the data controller. We are registered in England and Wales under company number 17177276, with registered office at Unit A, 82 James Carter Road, Mildenhall, IP28 7DE, United Kingdom. Contact info@directlabsupplies.co.uk.

What we collect and why

When you submit an enquiry or sample request, we store the contact, institution, product, intended application and delivery information you provide so that we can assess and answer the request and keep a record of it. Please do not include patient data, clinical identifiers, special-category personal data or confidential unpublished research. If you place an order, we also use the transaction details needed to take steps towards a contract, supply the order, keep accounting records and resolve problems.

We need your name, organisation, work email and product request to respond. A sample request also needs the intended application and full delivery address. A quotation request also needs a delivery address so that delivery requirements and charges can be assessed. If you do not provide the required fields, we cannot process the request; fields marked optional are voluntary.

Shopify hosts online checkout and processes contact, billing, delivery and payment information. We receive the order details and payment status needed to fulfil and administer your order, but we do not receive your full card number. For enquiries and quotations, our lawful bases are steps you ask us to take before a contract and our legitimate interests in responding to and keeping records of business enquiries, preventing misuse, and administering and defending our business. We also rely on contract, legal obligation and legitimate interests to process orders, keep required records and protect the business. Crisp live chat loads only with your consent.

Who receives it

With your separate statistics consent, Google Analytics processes website usage, traffic sources and technical information to help us improve the site. After a request is successfully received, we report only whether it was a sample or quotation enquiry, not your contact details, enquiry reference or form content. Campaign labels are restricted to approved marketing categories; referring pages are reduced to their website origin. Event and user data are retained for up to 14 months, with the user-data period restarting on new activity. This does not limit retention of aggregated reports. You can withdraw consent through cookie settings. Our cookie notice explains the cookies and their retention.

With your separate advertising-measurement consent, Google Ads receives successful sample/quotation event types, random event identifiers, recognised ad-click identifiers and technical information such as IP address and browser information. This helps measure which ads lead to enquiries. We do not send names, email addresses, telephone numbers, delivery addresses or form content in these events, and do not enable enhanced conversions, remarketing or advertising personalisation. You may use our forms without agreeing to this. Consent can be withdrawn through cookie settings; withdrawal stops future measurement but does not retract events already received by Google.

We use service providers only as needed: Shopify for ecommerce and payment processing, Crisp for optional chat, Cloudflare to host the website and D1 enquiry records. If email notifications are enabled, Resend sends an internal notification to our sales inbox. We also use warehouse and delivery providers for fulfilment, and professional advisers or HMRC for legal and accounting duties. Relevant product and application details may be shared with Yeasen when sample eligibility or technical support needs to be assessed. We do not sell personal data.

International transfers

Some providers may process personal data outside the UK. Where a destination is not covered by UK adequacy regulations, the provider uses an applicable transfer safeguard, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Contact us for information about the safeguard relevant to a particular provider.

How long we keep it

We periodically review ordinary enquiry and live-chat records, using 24 months after the last contact as the normal review point, and keep them longer only where needed for an active matter, legal obligation or dispute. Order, payment and tax records are normally kept for six years after the relevant financial year, or longer where law, a dispute or a regulatory enquiry requires it. Basket and sample-request-list data stay in your browser for up to 30 days; privacy choices are kept for six months.

Your rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction, portability or object to processing. You may withdraw live-chat, statistics or advertising-measurement consent at any time through cookie settings. Contact us first with a privacy request; you may also complain directly to the Information Commissioner's Office.

We do not make decisions producing legal or similarly significant effects solely by automated means.

Last updated: 30 September 2026