Privacy at TPD

Monvex LIMITED operates this online shop and website, including all related information, content, tools, products and services. This policy explains how we collect, use, store and share your personal data when you visit or use our services, make a purchase or otherwise communicate with us. By using our services you confirm that you have read and understood the practices described below.

Short version: we collect the minimum needed to run your account and ship your order. No analytics, no tracking pixels, no advertising networks, no profiling, no data sale.

Last updated: July 2026

Personal data we collect

Depending on how you interact with our services, we may process the following categories of personal data:

Contact and account data: email address (for passwordless magic-link login), an optional display name, account preferences.
Order data: shipping name and address, cart contents, order history, payment status, chosen payment method (SEPA bank transfer, card or crypto). We do NOT receive or store card data directly - card payments run via Stripe-hosted checkout. For SEPA we only see the order code and amount on our bank statement; account details remain with your bank.
Account features: wishlist, your stack, reviews you submit, loyalty tier and referral data.
Communication data: messages, support requests or feedback you send us.
Technical data: server log data (IP address, timestamp, requested page) kept short-term for security and operation. We do not build behavioural usage profiles.

Sources of personal data

Directly from you, when you create an account, place an order or communicate with us.
Via strictly necessary cookies when you use the site. There are no tracking or advertising cookies, so there is no consent banner: a session cookie keeps you logged in, an anonymous cart cookie preserves your cart before login, and a short-lived referral cookie (tpd_ref) records the referrer if you arrive via a referral link.
From service providers strictly to the extent needed to process payment and ship your order.

How we use your data

a) Providing our services. To process and fulfil orders, manage payment, shipping and account settings, and to send transactional notifications. Legal basis: contract performance.

b) Communication and support. To answer your requests and maintain the customer relationship. We send primarily transactional email (login links, order status, tracking). In rare cases a one-off service inquiry about your account may be added (e.g. if your account has been inactive for a long time). We do not run a newsletter, send marketing campaigns or show personalised advertising. If you also want no service inquiries: a short email to [email protected] is enough.

c) Security and fraud prevention. To verify accounts, detect and prevent abuse, and protect the service and our customers. Legal basis: our legitimate interest in a safe, available service. Please keep your account access secure and do not share it.

d) Legal compliance. To comply with applicable law, respond to lawful requests and enforce our terms.

Sharing of personal data

We keep the stack small on purpose. Data goes to these processors only as far as needed:

Resend - sends our transactional emails; receives your email address and the message content.
Stripe - external payment processor for card payments (optional, +5% surcharge). When you choose card at checkout, the actual card data is entered on Stripe-hosted pages - it never reaches our servers. Stripe receives your email address and the line items of the order to display them on the checkout page; we only learn whether the payment succeeded.
17track - tracking-status lookups for shipped parcels; receives the tracking number, not your address.
Cloudflare - proxy and CDN in front of the site; processes connection data for delivery and DDoS protection.
Hosting provider - the server infrastructure where the platform and database run, located in the EU.
Fulfilment partners - the warehouse partners that pack and dispatch your order receive the shipping name and address needed for delivery.

We do not sell, rent or trade your data, we have no advertising or marketing partners, and we share data with nobody beyond what is listed here - unless we are legally obliged to.

Third-party websites and links

Our services contain links to third-party websites (for example study sources, Discord, Telegram). We are not responsible for the privacy, security or accuracy of external sites. Any data you share on external platforms can be viewed, collected and used by those third parties under their own policies.

Data of minors

Our services are not intended for minors or anyone below the legal age of majority in their jurisdiction. We do not knowingly collect data from minors. If you are a parent or guardian and believe your child has submitted personal data to us, contact us so we can delete it.

Data security and retention

The site runs over HTTPS only. Login tokens are stored hashed, not in clear text. We never store card data on our systems - card payments are handled entirely on Stripe-hosted pages. SEPA payments only show us order code and amount on the bank statement. We keep the dependency and service surface deliberately minimal, because every extra third party is an extra risk. No online system can guarantee absolute security.

We retain personal data only as long as needed for the purposes in this policy or as required by law. Login tokens, sessions and abandoned anonymous carts are cleaned up automatically on a short cycle; unpaid orders are auto-cancelled after 7 days. When you delete your account, your personal data is removed or anonymised, except where limited records must be kept for legal reasons.

Your rights and choices

Depending on your jurisdiction you may have the following rights regarding your personal data:

Access: request a copy of the data we hold about you.
Deletion: request deletion of your personal data.
Correction: request correction of inaccurate information.
Portability: request a transfer of your data to yourself or a third party.
Objection: object to or request restriction of processing.

You can delete your account directly in your account settings, or write to [email protected] for any of the above. We do not run a marketing newsletter, so there is no unsubscribe list. Transactional emails (login links, order confirmations) are sent as needed. If you don't want service inquiries about your account either (see above), email [email protected] once and you won't get any more. We may need to verify your identity before processing a request.

Complaints

If you have concerns about our data practices, contact us using the details below. If you are in the EEA or the UK, you can also lodge a complaint with your local data protection authority.

International data transfers

The platform and database are hosted in the EU. Some of the service providers listed in section 4 (for example email delivery, tracking, the CDN) may process data outside the EEA. Where data is transferred outside the EEA or UK, we rely on standard contractual clauses or other lawful transfer mechanisms where no adequacy decision applies.

Updates to this policy

We may update this privacy policy from time to time to reflect changes in our practices, legal requirements or service offering. The last-updated date is always shown at the top of this page.

Contact

For questions about this policy or to exercise your rights, contact us at [email protected], via Discord (discord.gg/thepeptidedesk), Telegram (@thepeptidedesk) or WhatsApp (+49 152 33532820). Monvex LIMITED is the controller responsible for processing your personal data. Full operator details can be found in our legal notice (Impressum).

Terms · FAQ