This policy explains what personal data Limitless Lab collects when you visit this website, order from us, write to us or join our email list. It also explains why we collect it, who sees it, how long we keep it and what rights you have. We wrote it in plain language. Where the law requires a specific word, we use it.
Last updated: 13 November 2026.
1. Who is responsible for your data
The controller of your personal data is:
Limitless Lab LLC
Email: info@limitlesslab-official.com
In this policy, “we”, “us” and “Limitless Lab” mean this company. Write to the email address above for any privacy question or request. We do not have a data protection officer, because the law does not require one for a business of our size and type.
2. The short version
- We collect only what we need to run the shop: your order, delivery and contact details.
- We do not sell your data. We do not use advertising or social media tracking.
- We set analytics cookies only if you say yes in the cookie banner.
- We pay no card processor. You pay by bank transfer, so we see the sender details that your bank shows us.
- You can ask us to show, correct or delete your data at any time.
3. What we collect, why, and on what legal basis
| Situation | Data | Why we use it | Legal basis (GDPR) |
|---|---|---|---|
| You place an order | Name, delivery and billing address, email, phone number, order contents, order notes, the 18+ and terms confirmations, IP address at checkout | Take and process the order, deliver it, send order emails, issue invoices, handle damage claims and returns | Contract (Art. 6(1)(b)); legal duty for invoices and accounts (Art. 6(1)(c)) |
| You pay by bank transfer | Sender name, account number or IBAN, amount and payment reference, as shown on our bank statement | Match the payment to your order, keep accounting records, handle refunds | Contract; legal duty (Art. 6(1)(b), (c)) |
| You create an account | Name, email, password (stored only as a one-way hash), saved addresses, order history, wishlist | Let you log in, reorder and view past orders | Contract (Art. 6(1)(b)) |
| You write through the contact form or by email | Name, email, topic, message | Answer your question | Our legitimate interest in answering enquiries (Art. 6(1)(f)); contract if it relates to an order |
| You join the email list | Email address, date of sign-up, the wording you agreed to | Send the monthly evidence update | Your consent (Art. 6(1)(a)). You can withdraw it at any time. |
| You visit the site | IP address, browser and device type, pages requested, date and time, in server logs | Keep the site secure, find faults, block abuse | Legitimate interest in running a secure site (Art. 6(1)(f)) |
| You allow analytics cookies | WooCommerce order attribution: which page, search or campaign brought you to an order | Learn which pages help visitors | Your consent (Art. 6(1)(a)); see our cookie policy |
| You use the cart, checkout, wishlist or log in | Essential cookies and a session record | Make these features work | Needed to provide the service you asked for (Art. 6(1)(b), (f)) |
You are not required by law to give us your data. Without the order and delivery details, however, we cannot deliver an order.
4. Age limit
The shop is for adults. You must be 18 or older to order. When you check out you confirm this with a tick box. We do not knowingly collect data from children. If you think a child has sent us data, write to us and we will delete it.
5. Special categories of data
We do not ask for health information and we do not need it. Please do not send it to us. The products are sold for laboratory research only, and we do not ask what you plan to do with them beyond your confirmation of research use at checkout.
6. Who receives your data
Only the people and companies that need it to do their job for us:
- Hosting and email provider. Our website, database, backups and mailbox run on shared hosting from Namecheap, Inc. (USA). They process the data on our behalf.
- Delivery companies. Your name, address, phone number and email go to the courier that delivers your parcel, so they can deliver it and contact you about it.
- Our bank. It sees the payment details of your transfer.
- Accountant and tax advisers. They receive invoices and order records, under a duty of confidentiality.
- Authorities. We disclose data when the law requires it, for example to tax or customs authorities, or to a court.
- Software on this site. The plugins that run the shop (WooCommerce, our form and email plugins) run on our own server. They do not send your data to the plugin makers.
We do not sell your data and we do not share it with advertisers. We do not use Google Analytics, Meta Pixel or similar tracking tools on this site. Google Search Console, which we use to monitor how the site appears in search results, receives no data from your visit.
7. Transfers outside the European Economic Area
Our hosting provider is based in the USA, and our servers may be located there. We rely on the safeguards that the GDPR allows: the EU-US Data Privacy Framework where the provider is certified, and standard contractual clauses otherwise. Couriers that deliver outside the EEA must receive your delivery details to complete the delivery. You can ask us for a copy of the safeguards we use.
8. How long we keep your data
| Data | Kept for |
|---|---|
| Orders, invoices and payment records | The period the law requires for accounting records, normally 8 years from the end of the financial year |
| Account and wishlist | Until you ask us to delete your account. Order records stay for the period above. |
| Contact messages and our replies | Up to 2 years after the last message, then deleted |
| Email list | Until you unsubscribe or withdraw consent |
| Server logs | Up to 90 days |
| Cookies | As listed in the cookie policy |
| Backups | Overwritten on a rolling schedule. A deleted record can remain in a backup for a short time and is not restored except after a failure. |
9. How we protect your data
The whole site is served over HTTPS. Passwords are stored only as hashes. Admin access is limited to the people who need it, software is kept updated, and backups are kept separately from the live site. No system is perfectly secure. If a breach puts your rights at risk, we will tell you and the supervisory authority within the time the law sets.
10. Your rights
Under the GDPR you have the right to:
- Access the data we hold about you and get a copy.
- Correct data that is wrong or incomplete.
- Delete your data, unless we must keep it by law, for example invoices.
- Restrict how we use your data while a dispute about it is settled.
- Object to processing that rests on our legitimate interest.
- Move your data: get what you gave us in a common, machine-readable format.
- Withdraw consent at any time, for example for the email list or analytics cookies. This does not affect what we did before you withdrew.
To use any of these rights, write to info@limitlesslab-official.com. We may ask you to confirm who you are. We answer within one month. You can change your cookie choice at any time: open cookie settings. To leave the email list, use the link in any email or write to us.
We make no decisions about you by purely automated means, and we do not profile you.
11. Complaints
If you think we have handled your data unlawfully, please contact us first so we can put it right. You also have the right to complain to a data protection authority, in the EU country where you live or work, or where the problem happened. In Hungary this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9-11, naih.hu.
12. Cookies
Our cookie policy lists every cookie and browser storage item, what it does and how long it lasts.
13. Links to other sites
This site may link to scientific publications and other sites. We do not control them and this policy does not cover them.
14. Changes to this policy
We update this page when what we do with data changes. The date at the top shows the latest version. For a change that matters to you, such as a new purpose, we will tell you by email if we have your address.