Molekula Ltd · 1 Millennium Way, Newton Aycliffe, Durham DL5 6JW · Companies House 6879903

Last updated: 14 October 2026

1. Who we are

Molekula Ltd is the controller of the personal data described in this policy. You can contact us about it at [email protected] or by post at the address above.

We are part of the Molekula group, whose companies in the UK, Germany, Italy, France, Spain, the United States and China share one customer and order management system. Molekula Ltd operates that system for the group. When you deal with another Molekula company, that company is the controller and its own privacy policy applies.

We sell to businesses and institutions, so most of the personal data we hold is business contact information about the people we deal with at customers, suppliers and prospects.

2. What we collect and why

Visiting our website

When you visit molekula.com our servers and our network provider, Cloudflare, process your IP address, browser details, the pages you request and the time of the request. We need this to deliver the site, keep it secure and fix faults. Our legal basis is our legitimate interest in running a secure website. Error reports sent to our monitoring service, Sentry, may include your IP address and, if you are signed in, your user account.

The site loads its fonts from Bunny Fonts, an EU provider that sets no cookies. If you scroll to a “Prefer Molekula on Google” button, a Google script loads so that the button can work.

Cookies and similar technologies

We use a small number of cookies that the site needs to work: a session cookie, a security token for forms, two cookies that keep your basket for 60 days once you add something to it, and a cookie that remembers your cookie choice. These are strictly necessary and do not need your consent. We record the steps a basket goes through (viewed, checkout started, submitted) against the basket’s random identifier, so that we can see where checkout fails. This record does not identify you.

With your consent, given in our cookie banner, we also use:

Google Analytics, to understand how visitors find and use the site;
Google Ads, to measure which adverts lead to enquiries and orders;
the Meta Pixel, to measure our advertising on Facebook and Instagram.

The Meta Pixel is not loaded at all unless you accept. Google’s tags run in “consent mode”: if you decline, they set no cookies, but Google may still receive cookie-free signals, such as which page was viewed, that it uses for aggregated measurement. You can change your choice at any time with the button at the end of this page.

If you arrived from a Google advert and accepted cookies, we store the advert’s click identifier with your enquiry. If that enquiry later becomes an order, we report the click identifier, the order number and the order value to Google Ads. We do not send your name or email address.

Enquiries, quotes and website orders

When you use a contact, quote, bulk-price or basket form, we collect your name, company, email address, phone number, country, the products you are interested in and your message. Our forms are protected by Google reCAPTCHA, which processes information about your device and how you use the page to tell people from bots. We use this data to answer you, prepare quotations and orders, and keep a record of our dealings with your company. Our legal basis is taking steps at your request before entering into a contract, and our legitimate interest in managing our business relationships.

Customers and suppliers

For customers and suppliers we hold contact details of the people we deal with, orders, quotations, delivery addresses, invoices, payment records and our correspondence. For controlled substances we may also hold end-user declarations and the identity documents needed to check them. We use this data to perform our contracts, deliver goods, keep accounts and meet our legal obligations, including tax, drug-precursor, explosives-precursor, sanctions and export-control rules. Our legal bases are contract, legal obligation and legitimate interests.

We send customers service messages about their account, such as order updates, statements, payment reminders and notices that a product they buy is back in stock.

Customer portal

If you use our customer portal we hold your email address, the one-time sign-in codes we send you, and a record of your sign-ins and activity in the portal, so that we can give you access to your orders, documents and statements and keep the portal secure.

Business development

We look for companies that may need our products. For this we use business contact details of people in relevant roles (name, job title, company, business email and phone number). We get them from company websites, other public sources and business-contact data providers such as RocketReach. We may email these contacts about products relevant to their work. Our legal basis is our legitimate interest in promoting our business to other businesses. Every such email has an unsubscribe link, and if you object we stop at once and keep only what we need to respect your objection.

AI-assisted processing

We use AI services from Google (Gemini) and OpenAI to help with tasks such as reading supplier documents, drafting product content and researching companies. Where these tasks involve personal data, it is limited to business contact information. We do not make decisions that have legal or similarly significant effects on you solely by automated means.

3. Who we share it with

We share personal data only as needed for the purposes above, with:

other Molekula group companies, where they handle your order, delivery or account;
our service providers, under contracts that require them to protect it: DigitalOcean and Amazon Web Services (hosting and file storage, in London), Cloudflare (network and security), Microsoft (email), Sentry (error monitoring), Google (reCAPTCHA, analytics, advertising, AI), Meta (advertising), OpenAI (AI), RocketReach (business-contact data), Xero (accounting) and EasyPost (shipping labels);
carriers, freight forwarders and customs agents that deliver your goods;
professional advisers, banks and insurers;
authorities, where the law requires it, for example for tax, customs or controlled-substance reporting.

We do not sell personal data.

4. International transfers

Some of the providers above, and our group companies in the United States and China, process data outside the UK. Where a country does not have UK adequacy regulations, we protect transfers with the UK International Data Transfer Agreement or Addendum to the EU standard contractual clauses, or, for certified US companies, the UK Extension to the EU–US Data Privacy Framework.

5. How long we keep it

Accounting records, orders and invoices: six years after the end of the financial year they relate to, as UK tax law requires.
Records required for controlled substances and export control: as long as the relevant law requires.
Enquiries and business contacts with no ongoing relationship: up to three years after our last contact.
Your cookie choice: twelve months. Google Analytics data: fourteen months.
Server and security logs: a short period, normally no more than ninety days.

6. Your rights

You have the right to ask for access to your personal data, to have it corrected or erased, to restrict its use, to receive it in a portable format, and to object to processing based on our legitimate interests. You can object to direct marketing at any time, and we will then stop. Where we rely on your consent you may withdraw it at any time, without affecting what we did before. To exercise any of these rights, email [email protected].

7. Complaints

If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner’s Office (ICO), ico.org.uk.

8. Changes

We may update this policy. The current version is always on this page, with the date it was last updated.

Privacy policy