Sommaire (8)
Courtesy translation — In the event of any discrepancy, the French version shall prevail.
Chapter 01
Data controller
PLC Optimization LLC, operating the PHL brand, alone determines the purposes and means of processing customer and order data: it is the data controller. Lovable Labs Incorporated provides the technical hosting infrastructure (Lovable Cloud) and acts as a processor, processing data on behalf of PHL under the applicable contractual framework. Lovable is not the controller of PHL customer data.
No data protection officer (DPO) is required in view of the processing currently carried out: no public authority, no large-scale regular and systematic monitoring, no advertising profiling, no analytics tracking, no large-scale processing of special-category or criminal-offence data. No DPO is therefore appointed. The data protection contact point is contact@phl.bio. A technical provider's DPO is in no way PHL's DPO. This assessment will be reviewed if processing changes materially.
PLC Optimization LLC is established outside the European Union and offers goods to individuals located in the Union: Article 27 GDPR, on the designation of a representative in the Union, is liable to apply. No representative has been appointed to date. No person or entity is presented here as PHL's representative in the European Union.
EU REPRESENTATIVE (GDPR art. 27) — EXTERNAL LEGAL DECISION REQUIRED. The only open item in this chapter: appointing a representative in the Union is an external decision and cannot be generated by the website. No representative is invented.
Sensitive-data minimization. PHL neither collects nor requests any health data. The free-text “Message” field of the order form is intended solely for information useful to order preparation or delivery, and a notice explicitly asks customers not to enter any health, medical, condition, treatment or other sensitive information there. Any sensitive data volunteered is provided at the customer's sole initiative and is deleted from the record as soon as it is identified.
Chapter 02
Data processed
- Identification and contact data provided when placing an order (name, email, phone/WhatsApp, delivery address).
- Order data: cart contents, amount, PHL-2026-XXXXX reference, status, selected delivery and payment method.
- Correspondence data when the customer contacts PHL by email or WhatsApp.
- Technical data strictly necessary for the operation and security of the website (language preference, cart state, technical logs).
PHL does not collect health data and does not request any medical information. As the products are for research use, no medical profile is created.
No complete banking details are collected or stored on the website: bank transfer and cryptocurrency payments take place outside the website.
Chapter 03
Purposes & legal bases
Chapter 04
Recipients & processors
Data is accessible to authorised PHL personnel and to the technical providers required to operate the service: hosting and database (Lovable Cloud), the professional email provider used to send transactional emails and Private Access communications (Zoho), carriers selected for delivery, and the communication channels used by the customer (email, WhatsApp).
No data is sold or rented to third parties for advertising purposes.
Chapter 05
International transfers
The operating company is established in the United States and certain technical providers may process data outside the European Union, in particular in the United States. Such transfers may involve a legal framework different from that of the European Union.
Where GDPR requirements on international transfers apply, such transfers must be framed by appropriate safeguards in accordance with the applicable contractual and regulatory framework. Data processing agreements published by technical providers may provide for such mechanisms, including EU standard contractual clauses where applicable.
No adequacy decision, certification or specific transfer mechanism is claimed on behalf of PLC Optimization LLC: only the safeguards required by applicable law and the contractual framework of the relevant service providers are relied upon.
Chapter 06
Retention periods
The periods below are TARGET retention periods defined by PHL. They describe the applicable policy; to date, no automated deletion is yet implemented in the system and compliance is carried out through manual intervention.
External messaging: when you contact us via WhatsApp or email, the message is composed on your device and then transmitted by those third-party services. WhatsApp is neither hosted nor controlled by PHL, and the retention of messages by WhatsApp or by your email provider is governed by their own policies. PHL stores only the recorded order in its database; correspondence received in its professional mailbox follows the customer-correspondence retention period above.
Deletion requests: you may request the deletion of your personal data at contact@phl.bio. Such deletion applies subject to the data that PLC Optimization LLC must retain for its legal obligations, its accounting and tax obligations, the establishment, exercise or defence of legal claims, and for fraud-prevention and security purposes. No immediate or unconditional deletion of legally required records can be guaranteed.
AUTOMATED DELETION — NOT ACTIVATED. The periods above constitute PHL's documented retention policy. They are applied manually: no automatic purge process is active to date. An automated retention engine is a planned technical improvement.
Chapter 07
Your rights
Under the conditions provided by applicable regulations, in particular the GDPR where it applies, you have the following rights:
- Right of access to your data.
- Right to rectification.
- Right to erasure, within legal limits.
- Right to restriction of processing.
- Right to object, in particular to processing based on legitimate interest.
- Right to data portability, where applicable.
- Right to withdraw consent at any time, where processing is based on consent.
These rights may be exercised at contact@phl.bio. You also have the right to lodge a complaint with the competent supervisory authority in your country of residence.
Chapter 08
Security
PHL implements reasonable technical and organisational measures to protect data against unauthorised access, loss or alteration. As no system is infallible, PHL cannot guarantee absolute security.