Service providers & data recipients

These organisations receive or process personal data where necessary to provide services to New-U or our customers, listed by the categories set out in § 07 of the Privacy Policy.

Not every organisation listed here is our processor. Depending on the service and the processing activity, a provider may act as our processor, as a subprocessor, or as an independent controller in its own right — carriers and payment providers commonly do the latter for parts of their own processing, under their own privacy notices. Where required, our relationships are governed by appropriate contractual and data-protection terms.

Companion to

Updated

28 August 2026

01 Providers by category

Category Provider Typical role What it is used for Hosting and infrastructure Vercel; DigitalOcean Processor Serving the website and application across multiple regions, including the EEA and the United States, and supporting infrastructure. Database and storage Supabase Processor Managed PostgreSQL holding customer, order and account records, and object storage for community-forum image uploads. Encryption key management Amazon Web Services (KMS) Processor Managing the keys used to encrypt sensitive fields. Payment processing Cashu, CLKK, Conduit, Conflux, Etomin, Lexicons, MoneyEU, NexaPay, Niftipay, NOWPayments, PassimPay, Paymento, PayRam, Payriox, Peptide-Pay, Quiklie, TagadaPay, and direct cryptocurrency transfer. Generally independent controller Taking and settling a payment. These are integrated providers; which are available to you depends on your region, currency and the transaction, and not every integration is active at a given time. The methods you can actually choose are the ones shown at checkout. What each type of provider receives is in § 06 of the Privacy Policy. A payment provider generally determines its own purposes for fraud, anti-money-laundering and settlement processing and acts as an independent controller for that, under its own privacy notice. Fulfilment and carriers Royal Mail; USPS; DHL; MaltaPost; Australia Post Generally independent controller Delivering an order. Recipient name and delivery address. A carrier runs its own delivery network and keeps its own records, so it generally acts as an independent controller for that processing. Which carrier handles a destination is published on Shipping & Delivery. Shipment tracking 17TRACK Processor Reporting carrier status. Order reference and tracking number only. We do not share your email address with the tracking provider; tracking notifications are sent by us. Communications MailerSend Processor Transactional email, opt-in SMS and marketing email. Analytics Google (Tag Manager and Analytics); Vercel Analytics and Speed Insights Varies by service Aggregate site usage and performance measurement. Some analytics providers determine their own purposes for part of the processing; check the provider's own notice. Customer support Anthropic Processor AI-assisted customer-support functionality. Where required to resolve a support request, limited account or order information relevant to that request may be processed. Address validation Google Varies by service Checking that a delivery address entered at checkout is deliverable.

02 Transfers and safeguards

Several of these organisations are established outside the EEA and the United Kingdom. Where personal data is transferred internationally and applicable law requires additional safeguards, we use an appropriate transfer mechanism applicable to that relationship. Depending on the provider and destination, this may include an adequacy decision, the European Commission Standard Contractual Clauses together with any required UK addendum, or an equivalent lawful mechanism.

This page does not assert which mechanism covers which provider, because that is a per-relationship fact that has to be verified rather than assumed — naming a mechanism we had not checked would be a compliance claim we could not stand behind. The verified position for each provider (role, destination, data categories, transfer basis, governing terms and the date it was last checked) is maintained in our internal data-protection register, and we will tell you the mechanism applying to your order on request.

You can request the specific transfer mechanism applying to your order, or the identity of the payment provider that handled a particular payment, from newu.io.peptides@gmail.com.

03 How this page is maintained

This page lists the organisations currently in use. It is updated when one is added or retired.

A provider change does not by itself require a new Privacy Policy version where the processing category, purposes, data categories, lawful basis, recipient role (processor / subprocessor / independent controller), retention approach and applicable transfer safeguards all remain materially unchanged.

If any one of those does change, that is a change to the policy itself and is published as a new revision of the Privacy Policy, not quietly here. The test is deliberately stricter than “same category”: swapping a processor for a provider that would act as an independent controller, or that would receive a different class of data, changes what the policy tells you even though the row heading stays the same.

Related information

PRECISION. PURITY. PERFORMANCE.

Research peptides at >99% HPLC-verified purity, third-party tested by Janoshik Analytical & Freedom Diagnostics, with Certificates of Analysis published per released batch. Supplied strictly for laboratory research use.

Shop

All research compounds

Price list

Where to buy peptides

Research