Legal
Privacy notice
How Peps & Protocols collects and uses your personal data, why, who helps us, how long we keep it, and the rights you have.
Who we are
This notice explains how Peps & Protocols collects and uses your personal data when you use pepsandprotocols.com, fill in one of our forms, read our emails or speak with us.
The controller of your data is Scaling Solutions, trading as Peps & Protocols, Dubai Silicon Oasis, Dubai, United Arab Emirates. In this notice “we” and “us” mean that company.
Privacy questions: info@pepsandprotocols.com.
What this notice covers
This notice covers the website, our free guides, the 2-minute bloodwork check, the coaching application, the women's waitlist, the contact form, our emails and, if you ask for it, WhatsApp messages.
It does not cover health data from coaching clients. Clients get a separate Health Data Consent at onboarding, and no health data is collected before it is signed.
Please don't send us health details
None of our public forms asks for medical details, test results or what you take, and please don't include them. If a message reaches us with health details anyway, we reply without repeating them, delete them from our records, and point you to the right route.
What we collect
What you give us in our forms
| Form | What we collect |
|---|---|
| Free guide download | First name, email, which guide you asked for. Optional: mobile number and the WhatsApp, newsletter and coaching boxes you tick. |
| 2-minute bloodwork check | Your answers are scored in your browser. They are not sent to us and not stored. If you ask for your result by email we receive only: first name, email, your result group, the goal you picked, when you want to start, your age band and your country. Optional: mobile number and the boxes you tick. |
| Coaching application | First name, email, mobile number, the goal you picked, your age band, whether you use peptides or similar compounds now (yes, no or “on the call”, never names or doses), whether you had a blood test in the last 12 months (not the results), what has frustrated you, what you have tried, when you want to start, whether you can invest in coaching, your country and the boxes you tick. |
| Women's waitlist | First name, email, age band, country and the boxes you tick. Optional: mobile number. |
| Contact form | First name, email, the topic and your message. Optional: mobile number. |
| Newsletter | Email and first name. Optional: mobile number. |
Every form also records the page you used and, if the link you clicked had them, its campaign tags (where you came from, for example an Instagram bio link).
What we collect automatically
When you visit the website: your IP address, browser and device, the pages you view, the page that sent you, and, if you open our emails, whether you opened them and which links you clicked. Analytics and advertising cookies are only set if you accept them (section 11).
When you speak with us
If you book a Strategy Meeting we receive the time you picked and the details on the booking. Calls are recorded for an accurate record and for training only if you agree at the start of the call. You can say no.
Why we use it, and on what legal basis
| What we do | Legal basis (GDPR Article 6) |
|---|---|
| Send the guide or check result you asked for | Our legitimate interest in answering your request |
| A short series of follow-up emails after a guide download or the check, and Bobby's weekly email | Our legitimate interest in following up on what you asked for. Every email has a one-click unsubscribe, and the form tells you this before you send it. |
| Coaching updates for applicants and the women's waitlist: founding seats, waitlists, the membership | Our legitimate interest in keeping you informed about what you applied or signed up for. Unsubscribe with one click. |
| WhatsApp messages from Bobby | Your consent, given with its own unticked box. Reply STOP any time. |
| Handling your application and the Strategy Meeting | Steps you ask us to take before a contract (6(1)(b)) |
| Messages about your programme if you become a client | Our contract with you (6(1)(b)) |
| Answering your contact message | Our legitimate interest in replying to you |
| Recording a call | Your consent, asked at the start of the call |
| Website analytics and advertising cookies | Your consent through the cookie banner |
| Keeping invoices and payment records | Legal obligation (6(1)(c)) |
| Keeping the site and our systems secure, and preventing abuse | Our legitimate interest |
Where we rely on legitimate interest, you can object at any time (section 10). Where we rely on consent, you can withdraw it at any time; that does not affect what we did before.
We do not sell your data, we do not use it to profile you for anyone else, and we never put health details in advertising tools.
How the check and the application route you
The check and the application use your answers to show you a result and the next page. For example, coaching is for 25 and over, so an applicant under 25 is shown a different page and cannot book a call. No other decision with legal or similarly significant effects is made about you by a machine. A person reads every application.
Who processes it for us
We use service providers who process data on our behalf, under a data processing agreement:
- HubSpot (HubSpot, Inc. and HubSpot Ireland Ltd): website hosting, forms, contact records, email, meeting booking and analytics. Our HubSpot account is hosted in HubSpot's EU data centre.
- Google: Google Meet for the Strategy Meeting, and, only with your cookie consent, Google Analytics and Google Ads.
- Meta: WhatsApp, only if you tick the WhatsApp box, and, only with your cookie consent, the Meta advertising pixel.
- OpenAI: an advertising measurement pixel, only with your cookie consent.
- The tool we use to record a call, only if you agree to a recording, and our payment provider at checkout if you become a client.
We may also share data when the law requires it, or to protect our legal rights.
International transfers
We are based in the United Arab Emirates, outside the European Economic Area, and some of our providers are in the United States. When your data leaves the EEA we use the safeguards the GDPR requires, such as the European Commission's standard contractual clauses. You can ask us for a copy.
How long we keep it
- Guide, check, newsletter and waitlist contacts: until you unsubscribe or ask us to delete your data, or 24 months after you last opened an email or used a form, whichever comes first.
- Applications that do not lead to coaching: 12 months after the application.
- Contact messages: 12 months after our last reply.
- Call recordings: deleted once they are no longer needed for the reason you agreed to, and at the latest 12 months after the call.
- Client records: for the length of the programme and as long as the law requires afterwards.
- Invoices and payment records: as long as tax law requires.
If you unsubscribe we keep your email address on a suppression list so we don't email you again.
Your rights
You can ask us to:
- give you a copy of your data;
- correct it;
- delete it;
- restrict how we use it;
- send it to you or to someone else in a portable format.
You can object to our use of your data based on legitimate interest, and you can always object to direct marketing; we then stop. You can withdraw any consent at any time, for emails with the unsubscribe link in every email.
Email info@pepsandprotocols.com. We reply within one month. We may ask you to confirm your identity first.
You can also complain to the data protection authority where you live, for example the Autoriteit Persoonsgegevens in the Netherlands, the Gegevensbeschermingsautoriteit in Belgium or the AEPD in Spain. We'd appreciate the chance to sort it out first.
Cookies
We use cookies to keep the site working, to see which pages help and which don't, and, if you allow it, to measure our advertising. No health data goes into them.
- Necessary: needed for the site, forms and your cookie choice. Always on.
- Analytics: HubSpot analytics (for example the hubspotutk and __hs cookies) and Google Analytics. Only with your consent.
- Advertising: the Google Ads, Meta and OpenAI pixels. Only with your consent.
You choose in the cookie banner. To change your mind, clear this site's cookies in your browser and the banner asks again.
Age
Our website and emails are not meant for anyone under 18, and coaching is for 25 and over. If you think someone under 18 has given us their details, email us and we will delete them.
Changes to this notice
We update this notice when what we do changes. The version and date are at the top. If a change matters to you, we tell you by email before it applies.
Version 1.0, 12 October 2026.
Contact
Scaling Solutions, trading as Peps & Protocols, Dubai Silicon Oasis, Dubai, United Arab Emirates. Privacy questions: info@pepsandprotocols.com.
Company details: imprint.