Privacy Policy

When you place an order or register as a partner on PEPMAKE, we collect the following personal information necessary to fulfill your order and provide our services:

• Contact Information: Full name / institution name, email address, phone number.
• Shipping Information: Delivery address, postal code, and destination country.
• Order Information: Products purchased, quantities, order totals, and payment status.
• Partner Information: Social platform handles (if registering as a referral partner).
• Technical Data: IP address, browser user agent, and referral source (via Cloudflare analytics).

We use your personal data strictly for the following purposes:

• Processing and fulfilling your orders (including customs documentation and logistics).
• Sending order confirmations, payment receipts, and shipment tracking notifications via email.
• Managing our partner referral program (attributing referrals and calculating commissions).
• Improving website performance and security (via Cloudflare Web Analytics and D1 database auditing).
• Complying with legal obligations, including tax reporting and anti-fraud measures.

We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

For users in the European Economic Area (EEA), our legal basis for processing your data includes:

• Contractual Necessity: Processing your order and delivering products you purchased.
• Legitimate Interest: Preventing fraud, securing our platform, and improving service quality.
• Consent: For optional cookies (analytics and marketing), which you may withdraw at any time.

• All data is stored in Cloudflare D1 (SQLite), distributed across Cloudflare's global edge network.
• Order records are retained for 7 years to comply with tax and accounting regulations.
• Partner referral data is retained for the duration of the partner relationship plus 2 years.
• Cookie consent preferences are stored in your browser's localStorage and expire after 365 days.
• You may request deletion of non-mandatory personal data by contacting us (see Section 9).

We use the following categories of cookies:

You can manage your cookie preferences at any time by clearing your browser's localStorage or using the cookie consent banner that appears at the bottom of our website.

We implement industry-standard security measures to protect your data:

• All API traffic is encrypted via HTTPS (TLS 1.3) with HSTS preload enabled.
• Passwords are hashed using PBKDF2-SHA256 with 100,000 iterations and per-user salt.
• Admin and partner authentication uses signed HMAC-SHA256 JWT tokens with short expiry.
• Payment processing is handled by OxaPay — we never store or process credit card numbers.
• Cloudflare D1 databases are encrypted at rest and in transit.
• Content Security Policy (CSP) headers prevent XSS and content injection attacks.
• Admin access is protected by IP rate limiting, JWT signatures, and audit logging.

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of your personal data we hold.
• Rectification: Correct inaccurate or incomplete data.
• Erasure: Request deletion of your data (subject to legal retention requirements).
• Portability: Receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdraw Consent: Withdraw cookie consent at any time via browser settings.

To exercise any of these rights, contact us at the email address below. We will respond within 30 days as required by GDPR.

PEPMAKE operates on Cloudflare's global edge network. Your data may be processed in data centers located in the United States, European Union, and Asia-Pacific regions. Cloudflare maintains certifications under the EU-US Data Privacy Framework (DPF), UK Extension, and Swiss-US DPF for compliant cross-border data transfers.

For privacy-related inquiries, data access requests, or to exercise your rights, contact us:

📧 Email: [email protected]
📧 Orders: [email protected]
🌐 Website: https://pepmake.com

We aim to acknowledge all requests within 48 hours and resolve them within 30 calendar days. If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local supervisory authority.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. We will notify registered users of material changes via email. The "Last updated" date at the top of this page indicates when the most recent changes took effect.