Privacy Policy
Who is responsible
Peppies Research, Bulgaria. Contact privacy@peppies.eu, or see the imprint. This policy covers this website only. The policy for peppies.eu, the app, blood testing and clinician sessions is a separate and considerably longer document, because those services process health data.
What this site collects
The email address you type into the form, if you choose to, together with which page you were on, which language you were reading, and any campaign parameters that were in the link you arrived through. Those parameters tell us which advertisement or guide brought you here, and they are stored with your entry.
The quiz and landing pages also count anonymous steps (page opened, question answered, finished, scrolled, tapped) with the country they came from. These counts carry no identifier, no answers and nothing that could single you out.
Our hosting provider records standard server log data — IP address, time of request, page requested, browser user agent — which is technically necessary to deliver the page and keep it secure.
TikTok advertising measurement
This applies only if you arrive through one of our TikTok ads. Those links contain a click ID that TikTok adds (ttclid). Our server uses it to tell TikTok three things, so TikTok can see whether the ad led anywhere: that you opened a quiz page, that you answered its first question, and that you signed up. Each report goes from our server straight to TikTok and contains the click ID, the event, an event number and the page address, and nothing else: no IP address, no browser details, no email address. Legal basis: our legitimate interest in measuring our advertising (GDPR Art 6(1)(f)). You can object at any time at privacy@peppies.eu.
TikTok visitors also see a one-line bar asking whether we may load TikTok's pixel. Nothing happens until you answer. If you tap Yes, the pixel script is loaded from analytics.tiktok.com. It sets cookies (names starting with _tt, ttcsid or ttclid, kept for up to 13 months) and sends TikTok your page views on this site and the same three events. Our server's reports then also include your IP address, browser user agent, the _ttp cookie value and, if you sign up, your email address as a SHA-256 hash. Legal basis: your consent (Art 5(3) ePrivacy Directive and its national laws, such as § 25(1) TDDDG in Germany, and GDPR Art 6(1)(a)). If you tap No, the pixel is not loaded and nothing is set. Your answer is remembered only in this browser tab, until you close it.
For collecting and transmitting this data, TikTok Technology Limited (Dublin, Ireland) and we are joint controllers (GDPR Art 26). What TikTok does with the data afterwards is its own responsibility and is described in TikTok's privacy policy at tiktok.com/legal. TikTok may process data outside the EEA.
What this site does not do. No Meta pixel, no Google Analytics, no fonts or scripts loaded from anyone else's server. The only third-party script is TikTok's pixel, and it loads only after you tap Yes in the bar, which appears only if you came from a TikTok ad. Everyone else gets no cookies and nothing stored in the browser, and nothing you do here is tracked across other websites.
Why we are allowed to process it
- Your email address and the campaign parameters stored with it: your consent, given by submitting the form (GDPR Art 6(1)(a)). You can withdraw it at any time.
- TikTok pixel, and the extra data in our server's reports: your consent in the bar (see above). You can withdraw it with the button above.
- Click-ID-only reports to TikTok: our legitimate interest in measuring our advertising (GDPR Art 6(1)(f)).
- Anonymous step counts and server logs: our legitimate interest in delivering, securing and improving the site (GDPR Art 6(1)(f)).
What we do with your email address
We use it to create your account and to send you the information about verification, blood testing and clinician access described on this site. We do not sell it or rent it. The only time it goes to an advertiser is the SHA-256 hash described under TikTok above, and only if you tapped Yes. Every message includes a one-click unsubscribe.
Who processes it for us
The site is hosted by Cloudflare, Inc., which operates the servers that deliver these pages and stores form entries on our behalf. Cloudflare processes this data under a data processing agreement and the EU Standard Contractual Clauses.
TikTok is not our processor: see the joint-controller note under TikTok above.
How long we keep it
Your email address until you ask us to delete it or unsubscribe, whichever comes first. Server logs for the short retention period set by our hosting provider, after which they are deleted or anonymised.
Your rights
Under the GDPR you have the right to ask what data we hold and get a copy (Art 15), to have inaccurate data corrected (Art 16), to have it deleted (Art 17), to restrict how it is used (Art 18), to receive it in a portable format (Art 20), to object to processing based on legitimate interest (Art 21), and to withdraw consent at any time without affecting processing already carried out (Art 7(3)).
To use any of these, email privacy@peppies.eu. You may also complain to a supervisory authority — in Bulgaria the Commission for Personal Data Protection, or the authority where you live.
Minors
This site is not directed at anyone under 18 and we do not knowingly collect data from minors.
Changes
If this site starts doing more than it does today, this policy is updated before that goes live, not after. The TikTok section above was added on 26 September 2026, together with the consent bar.