Legal

Information under § 5 of the Austrian E-Commerce Act (ECG).

• Service provider: Ziffer Biolabs
• Address: Oswaldgasse 27-31, Stiege 7/7, 1120 Wien, Austria
• Email: support@ziffer.bio

These terms govern every order placed on this site.

1. Who you are contracting with

You are contracting with Ziffer Biolabs, Oswaldgasse 27-31, Stiege 7/7, 1120 Wien, Austria, email support@ziffer.bio. The same details are in the Impressum and in the footer of every page.

2. What is being sold

Laboratory reagents supplied for in-vitro research and analytical use by qualified professionals. They are not medicinal products, not food, not food supplements, not cosmetics, and not for human or veterinary use. See the research-use policy, which forms part of these terms.

No marketing authorisation has been granted for any item listed here under Directive 2001/83/EC or Regulation (EC) No 726/2004, and none is claimed.

3. Who may order

You may order only if you are acting in the course of a trade, business, craft or profession, or for bona fide research purposes, and you are competent to handle laboratory chemicals. You confirm this at checkout. We may decline or cancel any order, and we may ask for evidence of your research or business capacity before dispatch.

We do not sell to consumers for personal use.

4. Orders and contract formation

Listing an item is an invitation to treat, not an offer. Your order is an offer to buy. A contract is formed only when we send an order confirmation, or dispatch the goods, whichever is earlier. We may decline an order for any lawful reason, including where a compound cannot be lawfully supplied to your destination.

5. Prices

Prices are shown in euro and include VAT where applicable to your destination. Shipping is calculated at checkout and shown before you commit.

We do not display a struck-through reference price unless that price was genuinely charged for at least the preceding 30 days, as required by Directive 98/6/EC as amended by Directive (EU) 2019/2161. In practice we do not use reference pricing at all.

Prices may change. The price that applies is the one displayed when your order is placed.

6. Payment

Payment is by SEPA credit transfer against an invoice, or in Bitcoin. Card payment is not available.

Goods are dispatched once payment has cleared. An invoice is valid for 14 days; unpaid orders lapse after that and the stock is released.

7. Delivery

We dispatch from within the European Union, insulated and tracked. The batch and certificate reference travel on the packing note.

Risk passes to you on delivery. Where you are not acting as a consumer, title passes on payment in full.

Delivery estimates are estimates. Where a shipment is delayed by customs, we will tell you and provide the documentation we hold.

8. Destination restrictions

Some compounds cannot lawfully be supplied to some Member States. Where a restriction applies it is stated on the product page and enforced at checkout. It is your responsibility to know the law that applies where you are; it is ours not to ship into a prohibition we know about.

9. Right of withdrawal

Where you order as a consumer, your statutory right of withdrawal applies as set out in the right of withdrawal notice, including the sealed-goods exception. Where you order in the course of a business, the statutory right does not apply.

10. Conformity and complaints

If goods arrive damaged, short, or not matching their specification, tell us within 14 days of delivery with the batch reference and photographs. We will replace, or refund, at our option.

If your own independent assay disagrees materially with the certificate we published for that batch, send us the report. We will publish it, investigate, and refund or replace where the discrepancy is confirmed.

11. Liability

Nothing in these terms excludes liability for death or personal injury caused by negligence, for fraud, or for anything else that cannot lawfully be excluded — including liability under Directive (EU) 2024/2853 on liability for defective products.

Subject to that, we are not liable for loss arising from use of the goods outside their stated purpose, from storage or handling outside the stated conditions, or from any use in or on a human or animal — which is prohibited by these terms.

Our total liability for any order is limited to the amount you paid for it.

12. Data

We process your data as described in the privacy notice.

13. Governing law

These terms are governed by the law of the state in which the operating entity is established, without prejudice to any mandatory consumer protection you enjoy under the law of your own country of residence.

14. Changes

We may change these terms. The version that applies to your order is the version published when you placed it. Material changes are dated at the foot of these terms.

Everything sold on this site is supplied as a laboratory reagent for in-vitro research and analytical use by qualified professionals.

• Not a medicinal product. No marketing authorisation has been granted for any item listed here under Directive 2001/83/EC or Regulation (EC) No 726/2004.
• Not for human use, not for veterinary use, not for household use, not a food, not a food supplement and not a cosmetic.
• No item listed here is offered for the diagnosis, treatment, cure or prevention of any condition, and no such property is claimed for it.
• We publish no dosage, no administration route, no preparation-for-use instruction and no protocol of any kind, and we will not supply one on request.

Your declaration

By placing an order you confirm that you are ordering in the course of a trade, business, craft or profession or for bona fide research purposes; that you are competent to handle laboratory chemicals; and that you will not administer the material to humans or animals.

Anti-doping

Many of the substances listed are prohibited in sport under the WADA Prohibited List, in some cases at all times. Where that is the case it is stated on the product page. Some are additionally named in national anti-doping legislation. It is your responsibility to know the rules that apply to you.

Handling

No safety data sheet exists in our name for any item listed here, and no classification has been completed for any of them. What that means for handling, and what has to exist before anything is dispatched, is set out under handling and safety.

This notice applies to consumers. Directive 2011/83/EU rights do not apply to purchases made in the course of a trade, business, craft or profession.

Period

You have 14 days to withdraw from this contract without giving any reason. The period expires 14 days from the day on which you, or a third party other than the carrier indicated by you, acquire physical possession of the goods.

How to withdraw

Send us an unambiguous statement of your decision to withdraw — by post or email to the address published in the footer of every page. You may use the model withdrawal form, but you are not obliged to. To meet the deadline it is enough to send your communication before the period expires.

Effects

We will reimburse all payments received from you, including the standard delivery cost, without undue delay and not later than 14 days from the day we are informed of your decision. We may withhold reimbursement until we have received the goods back or you have supplied evidence of having sent them back. You bear the direct cost of returning the goods.

You are liable only for any diminished value resulting from handling other than what is necessary to establish the nature, characteristics and functioning of the goods.

Sealed goods

Every vial is supplied with a tamper-evident seal. Under Article 16(1)(e) of Directive 2011/83/EU the right of withdrawal does not apply to sealed goods which are not suitable for return for health protection or hygiene reasons and which were unsealed after delivery.

An unopened vial with an intact seal remains fully returnable within the 14-day period.

This is the model form set out in Annex I(B) of Directive 2011/83/EU. Using it is optional: any unambiguous statement of your decision to withdraw is enough. See the right of withdrawal notice for the period and its effects.

Where to send it

By post to Ziffer Biolabs, Oswaldgasse 27-31, Stiege 7/7, 1120 Wien, Austria, or by email to support@ziffer.bio.

The form

Complete and return this form only if you wish to withdraw from the contract.

To: Ziffer Biolabs
    Oswaldgasse 27-31, Stiege 7/7, 1120 Wien, Austria
    support@ziffer.bio

I/We (*) hereby give notice that I/We (*) withdraw from my/our (*) contract of sale
of the following goods (*) / for the provision of the following service (*):

  ......................................................................

Ordered on (*) / received on (*):   ..................................

Name of consumer(s):                ..................................

Address of consumer(s):             ..................................

Signature of consumer(s)
(only if this form is notified on paper):

  ......................................................................

Date:                               ..................................

(*) Delete as appropriate.

Business purchasers

The statutory right of withdrawal applies to consumers. Where you order in the course of a trade, business, craft or profession, it does not apply and this form has no effect. The terms of sale set out what does.

We dispatch within the European Union. Some individual products cannot be delivered to some Member States, because supplying them there would not be lawful. Where that applies to a product, the restriction is stated on that product's page, and an order we cannot lawfully fulfil is declined rather than shipped.

We do not block, redirect or limit access to this website on the basis of your nationality, place of residence or place of establishment, and we do not apply different prices or payment conditions on that basis.

Current restrictions

The per-country restriction matrix is not published yet.

It is generated from recorded national control measures and the per-product delivery-area list, and neither input has been through counsel. A matrix that names which compound may lawfully cross which border is only useful if it is right, so an incomplete one is not published here in the meantime. Two tracked blockers hold it: the German Anti-Doping Act position, and the interaction between destination restrictions and the geo-blocking regulation.

What each product page does carry today is the regulatory position recorded for that compound — including that no marketing authorisation exists for it anywhere, and its status under the WADA Prohibited List. That is stated on the page before anything is added to an order.

Not listed

The following compounds are not listed on this site and cannot be ordered here: semaglutide, tirzepatide, melanotan II, bremelanotide (PT-141), tesamorelin, thymosin alpha-1. Requests for them will not be fulfilled.

No reference page exists for them. The catalogue lists only the compounds that are offered, and each listing states the compound's identity figures and the regulatory position recorded for it.

No safety data sheet is published here yet

Article 31 of Regulation (EC) No 1907/2006 puts the safety data sheet on the EU supplier, in an official language of the Member State where the substance is placed on the market. No safety data sheet exists in our name for any item on this site, and no CLP self-classification has been completed for any of them. Both are recorded as open blockers rather than quietly deferred.

A manufacturer's own safety data sheet describes that manufacturer's material and is issued by that company, under its name and its liability. It does not discharge the obligation above, so none is republished here as though it were ours.

What has to exist before anything ships

For each substance: a documented classification decision under Article 4 of Regulation (EC) No 1272/2008, and — where that decision is hazardous — an Annex II safety data sheet in our own name, in the language of the destination. No item is dispatched before both exist for it.

Handling in the meantime

Every item listed here is an uncharacterised laboratory chemical with no classification on record. Handle it as you would any substance whose hazards are unknown, under your own institution's risk assessment and controls. We publish no handling procedure, because we hold no document that would make one anything other than a guess.

Storage conditions shown on a product page are the manufacturer's, quoted from its published specification, and are stated for the material as supplied.

What is not sold, and not to be done with it

Nothing listed here is a medicinal product, a food, a food supplement or a cosmetic, and nothing here is for human or veterinary use. No dosage, no route and no preparation-for-use instruction is published on this site, and none is supplied on request. The research-use policy is part of the terms of sale.

This notice explains how Ziffer Biolabs processes personal data when you use this site.

Controller

The controller is Ziffer Biolabs, Oswaldgasse 27-31, Stiege 7/7, 1120 Wien, Austria. Data protection enquiries go to support@ziffer.bio.

What we collect, and why

We collect as little as the transaction allows.

We do not collect special-category data. We do not ask for, and do not want, any information about your health.

What we do not do

• No advertising or analytics cookies and no tracking pixels unless you accept them (see Ad measurement)
• No profiling by us, and no automated decision-making with legal effects
• No sale, rent or trade of your data, to anyone, ever
• No third-party font or asset host. Until you accept ad measurement the site makes no request to any domain other than its own, so visiting a page does not disclose your IP address to a third party

Ad measurement

We advertise on Meta's and Google's services and, with your consent, measure which of those ads lead to visits and orders. The site asks once, on your first visit, inside the research-use notice, with "Accept cookies" and "Decline cookies". The same answer covers our own visit counts (see Our own visit counts). Until you accept, none of Meta's or Google's code is loaded and nothing is sent to them. Declining stores only your answer.

Who receives the data. Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland (the Meta Pixel and the Conversions API), and Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (the Google tag for Google Analytics and Google Ads, and the Measurement Protocol). Each also uses the data under its own terms, including to choose which ads to show you.

What they receive. For each page you view: its address, the address of the page you came from, your IP address, your browser's user agent and the identifiers in the cookies below. A page whose address is a private link (an order page, a sign-in link, a set-password link) is never reported, and no tag loads on one.

The purchase signal. When you open the page of one of your orders after it is paid, your browser asks our server to report the purchase, and our server sends:

• to Meta, through its Conversions API: your IP address and browser user agent, the identifiers in the _fbp and _fbc cookies, the order's reference, our internal identifier for the order, its SKUs, quantities and prices, its total, and the time it was paid. As the page, Meta is given our site's address followed by /orders, never the order page's own address.
• to Google, through the Measurement Protocol: the identifiers in the _ga and _ga_<id> cookies, that you consented, the order's reference, its SKUs, sizes, quantities and prices, the value of the goods, the shipping charge, and the time it was paid. Not your IP address or user agent: the request comes from our server, so Google sees our server's address.

Never your name, email address or postal address. Each SKU spells out a compound and a size, so both receive what the order contained.

Your browser asks only if you have accepted. It stops asking about an order once it has asked with Google's _ga cookie present, because the purchase cannot be sent to Google without it; until then it asks again whenever you open the order's page. Our server sends an order to each recipient once, counts it as sent only when the recipient has accepted it, and forgets this when it restarts. A repeat carries the same order identifiers: Meta discards a repeat that arrives within 48 hours of the first report, and Google Analytics deduplicates purchase events that carry the same order reference.

Cookies they set on this site, only after you accept:

Meta's script and Google's tag also keep entries of their own in this site's local storage.

Purposes and legal basis. Measuring how our ads perform and attributing purchases to them, on your consent: GDPR Art. 6(1)(a), and for storing and reading the cookies on your device § 165(3) TKG 2021.

Transfers outside the EEA. Meta and Google may process the data in the United States. Those transfers rest on the EU-US Data Privacy Framework (GDPR Art. 45), under which Meta Platforms, Inc. and Google LLC are certified.

Withdrawing. "Cookie settings" at the foot of every page brings the question back, in a bar at the foot of the page. Declining there first tells Meta's and Google's code, where it is running, that consent is withdrawn. Then it deletes the cookies above and those local storage entries from this site, and reloads the page so that none of their code keeps running. Your other open tabs of this site do the same, and so does a page of this site you return to with the back button. They are deleted again each time a page of this site loads, and nothing further is sent. Withdrawing does not affect what was sent before it.

Our own visit counts

With the same consent, we count on our own server how the shop is used: which pages are viewed, which products are added to an order, and how many visits reach checkout and place an order. Nothing is counted until you accept, and our server checks your answer again on every count it receives.

Each count is one row: what happened, the path of the page, for an add the SKU and quantity, for a placed order its number of units and the value of its goods, on the first page of a visit the site that referred you and any campaign labels (utm_source, utm_medium, utm_campaign) on the address you arrived at, a flag for automated traffic, and the daily-salted hash described under Partner links and codes. No IP address, no cookie, no order reference, and nothing you typed. A page whose address is a private link is never counted. The rows are sent to nobody.

Raw rows are deleted after 90 days. Daily totals, which hold no hash, are kept.

Legal basis. Your consent: GDPR Art. 6(1)(a). Declining under "Cookie settings" stops the counting at once.

Your orders and our emails

Every order is kept together with the others placed with the same email address: that is your account. Checkout never asks you to register, and the account exists from your first order. You open it at your orders with a one-time link we email to that address. The link works once, for 15 minutes; only a hash of it is stored, and there is no password.

We email you when an order paid by bank transfer is received (with the details to pay it), when an order is paid, dispatched, cancelled or refunded, and when you ask for a sign-in link. Partners receive a welcome with their code, a link to set a new password when they ask for one, and a note of each payout. These are service emails about something you did or asked for. We send no newsletter and no advertising. Our emails load no images and carry no tracking, so we cannot tell whether one was opened.

Emails leave our own mail server through Amazon Simple Email Service (Amazon Web Services), in its EU region in Stockholm (eu-north-1), which delivers them to your mailbox. Amazon processes the message and your address for us, as our processor under a data processing agreement (GDPR Art. 28). Replies go to support@ziffer.bio.

Partner links and codes

Some links to this site come from partners in our affiliate programme. A partner link carries a code: ?ref= and the code at the end of the address, or the short form /r/ and the code.

Arriving through a partner link stores nothing on your device. The page shows a notice that names the code, says that the partner earns a commission and that your price is unchanged, and offers "Apply to my order" and "Dismiss". "Dismiss" stores nothing. The code is taken out of the address bar either way.

"Apply to my order" stores the code in your browser's local storage, beside your cart. So does typing a code into "Have a partner code?" at the cart or at checkout. The code is then one visible line in the cart and at checkout, and you can remove it there at any time. It is not a cookie, and your browser does not attach it to requests. It reaches our server twice: once when it is checked, at the moment you press "Apply to my order" or type it in, and once as part of an order you place. It does not lapse: it stays in your browser, as that visible line, on every order you place from it, until you remove it or apply another code. It lives in your browser only. Nothing on our servers ties you to a partner, so an order from another device, or after you have cleared your browser's storage, carries no code unless you apply one again.

The site can be set to apply a partner code on arrival instead. That setting is off, and it stays off unless this notice is changed first to say so.

The visit itself is logged on our server. For each visit through a partner link we record the code, the page you landed on, the host that referred you, a flag for automated traffic, and a hash. The hash is SHA-256 over your IP address and browser user agent, made with a random salt held only in server memory and replaced every UTC day. We never store the IP address and we set no cookie. The hash does tell one visitor from another, within a single day: that is what it is for, so that a partner's count of visitors is not a count of page loads. Once a day's salt is gone its hashes cannot be recomputed by anyone, including us, and cannot be linked to a hash from another day.

Raw visit rows are deleted after 90 days. Daily counts per partner are kept.

A partner's invitation to the partner programme is different. A link to the programme's own pages carrying a partner's code shows no notice, stores nothing and is not logged. If the code belongs to an active partner, it is shown on the page and filled into the registration form, where you can see it and clear it before you join.

The code changes no price. The rules partners work under are in the affiliate programme terms.

Affiliate partners

If you register as a partner we hold what the table above lists. We do not verify your email address. We send it a welcome with your code when you register, and a link to set a new password when you ask for one.

Commission is paid in Bitcoin, to the wallet address you enter. A wallet address is public on its blockchain, and payouts to it are visible there to anyone.

Sign-in attempts to the partner area are rate-limited with the same daily-salted hash of your address. No IP address is stored. Each attempt is recorded with the email address that was typed into the form, whether or not it belongs to a partner, and those records are deleted after 30 days.

Every change to a payout address is recorded with its time, and a new address waits before a payout is prepared for it. A transfer cannot be recalled, so an address that nobody has had time to notice is not paid.

Cookies and local storage

• Advertising and analytics cookies, and Meta's and Google's local storage entries, only after you accept them: see Ad measurement.
• Three cookies of our own exist, all strictly necessary. Two are session cookies, and neither is set by browsing the shop. One is for partners: it is limited to the partner area and set only when a partner registers, signs in or sets a new password. The other is for customers: it is limited to your orders and set only when you sign in there with a link we emailed you. The third, zf_consent, records your answer to the measurement question (accepted or declined, and which version of the question) for six months. It holds no identifier.
• Your cart, and a partner code you applied, live in your browser's local storage. Both are put there by your own actions, both are visible to you, and both can be removed by you.
• When you answer the research-use notice shown on your first visit (with "I understand", or with either answer to the measurement question it carries), one entry in the same local storage records that, so the notice does not return on every page. It holds no identifier and nothing about you.
• When your browser has asked for a paid order's purchase signal with Google's _ga cookie present (see Ad measurement), one entry in the same local storage records that order's reference, so it does not ask again.

Nothing else of ours is stored on your device.

Who else sees your data

Only parties that must, to fulfil your order:

• the carrier, for delivery
• Amazon Web Services, which delivers our emails to your mailbox (see Your orders and our emails)
• our bank or the Bitcoin payment infrastructure, for payment
• our accountant and tax authority, for statutory records
• the customs authority, where an import declaration requires it

Only with your consent, Meta Platforms Ireland Ltd. and Google Ireland Ltd. also receive what Ad measurement describes.

Where you applied a partner code to your order, that partner sees that an order was placed with their code, the date it was paid and its commissionable value. The partner never sees who placed it, and never sees what it contained. If that partner joined the programme with another partner's code, the other partner sees the same figures for the second-tier commission the order earns them, and nothing more.

If you are a partner and joined with another partner's code, that partner sees how many partners joined with their code and, for each paid order placed with yours, its date, its commissionable value and the second-tier commission it earned them. They are never shown your name, your email address or your code.

Each receives the minimum needed. Personal data leaves the EEA for marketing purposes only with your consent, to Meta and Google in the United States (see Ad measurement). Where an international shipment requires a transfer, it is limited to what the customs declaration demands.

How long we keep it

Order, invoice and accounting records for the statutory retention period applicable to the entity's state of establishment — typically six to ten years. Batch traceability records for as long as product liability exposure persists under Directive (EU) 2024/2853. Everything else is deleted when the purpose ends.

Raw rows for visits through a partner link are deleted after 90 days; daily counts per partner are kept. Raw rows of our own visit counts are deleted after 90 days; daily totals are kept. Records of sign-in attempts to the partner area are deleted after 30 days. A sign-in link to your orders expires after 15 minutes and is deleted a day later; a session ends after 30 days, or after 7 days unused. The record of which emails we sent about an order is kept with that order. A partner's ledger and payout records are accounting records and are kept for the same statutory period, together with the account they belong to.

Your rights

Under GDPR Articles 15 to 22 you may request access to your data, rectification, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests. Ask, and we will answer within one month.

Where we hold data to satisfy a statutory retention duty we cannot delete it on request, and we will tell you plainly which duty applies rather than refusing without explanation.

You may complain to the supervisory authority in your country of residence or place of work.

Security

Data is held on infrastructure in the European Union. Payment credentials never reach our servers: bank transfers happen at your bank, and Bitcoin payments settle to a node we operate without us handling card or account credentials at any point.

Orders are stored on our own server. The public website writes an order through a database role that cannot read a customer's name, email address or delivery address back out of it; it learns your email address only while you are signed in, and only from your own session. Partner passwords are stored only as argon2id hashes. Customer accounts have no password at all.

Changes

Material changes are dated at the foot of this notice. The version that applied when you ordered governs that order.

These terms govern the Ziffer affiliate programme. While the programme is closed no registration is taken, no code is valid and no commission accrues.

In these terms a partner is a person or business registered in the programme. "You" is the partner. Figures are the programme settings at the date shown at the foot of these terms. If a setting changes, these terms change with it (section 17).

1. What this is

An affiliate programme. A partner gets a code and a link. When a customer chooses to apply that code to an order, and the order is paid, the partner earns a commission on it.

A partner can also invite other partners. When a partner who joined with your code earns a commission on an order, you earn a second-tier commission on the same order, on top of theirs (section 4).

You join by registering. We can close registration, and we can suspend or end any partnership, at any time.

The programme as a whole is either open or closed. While it is closed, registration is refused, codes are not valid and nothing accrues. An order paid while it is closed earns nothing, whenever it was placed. Commission already in your ledger stays there under these terms.

Registering gives you a code. It does not give you our agreement to anything you publish. Sections 9 to 13 apply from the first minute.

2. Who may join

A person of full legal age, or a business, publishing under a name we can trace to them.

You register at /affiliates/join, in the partner area. We ask for your name, your email address, a password you choose, and where you publish. Company, VAT ID and country are optional. You accept the content rules in section 9 and these terms when you register, and the version you accepted is recorded with your account. Your account, your code and your link exist at once.

One account and one code per partner.

If another partner sent you, you may give their code when you register; their invitation link fills it in for you, and you can clear it. It is recorded with your account and is not changed afterwards except by us. Section 4 says what it means for them and what it does not mean for you.

We do not verify your email address. Register with an address you control: we send it a welcome with your code, a note of each payout, and, when you ask for one at the sign-in page, a link that sets a new password. The link works once, for 60 minutes.

Do not register if your channels fall under section 12.

3. Your code and link

Your code is generated by us: ZF followed by six characters. It carries no meaning. You cannot choose it and you cannot change it. A code that spelled a word would itself be a statement about a product.

Your link is any page of this site with ?ref= and your code added, or the short form /r/ followed by your code, which redirects to the same place. The portal builds both.

Your invitation link is the programme page with your code: /affiliates?ref= and your code, or /r/ followed by your code and ?to=/affiliates. A visitor who arrives through it is shown the programme first; when they join, your code is on their registration form.

The code changes no price. A customer pays the same with it and without it. It is not a discount, a voucher or a coupon, and you may not describe it as one.

The code and the link remain ours. They stop working the moment you are suspended or terminated, and while the programme is closed.

4. What earns commission

There are two kinds of commission, and both are percentages of the commissionable value of a paid order.

Commissionable value is the merchandise after any pack or volume discount. Shipping is never part of it. VAT is taken out of it once orders record VAT. Today they do not, so the base is the merchandise figure as charged, and each ledger row records which of the two bases it used.

Direct commission is earned on a paid order that carries your code. Its rate comes from a ladder, read from your commissionable sales over the trailing 90 days.

Second-tier commission is earned on a paid order that carries the code of a partner who joined with yours, where that order earns them a direct commission. Its rate is the ladder's second column, read from the same rung as their direct rate on the same order: the rung of their sales, not of yours.

An order is rated by the sales that preceded it. The order that crosses a threshold earns the old rates. The next one earns the new rates.

Both rates are fixed at the moment the order turns paid and are written on the ledger rows. They do not change afterwards.

The second tier is paid on top of the direct commission. Nothing is taken from the partner who made the sale: their rate is the same as it would be had they joined with no code. If you joined with another partner's code, the same is true of you.

The second tier is one level deep. You earn nothing on the orders of partners who joined with the code of a partner who joined with yours.

Second-tier commission does not count toward your own commissionable sales. Your rung is read from the orders that carry your code, and from nothing else.

We may agree a different direct rate with you in writing. It then replaces the ladder for you. It does not change the second tier on your orders, which is still read from the ladder.

No direct rate above 15 % and no second-tier rate above 5 % exists. Those ceilings are constraints in our database, not settings. No agreement, correction or adjustment can exceed them. One order therefore carries at most 15 % in direct commission and 5 % in second-tier commission.

5. What does not

• Your own orders. An order whose email address or VAT ID matches yours earns nothing. A commission on your own purchase would be a discount, and the code changes no price. That holds for the second tier too: your own order placed with the code of a partner who joined with yours earns them their commission and earns you nothing.
• Orders paid while you are suspended or terminated, of either kind.
• Orders paid while the programme is closed.
• Orders that are not paid: placed, awaiting payment, cancelled or lapsed.
• Refunded orders, to the extent of the refund (section 7).
• Orders without your code on them. A visit through your link earns nothing by itself.
• Shipping charges.
• For the second tier: an order that earns the partner whose code is on it nothing, for any reason above, earns no second tier either.

Where an order carried your code and earned nothing for one of the first three reasons, we record the order and the reason. Where it earned its partner a commission and no second tier for one of them, we record that as well.

6. Attribution

Attribution is per order, and the customer decides it.

Arriving through your link applies nothing and stores nothing on the visitor's device. The site shows a notice that names your code, says that you earn a commission and that the price is unchanged, and offers two buttons: "Apply to my order" and "Dismiss". A customer can also type a code at the cart or at checkout.

An applied code is one visible line in the cart and at checkout. The customer can remove it at any time before ordering.

The last code applied wins. A second code replaces the first.

An applied code does not lapse. It stays in the customer's browser and is applied, visibly, to every order placed from that browser, until the customer removes it or applies another code.

That binds a browser, not a person. Nothing on our servers ties a customer to a partner: a customer who orders from another device, or who has cleared their browser's storage, orders with no code unless they apply one again.

We check the code again when the order is placed. If you are not active at that moment, or the programme is closed, the order carries no code.

7. Pending, approved, paid

Pending. When the order is paid, the commission is posted to your ledger as pending.

Approved. 30 days after payment we approve it, provided the order has not been refunded in full and you are active. Approval is an act by a person, and our database refuses one made before the hold has passed. The hold covers the 14-day withdrawal period. It can be changed, never to fewer than 14 days.

Paid. Approved commission goes into a payout (section 8).

Second-tier commission follows its order in all of this: it is posted, held, approved and reversed with the order, as direct commission is, and paid with your other commission. It is not approved while the partner who made the sale is suspended.

Refunds reverse commission. A full refund reverses all of it. A partial refund reverses the same proportion. The refunded value also comes off your trailing sales.

If the commission was already paid out, the negative amount stays on your ledger and is set against future payouts.

The ledger is append-only. A wrong row is corrected by another row and is never edited.

8. Payouts

Monthly. One payout per partner per calendar month.

The minimum is €50. A payable balance under the minimum carries forward.

Payouts are made in Bitcoin, on-chain, and in no other way. You enter a Bitcoin address in the portal.

Commission is determined in euro. We convert it at the time of the transfer.

A person makes the transfer from our own wallet and records its transaction id. No software of ours moves money. The address is fixed for a payout at the moment the payout is prepared; a later change applies to the next one.

Check the address before you save it. A transfer to an address you entered wrongly cannot be recovered, and that risk is yours.

A new or changed address waits seven days before a payout is prepared for it, and every change is recorded. A transfer cannot be recalled, so an address nobody has had time to notice is not paid. If your address changes and you did not change it, tell us at once.

Only an active partner is paid.

The tax position of payouts is not settled. Open questions: whether VAT applies and who accounts for it, whether we issue a self-billed credit note or you send us an invoice, how a payout in Bitcoin is valued and documented, whether we must identify you before we may pay you, and what we must report to an authority. No payout is made until our accountant and counsel have settled them. Commission accrues and is held in the meantime. These terms will then say what was decided. Your own taxes on what you earn are yours to declare and pay.

9. Content rules

What you publish about us is assessed as if we had published it. Under EU medicines law a product is judged by how it is presented, a disclaimer does not repair a presentation, and the presentation of anyone paid by the seller counts as the seller's. So the rules for your content are the rules for this site.

• No statement about any effect of a compound on a person or an animal.
• No quantities, schedules or routes of use. No preparation instructions.
• No framing of any product as being for use in or on people or animals.
• No before-and-after material.
• No testimonials and no accounts of use: not yours, not a customer's, not anyone's.
• No implication. The impression counts, not only the words. That rules out the soft verbs — supports, improves, enhances, promotes, boosts, aids, optimises, restores — and any image, caption, hashtag or surrounding content that suggests a use.
• No naming of a supplier or manufacturer of ours, and no guessing at one.
• No statement about price other than the price shown on this site. The code is not a discount.
• No statement made in our name. You do not speak for Ziffer.

These rules cover everything you publish with or near your code or link: posts, captions, replies, comments, stories, video, audio, images, alt text, hashtags, profile text and private answers to people who ask.

If someone asks you what a compound does or how it is used, the answer is that you cannot say. Point them to the research-use policy.

10. Approved copy only

The only statements about a product you may publish are the approved-copy texts in the portal. Publish them word for word. Do not shorten one, add to one or combine two into something new. A translation is a new text and needs our written agreement first.

The approved texts are kept in our repository and pass the same automated check as this site's own copy.

You may state facts about yourself and about your relationship with us: that you are a partner, and that you earn a commission. You may link to any page of this site.

If you want to say something that is not there, ask. If we agree, it is added to the approved copy. Until then it is not approved.

11. Disclosure

Every placement carries a clear advertising disclosure. Every post, every video, every page, every time — not once per channel.

The required wording:

Advertisement. I earn a commission on orders placed with this code.

Put it directly with the code or link, readable without a click and at least as legible as the code. Not below a fold, not only in a profile, not as a hashtag alone. Where a platform has its own paid-partnership label, use that as well, not instead.

An invitation to other partners is a placement too. Its wording is:

Advertisement. I earn a commission on the orders of partners who join with this code.

Sections 9 to 12 apply to invitations as to everything else you publish, and they bind every partner who joins with your code in the same words.

12. Where you may not promote

• No promotion in sport, physique or body-weight communities: forums, groups, channels, hashtags or accounts built around training, competition, physique or body weight.
• No paid search advertising on compound names or on our brand name.
• No coupon, voucher or deal sites. The code is not a discount, so listing it as one is false.
• No email campaigns and no direct-message campaigns. No unsolicited email or direct messages at all.
• Nothing aimed at minors.

If you are unsure whether a placement is allowed, it is not. Ask first.

13. Review and records

Nobody reviews your channels before your code works, and no review stands between you and a payout. That is not permission. The rules bind you from registration, and a breach found later counts from the day it was published.

We may look at what you publish at any time. Where we do, we keep written notes of what we looked at, what we found and what we told you. They are internal.

Tell us when you start publishing on a channel you did not list when you registered.

When we ask for a link to a placement or a copy of it, send it. When we ask you to correct or remove a placement, do it without delay and confirm it.

14. Suspension, termination and forfeiture

Suspension. We may suspend you at any time while we look into something. Your code stops working at once. While you are suspended, orders paid earn nothing, and nothing of yours is approved or paid out. You can still sign in and read your ledger.

Termination for breach. We may terminate you for a breach of sections 9 to 12, for orders you placed or arranged yourself, for false details at registration, or for anything that puts our legal position at risk. On termination for breach all commission not yet paid out is forfeited, pending and approved alike. It is taken off your ledger in one row that states the reason. Your code stops working and you can no longer sign in.

When a partner who joined with your code is terminated for a breach, the second-tier commission you have not yet been paid on their orders is taken back, order by order. What was already paid out to you stays paid.

Ending without breach. You may leave at any time by telling us in writing, and we may end your participation at any time by telling you. From that day you remove your code and link from your placements. Your account stays open while commission already earned runs its course under sections 7 and 8: it is approved once its hold has passed, and it is paid in the monthly payout if the approved balance reaches the minimum. The account is closed after that payout, or once no approved balance at or above the minimum can arise. A balance below the minimum at that point is not paid out.

Afterwards. Remove your code, your link and the approved copy from every placement you control. Section 9 continues to apply to anything you leave up.

15. Data

What we hold about you: your registration (name, email address, where you publish, and company, VAT ID and country where given, and the partner whose code you joined with, if any), the version of these terms you accepted and when, your password as an argon2id hash and in no other form, your payout details (a Bitcoin wallet address), every change to that address and when it was made, your ledger and payouts, and any notes we make about your account.

A wallet address is public on its blockchain. Payouts to it are visible there to anyone.

The portal sets one session cookie when you sign in. It is limited to the partner area and is set for nobody else.

What you can see about orders: that a paid order carried your code, its date, its commissionable value, the rate, the commission and its state. You also see daily click counts for your link. You never see who placed an order, its order reference or what it contained, and we hold nothing that identifies a visitor.

What you can see about the partners who joined with your code: how many there are and how many are active, and for each paid order placed with one of their codes, its date, its commissionable value, your second-tier rate and amount, and its state. You never see their names, email addresses or codes, or which of them an order came from. If you joined with another partner's code, that partner sees the same about the orders placed with yours.

Do not try to work out who placed an order.

The privacy notice describes all of this, including what is recorded when someone follows your link.

16. No agency, no exclusivity

You are an independent contractor. You are not our employee, agent or representative. You cannot bind us and you do not speak for us.

Nothing here is exclusive. We may work with other partners. You may work with other sellers.

You bear your own costs.

None of this changes how your content is assessed. Because we pay you, a regulator may regard what you publish as ours. That is why sections 9 to 12 exist.

17. Changes and governing law

We may change these terms and the programme settings. A change applies to orders paid after it is published. Material changes are dated at the foot of these terms. If you do not accept a change, stop using your code and tell us in writing; section 14 then applies.

These terms are governed by the law of the state in which the operating entity is established, which is Austria.