Privacy Policy

Researchers coming to us for our services entrust us with special category information that is covered by extra legal protections. We thank the visitors who have taken the time to read and understand these policies. Protecting this information is a responsibility we take very seriously and we commit to handling your information in a way that’s open and transparent.

Basic Outline

This page provides the details of our policies and practices regarding the collecting, use, and sharing of any protected information. The language is transparent and compliant with the Data Protection Act 2018 (DPA), the UK General Data Protection Regulation (GDPR), and other UK and European Union data protection laws.

Getting Started

Researchers can contact us via email or use our website’s contact form with any questions about our policies, and we encourage all visitors to read all of the information presented here to clearly understand how we handle all data.

Data Collection

Most information collected helps to maintain the services we provide. Basically, two different types of data are gathered. Each has its own uses and some of them can be modified by our visitors.

User Provided Data

This is information given to us directly from the customer while doing various things on our site, like creating an account, making an order, or contacting customer support. It’s commonly given information to any website for processing, typically a name and shipping address at a minimum. A working phone number and active email address are also gathered.

Automatically collected Data

There are digital tools gathering information in the background automatically while browsing our site. Most commonly known is Cookies, which we’ll detail later. Most gather technical information unique to each visitor, usually in the form of a visitor’s device information, IP address, time zone, and the browser being used. Interactions with our site and the links we provide are also gathered for customisation.

Using the Data

Data is primarily used to process and complete orders. It gives us the ability to legally verify and dispense the research materials, process the shipping, and take care of payments.

Contact Details

To provide the majority of our services, collecting up-to-date contact information is required for efficient order processing and lawful compliance. Some data is also used for improving the user’s experience.

Aggregate Data

These are details we look at to help us improve our overall product availability and services. We’re able to keep our website interactions seamless and efficient while maintaining security. No personal data is ever used for marketing without express permission to do so.

Personal Data and Payment Handling

The only personal information we keep on our servers is contact information. We don’t process or store banking details, debit card, or credit card details beyond what is needed for processing payments. Financial transactions are done under the Payment Card Industry Data Security Standards through registered e-commerce platforms such as Monzo and accredited institutions like major banks.

Checking Out

Payment information is first secured through encryption during checkout. It’s then passed directly to personnel authorised to handle it. The only financial transaction data we can store is a card’s authorisation code and last 4 digits. They allow us to get confirmation from the customer and are a fixed part of fraud prevention.

Proper Handling

In some circumstances we’re given individual health information required for processing. This and all sensitive personal information is restricted to very limited access and stays controlled through encryption while it’s going through TLS/SSL during processing and when it’s “at rest”. These cryptographic protocols are used to secure internet communication and only those qualified can process this information.

Individual Data Rights

Everyone in the UK has important rights regarding their personal information that are protected under several data protection laws. While some information is required for specific services visitors are under no obligation or requirement to share any of their personal details. Visitors also have the right to file a complaint with the Information Commissioner’s Office at any time.

Access and correction

Individuals can claim access to their stored personal information at any time through a data subject access request. They can also ask that incomplete or inaccurate information be corrected.

Erasure and Objections

An individual’s data may need to be deleted for a particular reason. Our visitors have the right to erasure, also known as the right to be forgotten. They can also object to their information being processed, especially for marketing. They can request a restriction to processing, meaning we’d only be able to store it but not use it.

Responding to requests

We want to provide customers with as timely an action as possible. Once we’ve received a legitimate request, we will respond to it within a month. Please feel free to contact us to exercise any of these rights at any time.

Cookies and Analytics

There are several analytic and tracking technologies used, strictly to maintain the ability to function, and for visitors to do things like securely log in.

Performance Cookies

These help us pinpoint and count the number of visitors we have and how they navigate the platform. This improves our site’s functionality, for example, by organising in a way that makes browsing easier.

Google Analytics and Cookie settings

This service helps us gather trends on our visitors’ behaviour patterns during navigation and standard internet login information. Marketing and advertising cookies are sometimes used, but only through direct consent. Our customers can manage cookies in any way that they’d like. They can change cookie preferences either through the pop-up on our website or directly through their browser settings.

GDPR Compliance

All of our activities are built around remaining GDPR and DPA 2018 compliant. We, the data controller, assert that user data rights are comprehensive. We are mandated to provide fully lawful processing, minimal data collection, accuracy, limited purpose, and information security.

Lawful Activity

The lawful agreement between us and our visitors to process data for completing orders is contractual. To send marketing communications, the lawful basis is individual consent that can be withdrawn at any time. We affirm that the lawful basis for our analyses and security activities is a legitimate interest in running our business soundly as long as our practices do not stand in the way of an individual’s fundamental rights.

Data Security

Our site implements the needed security measures designed to prevent personal data from being accidentally lost, used, altered, or accessed without authorisation. We maintain data encryption, secure servers, and access limits on personal information. Personal data is only kept as long as needed for specific purposes.

Breaches

There are procedures in effect for any suspected personal data breaches. We’ll notify any customer and applicable authority of the breach when legally bound to do so. However, we cannot guarantee absolute digital safety as internet transmission and electronic storage are not always completely secure.

Updates to our Privacy Policy

We reserve the right to post any changes to this page and will notify customers by email when appropriate. There will be a date at the bottom of this page indicating when the most recent changes took place. We ask all visitors to read this page periodically to keep up with any changes. Please contact our Data Protection officer by email or by postal address, both of which can be found on the homepage.