Privacy policy

1. Who is responsible for your data

PlasmidAgent is the controller of personal data used to operate this website, manage customer accounts and provide the service. For sequence data and sample metadata submitted by a customer, we normally act as that customer's processor and follow its instructions.

Contact [email protected] with privacy questions, rights requests or complaints. The operator's registered identity and address must be added here before launch.

2. Data we collect

We may collect:

• name, work email, organisation, role and account details
• billing contacts, invoices, payments and transaction records
• API keys in protected form, authentication events and permissions
• sequence files, reference data, sample identifiers, analysis settings and results submitted through the service
• IP address, device and browser data, API requests, logs, error records and security events
• support messages, feedback and marketing preferences

3. How we use data and our legal bases

We use personal data to:

• provide accounts, analyses, reports, support and billing where this is needed to perform a contract or take steps before a contract
• secure, monitor and improve the service where this is necessary for our legitimate interests in operating a safe and effective product
• keep financial, corporate and compliance records where the law requires it
• send product news or marketing where you have consented or where permitted by law, subject to your right to opt out
• establish, exercise or defend legal claims where this is necessary for our legitimate interests or legal obligations

4. Scientific data

Plasmid sequences and laboratory sample identifiers are not always personal data. They become personal data if they identify or can reasonably be linked to a living person. Customers control what they submit and must avoid patient data, human genomic data and special category data unless suitable written terms and a lawful basis are in place.

We do not use customer sequence data to train general-purpose machine learning models unless the customer has expressly agreed to that use in writing.

5. Who receives data

We may share data with providers that supply cloud hosting, storage, security, communications, customer support, billing and professional advice. They may use data only under our instructions and contract, unless they act as an independent controller for a stated purpose.

We may also disclose data when required by law, to protect rights or security, or as part of a financing, reorganisation or sale. Confirm and publish the live subprocessor list before launch.

6. International transfers

Some suppliers may process data outside the United Kingdom. Where the destination is not covered by UK adequacy regulations, we use an approved transfer mechanism such as the UK International Data Transfer Agreement or the UK Addendum, together with supplementary safeguards where required. Contact us for information about the safeguard used for a particular transfer.

7. Retention

We keep personal data only for as long as needed for the purpose for which it was collected, including legal, accounting and security requirements. Customer contracts or account settings determine the active retention period for uploaded files and analysis results.

As a draft policy, account and contract records are kept for up to six years after the relationship ends, security and API logs for up to 12 months, and support correspondence for up to two years. Backups may retain deleted data for a limited recovery period. Confirm these periods against the live systems before launch.

8. Security

We use technical and organisational measures designed to protect data, including access controls, encryption in transit, logging, backups and incident procedures. No internet service can guarantee complete security. Customers must protect their credentials and configure their systems appropriately.

9. Your rights

Depending on the circumstances, you may ask for access to your personal data, correction, erasure, restriction, or a portable copy. You may object to processing and may withdraw consent at any time where consent is the legal basis. Withdrawing consent does not affect earlier lawful processing.

You have the right to object at any time to direct marketing. You may also object to processing based on legitimate interests. We will stop unless we have compelling lawful grounds to continue.

To exercise a right, email [email protected]. We may need enough information to verify your identity and locate the relevant data. Rights can be limited by law and do not all apply in every case.

10. Complaints

Contact us first so we can investigate your concern. You may also complain to the Information Commissioner's Office through its data protection complaints service.

11. Cookies and local storage

The public website currently uses only storage that is necessary to deliver requested features and protect the service. If we add analytics or advertising technologies that require consent, we will provide a choice before using them and update this notice.

12. Automated decisions

The service produces automated plasmid QC results, but we do not use personal data to make solely automated decisions that have legal or similarly significant effects on individuals. Customers remain responsible for reviewing results and deciding how to use them.

13. Changes to this policy

We may update this policy when the service, suppliers or law changes. We will post the revised version here and change the date above. We will give reasonable notice if a change materially affects how we use personal data.