Privacy Policy

Effective date: August 1st 2026
Version: 2608011

1. Introduction

MyAssays Limited, also referred to in this policy as “MyAssays Ltd”, “MyAssays”, “we”, “us” or “our”, is committed to protecting personal data and respecting the privacy rights of individuals who use our website, products and services.

This Privacy Policy explains:

• what personal data we collect;

• how and why we use it;

• the lawful bases on which we rely;

• who we share it with;

• how long we retain it;

• how we protect it; and

• the rights available to individuals under applicable data protection law.

This policy applies to our websites at myassays.com, myassays2.com and mycurvefit.com, registered and subscription accounts, assay-analysis services, support services, communications, marketing activities and related online tools.

This policy should be read together with our Website Terms of Use, the applicable Service Terms, including the Data Processing Schedule, and any separately agreed institutional or customer agreement that applies to the use of our services.

2. Who we are

MyAssays Limited is a company registered in England and Wales under company number 07089538.

Our registered office is:

MyAssays Limited
21 Hampton Place
Brighton
East Sussex
BN1 3DA
United Kingdom

For personal data that we determine the purposes and means of processing, MyAssays Limited is the controller.

2.1 Data protection responsibility

MyAssays Limited has assessed whether it is required to appoint a Data Protection Officer under applicable UK data protection law.

Based on the nature, scope and scale of its current personal-data processing activities, MyAssays Limited is not presently required to appoint a statutory Data Protection Officer.

We have designated a Privacy Contact to oversee data protection matters and to receive privacy enquiries, rights requests and data protection complaints.

The Privacy Contact can be contacted at:

Email: privacy-2617@myassays.com; or

Post: Privacy Contact, MyAssays Limited, 21 Hampton Place, Brighton, East Sussex, BN1 3DA, United Kingdom.

We keep our need to appoint a Data Protection Officer under review, particularly where there are material changes to the scale or nature of our processing activities.

3. When we act as controller and processor

3.1 When MyAssays acts as controller

We normally act as controller for personal data used for:

• creating and administering user accounts;

• managing subscriptions and payments;

• communicating with users and institutional contacts;

• providing support;

• protecting our systems and preventing fraud;

• operating and improving our website;

• complying with legal and regulatory obligations; and

• sending marketing communications where permitted.

3.2 When MyAssays acts as processor

An institutional or business customer may upload data to the MyAssays service or generate data through the service. That information may include personal data relating to the customer’s employees, researchers, study participants, patients or other individuals.

Sample IDs are intended to be non-identifying laboratory, study or research codes. However, a customer may submit information that constitutes personal data, including pseudonymised data, where the customer or another party can associate a code with an identifiable individual.

Where we process such personal data only on the customer’s documented instructions, the customer is normally the controller and MyAssays acts as its processor.

Our processing in that capacity is governed by the applicable Service Terms, including the Data Processing Schedule, or by any separately agreed data-processing terms between MyAssays and the customer. The customer is responsible for establishing an appropriate lawful basis, providing required privacy information to affected individuals and ensuring that its instructions comply with applicable law.

This Privacy Policy does not replace the applicable Service Terms, including the Data Processing Schedule, or any separately agreed contractual data-processing terms.

4. Definitions

For the purposes of this policy:

“Data Processing Schedule” means the data-processing terms incorporated into the applicable MyAssays Service Terms that govern MyAssays’ processing of personal data on behalf of a customer.

“Service Terms” means the applicable MyAssays Terms and Conditions of Service, including any schedules, order terms or other contractual documents incorporated into them.

“Personal data” means information relating to an identified or identifiable living individual.

“Special category data” includes personal data revealing or concerning matters such as health, genetics, biometrics, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership or sexual life or orientation.

“Customer Content” means data and material submitted to, stored in, configured through or generated through the MyAssays service by or for a customer. It may include assay measurements, protocols, standards, samples, configurations, files, analysis parameters, prompts, results, reports and related metadata.

Customer Content is not necessarily personal data. This Privacy Policy applies to Customer Content only to the extent that it contains personal data.

“Processing” includes collecting, recording, storing, using, altering, accessing, disclosing, transferring, analysing and deleting personal data.

5. Personal data we may collect

Depending on how an individual interacts with MyAssays, we may collect the following categories of personal data.

5.1 Identity and contact information

This may include:

• name;

• title and position;

• employer or institution;

• department;

• business or institutional address;

• email address;

• telephone number; and

• other contact details.

5.2 Account and authentication information

This may include:

• username;

• encrypted or hashed password information;

• account identifier;

• subscription type;

• account status;

• login and logout records;

• authentication events;

• password-reset activity; and

• user preferences.

We do not have access to a user’s password in readable form where passwords are stored using appropriate cryptographic protection.

5.3 Professional and institutional information

This may include:

• organisation or institution;

• professional role;

• research or laboratory function;

• areas of professional interest;

• purchasing authority; and

• information required to administer an institutional subscription.

5.4 Subscription, payment and transaction information

This may include:

• subscription selections;

• quotations;

• billing address;

• invoices;

• payment status;

• transaction dates and values;

• tax information;

• purchase history; and

• limited payment-card information received from a payment provider.

Full payment-card details are processed by Stripe and are not stored by MyAssays.

5.5 Communications and support information

This may include:

• support requests;

• emails and other correspondence;

• feedback;

• complaint information;

• survey responses;

• records of telephone or online communications; and

• technical information supplied while resolving an issue.

5.6 Website, device and usage information

This may include:

• IP address;

• browser type and version;

• operating system;

• device type;

• language and time-zone settings;

• referring website;

• pages viewed;

• links and tools used;

• dates and times of access;

• session information;

• diagnostic records;

• error logs; and

• security-event information.

5.7 Cookie and preference information

This may include:

• cookie identifiers;

• consent choices;

• website preferences;

• information about interactions with our website and communications.

Further information about our use of cookies and similar technologies is provided in section 10 of this Privacy Policy.

5.8 Referral, promotion and marketing information

This may include:

• referral or discount code;

• identity of the referring organisation or individual;

• use of a promotion;

• marketing preferences;

• newsletter subscriptions;

• communication history; and

• records of consent or opt-out requests.

5.9 Customer Content and assay-related information

This may include:

• assay data;

• laboratory measurements;

• sample IDs;

• protocol information;

• plate layouts;

• standards and controls;

• uploaded spreadsheets or files;

• analysis settings;

• calculated results;

• reports;

• notes; and

• associated metadata.

Customers should not upload directly identifying patient, participant or other sensitive personal data unless this is necessary, lawful and expressly permitted under their agreement with MyAssays.

Where Customer Content contains special category data, the customer must ensure that an appropriate condition for processing that data applies and that suitable contractual, technical and organisational safeguards are in place.

5.9.1 Sample IDs

MyAssays allows users to enter Sample IDs. Sample IDs are intended to consist of non-identifying laboratory, study or research codes.

Users must not enter names, email addresses, NHS numbers, medical-record numbers, dates of birth or other directly identifying information in a Sample ID field unless this has been expressly agreed with MyAssays and is lawful under the customer’s applicable agreement.

A coded Sample ID may still constitute personal data where the customer or another party can associate the code with an identifiable individual. Where MyAssays processes such information solely to provide services to a Business or Organisational Customer, the customer normally acts as controller and MyAssays acts as processor under the applicable Service Terms, including the Data Processing Schedule.

5.10 AI-assisted feature information

Where a user accesses an AI-assisted feature, we may process:

• prompts and instructions;

• protocol descriptions;

• assay configuration information;

• uploaded context;

• system responses;

• feedback on responses;

• technical logs; and

• information required to detect misuse or improve the reliability of the feature.

Users should not include personal data, confidential patient information or directly identifying research-participant information in AI prompts unless this is expressly permitted and necessary for the service.

5.11 Public or shared content

Where the service allows a user to post information to a discussion area, shared workspace or other collaborative facility, we may process the content submitted and information showing who submitted it.

Users should understand the intended visibility of an area before submitting information.

5.12 Security and fraud-prevention information

This may include:

• suspected fraudulent activity;

• unusual account behaviour;

• failed access attempts;

• blocked IP addresses;

• device and session identifiers;

• records of reported misuse; and

• information relevant to an investigation.

5.13 Information received from third parties

We may receive personal data from:

• an individual’s employer or institution;

• an institutional account administrator;

• payment providers;

• referral partners;

• service providers;

• publicly available professional sources;

• fraud-prevention providers;

• authentication providers; and

• regulators, law-enforcement bodies or professional advisers.

Where required, we will tell individuals the source of the information.

6. How we use personal data and our lawful bases

We use personal data only where we have a lawful basis.

Purpose	Categories commonly used	Lawful basis
Registering and administering an account	Identity, contact, account and professional information	Performance of a contract or taking steps at the individual’s request before entering a contract
Providing free or subscription services	Account, Customer Content, usage and support information	Performance of a contract; where acting as processor, processing on the customer’s documented instructions
Administering institutional accounts	Identity, contact, role and account information	Performance of a contract and our legitimate interests in administering customer relationships
Processing subscriptions, invoices and payments	Contact, transaction and billing information	Performance of a contract and compliance with legal obligations
Providing support and responding to enquiries	Contact, account, communications, technical and Customer Content information	Performance of a contract and our legitimate interests in supporting users and improving service quality
Maintaining service security and availability	Account, authentication, device, usage, log and security information	Our legitimate interests in protecting users, information, systems and services; compliance with legal obligations
Detecting fraud, abuse and prohibited activity	Account, transaction, device, usage and security information	Our legitimate interests in preventing fraud and misuse and establishing or defending legal claims
Operating and improving the website and services	Usage, device, feedback, survey and support information	Our legitimate interests in understanding and improving our services; consent where required for cookies or similar technologies
Developing features and analysing service performance	Usage, technical, feedback and appropriately anonymised or aggregated information	Our legitimate interests in service development and quality assurance; consent where required
Providing AI-assisted functionality	Prompts, configuration information, Customer Content and technical logs	Performance of a contract; our legitimate interests in providing and securing the feature; where acting as processor, the customer’s documented instructions
Sending service and account communications	Contact and account information	Performance of a contract and our legitimate interests in administering the service
Sending marketing communications	Contact, professional, marketing-preference and transaction information	Consent or our legitimate interests, including any applicable business-to-business or existing-customer marketing rules
Administering referrals and promotions	Contact, referral and transaction information	Performance of the promotion, consent or our legitimate interests, depending on the circumstances
Complying with law and regulatory requests	Any relevant information	Compliance with legal obligations and our legitimate interests in protecting our legal position
Managing disputes and legal claims	Account, transaction, communications, Customer Content and security information	Our legitimate interests in establishing, exercising or defending legal claims
Business restructuring or sale	Relevant customer, supplier, account and transaction information	Our legitimate interests in managing our business and a potential transaction, subject to appropriate confidentiality measures

Where we rely on legitimate interests, we consider whether the processing is necessary and whether the individual’s interests, rights or freedoms override our interests.

Individuals may contact us for further information about a legitimate-interest assessment relevant to their personal data.

7. Special category data

MyAssays does not require users to provide special category personal data merely to create an account, purchase a subscription or use standard account-management functions.

However, assay data, sample information or associated results may constitute health, genetic or other special category personal data where they relate to an identified or identifiable individual.

A coded or pseudonymised Sample ID may still constitute personal data where the customer or another party retains information that can link the code to an individual. Pseudonymised information is not the same as anonymous information and remains subject to applicable data protection law.

Customers must not enter names, email addresses, NHS numbers, medical-record numbers, dates of birth or other directly identifying information in Sample ID fields unless:

• this is necessary for the permitted use of the service;

• it has been expressly agreed with MyAssays;

• the customer has identified an appropriate lawful basis and special-category condition;

• affected individuals have received any required privacy information; and

• appropriate contractual, technical and organisational safeguards are in place.

Where MyAssays acts as a processor of Customer Content, we engage subprocessors only under appropriate written terms and in accordance with the applicable Service Terms, including the Data Processing Schedule.

Where MyAssays processes special category personal data solely on behalf of a Business or Organisational Customer, that processing is governed by the applicable Service Terms, including the Data Processing Schedule.

• process the information only on the customer’s documented instructions;

• apply appropriate technical and organisational security measures;

• ensure that authorised personnel are subject to confidentiality obligations;

• assist the customer with applicable data protection obligations as required by law and contract; and

• return or delete the information at the end of the service relationship in accordance with the applicable Service Terms, including the Data Processing Schedule, and applicable legal requirements.

The customer remains responsible for determining whether submitted assay data constitutes special category personal data and for ensuring that the processing is lawful, necessary and proportionate.

Where MyAssays processes special category personal data for its own purposes, MyAssays will identify an applicable lawful basis under Article 6 of the UK GDPR and an appropriate condition under Article 9, together with any additional requirements under the Data Protection Act 2018.

8. AI-assisted technology

MyAssays may provide tools that use AI-assisted technology to help users create, configure, develop or review assay protocols and analysis settings.

AI-assisted output may be incomplete, inaccurate or unsuitable for a particular scientific or regulatory purpose. Users remain responsible for reviewing and validating outputs before relying on them.

Where personal data is processed through an AI-assisted feature, we will:

• identify the purpose and lawful basis for the processing;

• limit personal data to what is necessary;

• apply appropriate access and security controls;

• provide relevant information about third-party AI providers where required;

• use appropriate contractual and international-transfer safeguards; and

• provide information about any applicable automated decision-making rights.

MyAssays does not use Customer Content to train a general-purpose AI model or permit an AI provider to use Customer Content for its own model training unless the customer has expressly agreed to that use in writing.

9. Automated decision-making

MyAssays does not currently use personal data to make solely automated decisions about individuals that produce legal effects or similarly significant effects.

AI-assisted assay configuration or data-analysis support is intended to assist a user and does not, by itself, make a legal or similarly significant decision about an individual.

If this changes, we will provide appropriate information about:

• the use of automated decision-making;

• the logic involved;

• the significance and expected consequences;

• the safeguards applied; and

• the individual’s rights to obtain human intervention or challenge a decision, where applicable.

10. Cookies and similar technologies

10.1 What cookies are

Our website and online services use cookies and similar storage and access technologies.

A cookie is a small text file placed on a user’s computer, mobile device or other equipment when they visit a website. Cookies may allow a website to recognise a device, maintain a secure session, remember preferences, understand how the service is used or provide other functionality.

Similar technologies may include:

• local storage;

• session storage;

• pixels and tags;

• software development kits;

• device identifiers; and

• other technologies that store information on, or access information from, a user’s device.

In this section, references to “cookies” include these similar technologies unless stated otherwise.

10.2 How we use cookies

MyAssays currently uses cookies and similar technologies only where they are necessary to operate, secure and provide our website and online services.

We use these technologies for purposes including:

• authenticating registered users;

• maintaining secure user sessions;

• applying account roles and access permissions;

• securing forms and transactions;

• processing payments;

• detecting and preventing fraud, misuse and unauthorised access; and

• providing functionality specifically requested by the user.

MyAssays does not currently use cookies for website analytics, advertising, cross-site tracking, behavioural profiling or personalised marketing.

If we introduce additional cookies or similar technologies in future, we will update this Privacy Policy and implement any consent or objection mechanism required by applicable law before using them.

10.3 Categories of cookies

Strictly necessary cookies

MyAssays currently uses only cookies and similar technologies that are necessary to provide, operate and secure the website and online services requested by the user.

These technologies include cookies used for:

• account authentication;

• maintaining a logged-in session;

• applying user roles and access permissions;

• server-side session management;

• securing payments and transactions; and

• detecting and preventing fraudulent or malicious activity.

We rely on the strictly necessary exception for these technologies and do not request consent for their use.

Users may block or delete these cookies through their browser settings. However, doing so may prevent users from logging in, maintaining a secure session, accessing account functions or completing a payment.

Functionality cookies

MyAssays does not currently use separate non-essential functionality cookies.

If we introduce functionality cookies in future, we will assess whether consent or another applicable legal exception is required and will update this Privacy Policy accordingly.

Analytics and statistical cookies

MyAssays does not currently use analytics or statistical cookies.

If we introduce analytics or statistical technologies in future, we will assess whether consent is required or whether an applicable statistical-purpose exception is available. Where required, we will obtain consent or provide an appropriate objection mechanism before using those technologies.

Marketing and advertising cookies

MyAssays does not currently use marketing, advertising, retargeting, cross-site behavioural tracking or personalised-advertising cookies.

We will not introduce such technologies without first updating this Privacy Policy and obtaining any consent required by law.

10.4 First-party and third-party cookies

First-party cookies are cookies placed on the MyAssays website domain and used to operate and secure the MyAssays service.

MyAssays uses first-party cookies for:

• authenticating registered users;

• maintaining secure user sessions;

• applying user roles and access permissions; and

• maintaining server-side session state.

These cookies are provided through the Microsoft ASP.NET technology used by the MyAssays application.

MyAssays also uses Stripe in connection with subscription payments. Stripe may place cookies on the MyAssays website domain to support payment security, device recognition and fraud prevention. Although these cookies appear as first-party cookies because they are placed on the MyAssays domain, Stripe provides and operates the underlying payment-security technology.

Stripe may process certain information for its own legal, regulatory, security and fraud-prevention purposes. In relation to that processing, Stripe may act as an independent controller. Stripe’s own privacy information also applies to its processing.

MyAssays does not currently use third-party cookies for analytics, advertising, behavioural profiling, social-media tracking or personalised marketing.

Microsoft Azure and Twilio SendGrid provide hosting and email-delivery services respectively, but they are not currently identified as placing or accessing cookies or similar technologies on users’ devices through the MyAssays websites.

If we introduce any additional first-party or third-party cookies or similar technologies, we will update this Privacy Policy and implement any consent or objection mechanism required by applicable law before using them.

10.5 Session and persistent cookies

Session cookies normally expire when the user closes their browser or ends the relevant session.

Persistent cookies remain on the user’s device for a specified period or until the user deletes them.

We do not retain cookies for longer than reasonably necessary for their stated purposes.

10.6 Cookies currently used

The following table identifies the cookies and similar technologies currently used by MyAssays.

Cookie or technology	Provider	Purpose	Category	First/third party	Duration	Consent or exception
__stripe_mid	Stripe	Helps Stripe identify devices and detect or prevent fraudulent payment activity	Payment security	First-party cookie set through Stripe.js	1 year	Strictly necessary
__stripe_sid	Stripe	Supports Stripe payment-session security and fraud detection	Payment security	First-party cookie set through Stripe.js	30 minutes	Strictly necessary
.ASPROLES	MyAssays / Microsoft ASP.NET	Caches the logged-in user’s roles or permissions	Authentication/authorisation	First party	Session	Strictly necessary
.ASPXFORMSAUTH	MyAssays / Microsoft ASP.NET	Stores the forms-authentication ticket used to keep a user logged in	Authentication	First party	Session	Strictly necessary
ASP.NET_SessionId	MyAssays / Microsoft ASP.NET	Identifies the browser session so that server-side session state can be maintained	Session management	First party	Session	Strictly necessary

10.7 Cookie consent and preferences

The cookies currently used by MyAssays are necessary for account authentication, session management, access control, payment processing and fraud prevention. We rely on the strictly necessary exception for these technologies and do not request consent for their use.

Users may block or delete cookies through their browser settings. However, blocking strictly necessary cookies may prevent users from logging in, maintaining a secure session or completing a payment.

MyAssays does not currently use analytics, advertising or other non-essential cookies.

If we introduce a technology that requires consent, we will update this Privacy Policy and implement an appropriate consent-management mechanism before using that technology.

10.8 Browser settings

Most browsers allow users to view, block and delete cookies.

Browser settings may also allow users to:

• reject all cookies;

• reject third-party cookies;

• delete cookies when the browser closes; or

• receive a warning before a cookie is stored.

The method varies between browsers and devices.

Blocking all cookies may prevent users from logging in or using important parts of the MyAssays service.

10.9 Personal data collected through cookies

Information collected through cookies may include:

• IP address;

• device and browser information;

• operating system;

• session identifier;

• login status;

• dates and times of access;

• pages and features used;

• referring website;

• error and diagnostic information.

Where this information relates to an identified or identifiable individual, it constitutes personal data and will be handled in accordance with this Privacy Policy.

Our lawful bases, recipients, international-transfer arrangements, retention practices and users’ rights are explained elsewhere in this Privacy Policy.

10.10 Changes to the cookies we use

We may update the cookies and similar technologies used by MyAssays when we:

• introduce or remove website features;

• change service providers;

• improve security;

• alter our analytics arrangements; or

• change our marketing practices.

We will update the table in section 10.6 when material changes occur.

Where a change introduces a new technology requiring consent, we will request consent before using that technology.

The “Last updated” date at the beginning of this Privacy Policy indicates when this section was most recently reviewed.

11. Marketing

Where an individual requests a demonstration, creates a trial account, downloads trial material or asks for information about a service, we may contact them to provide requested support, seek feedback and discuss relevant MyAssays services. We will do so under an appropriate lawful basis and in accordance with applicable electronic-marketing rules.

We may send information about MyAssays products, services, features, training or events where permitted by law.

We may rely on consent, an applicable existing-customer rule or legitimate interests for appropriate business-to-business communications, depending on the recipient and communication method.

Individuals may opt out at any time by:

• using the unsubscribe facility included in a marketing message;

• changing available account preferences; or

• contacting us.

Opting out of marketing does not prevent us from sending necessary account, subscription, security or service communications.

We may retain limited information on a suppression list to ensure that an opt-out preference is respected.

We will not provide personal data to an unrelated third party for that third party’s independent marketing unless we have clearly informed the individual and have an appropriate lawful basis.

12. When we share personal data

We may share personal data with the following recipients where necessary and lawful.

12.1 Service providers and processors

We use selected service providers to operate, secure and support the MyAssays services. These providers may process personal data only for authorised purposes and subject to appropriate contractual and data-protection requirements.

Our current principal service providers include:

Provider	Service provided	Personal data that may be processed
Microsoft Azure	Cloud infrastructure, application hosting, data storage and backup services	Account information, Customer Content, technical information, usage records, security logs and other information stored or processed through the MyAssays service
Stripe	Subscription billing, payment processing and payment fraud prevention	Name, email address, billing information, payment and transaction information, IP address, device information and fraud-prevention signals
Twilio SendGrid	Transactional and service-related email delivery	Recipient email address, sender information, email content, message identifiers, delivery status, bounce information and related email-delivery records

The precise role of a provider may depend on the relevant processing activity. A provider may act as:

• our processor where it processes personal data solely on our instructions;

• our subprocessor where it processes Customer Content on behalf of an institutional customer for whom MyAssays acts as processor; or

• an independent or joint controller where it determines some of its own processing purposes, such as regulatory compliance, payment security or fraud prevention.

Service providers may themselves use approved affiliates and subprocessors. Further information about relevant providers, processing locations and international-transfer safeguards may be requested from our Privacy Contact.

12.2 Institutional customers and account administrators

Where an account is provided or paid for by an institution, authorised institutional administrators may receive information about the account, such as:

• user identity;

• account status;

• subscription use;

• access permissions; and

• information reasonably required to administer the institution’s service.

The institution may be an independent controller of that information.

12.3 Referral partners

Where an individual uses a referral or discount code, we may provide the relevant partner with limited information necessary to verify use of the code or administer the referral.

Before doing so, we will provide appropriate notice and establish a lawful basis. We will not disclose information beyond what is reasonably necessary for the stated purpose.

12.4 Professional advisers

We may share information with lawyers, accountants, auditors, insurers and other professional advisers where necessary to obtain advice, manage risk or establish, exercise or defend legal claims.

12.5 Public bodies and legal recipients

We may disclose information where required or permitted by law, including to:

• courts;

• regulators;

• law-enforcement bodies;

• tax authorities; and

• other competent public authorities.

12.6 Corporate transactions

If MyAssays is involved in a merger, acquisition, financing, restructuring or sale of all or part of its business or assets, relevant information may be disclosed to prospective parties and advisers subject to appropriate confidentiality arrangements.

Any recipient acquiring the relevant business will be required to use personal data consistently with applicable law.

12.7 Customer-directed sharing

Where a Customer or user creates a Share Link, MyAssays makes the selected Customer Content available through the link at that Customer’s or user’s direction.

Depending on the configuration of the feature, any person possessing the Share Link may be able to access the Shared Content. MyAssays does not select or verify the intended recipients unless the relevant feature expressly provides recipient-verification controls.

The Customer is responsible for determining whether the disclosure is lawful, selecting authorised recipients, communicating the Share Link securely and providing any required privacy information to affected individuals.

Where Customer Content contains personal data and MyAssays acts as Processor, generating and maintaining the Share Link forms part of the processing carried out on the Customer’s documented instructions under the applicable Service Terms, including the Data Processing Schedule.

MyAssays will disable or delete a Share Link following a verified request from an authorised Customer or user. This prevents future access through the link but cannot recall information previously accessed, downloaded, copied or further disclosed by a recipient.

13. Selling personal data

MyAssays does not sell personal data or Customer Content in exchange for money.

We do not permit service providers to use personal data received from us for their own unrelated purposes except where separately disclosed and permitted by law.

The disclosure of information to a processor providing services to MyAssays, or the transfer of information as part of a corporate transaction, is not treated by us as a sale of personal data.

14. Aggregated and anonymised information

We may generate statistical, aggregated or anonymised information for purposes such as:

• service monitoring;

• scientific or technical research;

• usage reporting;

• capacity planning;

• benchmarking;

• product development; and

• business analysis.

We will take reasonable measures intended to prevent individuals from being identified from information treated as anonymous.

Where information can still be linked to an identifiable individual, we will continue to treat it as personal data.

15. International transfers

Some suppliers or service providers may process personal data outside the United Kingdom.

Where a disclosure constitutes a restricted international transfer, we will use a transfer mechanism permitted under applicable UK data protection law. Depending on the circumstances, this may include:

• UK adequacy regulations;

• the UK International Data Transfer Agreement;

• the UK Addendum to approved European standard contractual clauses;

• binding corporate rules; or

• another legally permitted safeguard or exception.

Where required, we assess whether the transfer mechanism provides an appropriate level of protection and whether supplementary safeguards are necessary.

Information about relevant transfer destinations and safeguards may be requested through our privacy contact.

16. Data security

We use appropriate technical and organisational measures intended to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

Our measures are selected according to the nature of the information, the risks associated with the processing and the available technology.

Measures may include, where appropriate:

• encryption of information in transit;

• encryption at rest;

• access controls and account permissions;

• password-protection measures;

• logging and monitoring;

• restricted administrative access;

• vulnerability management;

• secure development and change-management practices;

• supplier security assessments;

• backup and recovery procedures;

• employee confidentiality obligations;

• security and privacy training; and

• incident-response procedures.

No online service can guarantee absolute security. Users must keep login credentials confidential, use appropriately strong passwords and inform us promptly if they believe their account or credentials have been compromised.

Further security information may be provided to institutional customers subject to appropriate confidentiality and security restrictions.

17. Personal data breaches and security incidents

We maintain procedures for identifying, assessing, investigating, documenting and responding to suspected personal data breaches.

Where MyAssays acts as controller, we will notify the Information Commissioner’s Office and affected individuals where and within the period required by applicable law.

Where MyAssays acts as processor and becomes aware of a personal data breach affecting personal data processed for a customer, we will notify the customer without undue delay in accordance with applicable law and the applicable Service Terms, including the Data Processing Schedule.

We will provide information reasonably necessary to help an affected controller understand the nature and consequences of a breach and comply with its legal obligations. This may include available information about:

• the nature of the incident;

• affected data and individuals;

• likely consequences;

• containment measures;

• remediation; and

• relevant contact details.

The disclosure of full forensic, privileged or security-sensitive investigation materials is subject to applicable law, legal privilege, confidentiality, security considerations and the parties’ contract.

18. Retention of personal data

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including satisfying legal, accounting, security, contractual and reporting requirements.

We determine retention periods by considering:

• the nature, amount and sensitivity of the information;

• the purpose for which it is used;

• the duration of the account or customer relationship;

• contractual commitments;

• legal limitation periods;

• tax and accounting obligations;

• security requirements;

• the risk of harm from unauthorised use or disclosure; and

• whether the purpose can be achieved using anonymised information.

Our intended retention periods are as follows:

Information	Intended retention period
Active account information	For the duration of the account
Closed account information	30-days after account closure, unless a longer period is necessary
Subscription, invoice and transaction records	Normally six years from the end of the financial year to which the record relates, or longer where required for tax, accounting, audit, dispute or regulatory purposes.
Support correspondence	12 months after the request is resolved
Security, access and system logs	90-days unless needed for an investigation
Marketing records	Until opt-out, inactivity or account removal, with limited suppression information retained as necessary
Cookie-consent records	For the duration of the associated account
Customer Content	For the duration of the account
Backups	12 months
Complaints and rights-request records	12 months after closure
Legal claims and dispute records	For the duration of the matter and applicable limitation period

At the end of the applicable retention period, information will be securely deleted, anonymised or isolated from further use unless continued retention is required or permitted by law.

Deletion from backup systems may occur through the normal backup-overwrite cycle rather than immediately, provided that the information remains protected and is not restored for ordinary operational use.

19. Customer Content at the end of a service relationship

The return, export, deletion and retention of Customer Content are governed principally by the applicable Service Terms, including the Data Processing Schedule, and any separately agreed customer contract.

Subject to the applicable Service Terms, including the Data Processing Schedule, applicable law, security requirements and reasonable technical limitations, an authorised customer may request:

• an export of Customer Content in an available format;

• return of Customer Content;

• deletion of Customer Content; or

• closure of the relevant account.

MyAssays may retain limited information where required for legal compliance, fraud prevention, dispute resolution, security, financial recordkeeping or the establishment, exercise or defence of legal claims.

This section concerns contractual Customer Content. It is separate from an individual’s statutory rights in relation to their personal data.

20. Individual data protection rights

Subject to applicable conditions and exemptions, individuals may have the right to:

• be informed about how their personal data is used;

• request access to their personal data;

• request correction of inaccurate or incomplete personal data;

• request deletion of personal data;

• request restriction of processing;

• object to processing based on legitimate interests;

• object to direct marketing;

• request transfer of eligible personal data in a structured, commonly used and machine-readable format;

• withdraw consent at any time where processing is based on consent;

• request human intervention in relation to certain automated decisions; and

• complain about the way personal data has been handled.

A request may be submitted using the contact details in section 2.

We may need to confirm the requester’s identity and authority before acting on a request. We will request only information reasonably necessary for that purpose.

We will respond within the period required by applicable law. Rights requests are normally handled without charge. A reasonable fee may be charged, or a request may be refused, only where permitted by law, including where a request is manifestly unfounded or excessive.

Some rights do not apply in every circumstance. Where we cannot comply fully with a request, we will explain the reason unless the law prevents us from doing so.

Where MyAssays holds personal data solely as a processor for an institutional customer, the individual may need to submit the request to that customer. We will provide reasonable assistance to the customer as required by law and contract.

21. Data protection complaints

Individuals may complain directly to MyAssays about our use of their personal data.

Complaints can be submitted:

• through the support or contact facility on the MyAssays website;

• by email to privacy-2617@myassays.com; or

• by post to our registered address, marked “Data Protection Complaint”.

To help us investigate, a complaint should explain:

• the individual’s name and contact details;

• the relevant account or relationship with MyAssays;

• what happened;

• the personal data or processing concerned;

• relevant dates; and

• the outcome sought.

We will:

• acknowledge a data protection complaint within 30 days of receipt;

• take appropriate steps to investigate it without undue delay;

• make appropriate enquiries;

• keep the complainant informed where the investigation is continuing; and

• communicate the outcome without undue delay.

Individuals also have the right to complain to the Information Commissioner’s Office, the United Kingdom’s data protection regulator.

We encourage individuals to contact us first so that we have an opportunity to investigate and resolve the concern, but doing so does not affect the right to contact the regulator.

22. Children

The MyAssays services are intended for professional, scientific, educational, institutional and business use. They are not directed at children.

Individuals under the age of 18 must not create an account or provide personal data without appropriate authorisation and, where required, consent from a parent, guardian or responsible institution.

If we become aware that personal data has been collected from a child without an appropriate basis, we will take reasonable steps to delete or otherwise lawfully address it.

23. Third-party websites

Our website may contain links to websites or services operated by other organisations.

Those organisations are responsible for their own privacy practices. This Privacy Policy does not apply to an external website merely because MyAssays provides a link to it.

Individuals should review the relevant third party’s privacy information before providing personal data.

24. Changes to this policy

We may update this Privacy Policy to reflect changes in:

• law or regulatory guidance;

• our services;

• our use of personal data;

• our suppliers;

• our security arrangements; or

• our organisational structure.

The current version will be published on our website with its effective date.

Where a change materially affects how we use personal data, we will take reasonable steps to bring it to the attention of affected individuals, which may include an account notice or email.

25. Contact us

Questions, requests and complaints concerning this Privacy Policy or our use of personal data should be addressed to:

Privacy Contact
MyAssays Limited
21 Hampton Place
Brighton
East Sussex
BN1 3DA
United Kingdom

Email: privacy-2617@myassays.com or use the Send Message form below.