PRIVACY POLICY

Biopharm Services Limited

Last Updated: 13 March 2026

1. INTRODUCTION

1.1 Who are we?

Biopharm Services Limited, Unit 11, Chess Business Park, Moor Road, Chesham, Bucks, HP5 1SD, United Kingdom.

Contact email: info@biopharmservices.com

Contact telephone: +44 (0)1494 578011

We develop and support BioSolve® Process, the biopharmaceutical industry’s most powerful bioprocess analysis tool, and other software and solutions as part of the Biopharm® Platform.

We are incorporated in the United Kingdom and provide products and services to customers globally, including in the United Kingdom, the European Union, the United States and Japan.

For the purposes of data protection law, we act as a data controller in respect of the personal data described in this Policy, except where we process personal data on behalf of customers under contract (in which case we act as a data processor).

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where applicable, the EU General Data Protection Regulation (EU GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the Japan Act on the Protection of Personal Information (APPI), and other international data protection and privacy laws relevant to the jurisdictions in which we operate.

1.2 Processing on behalf of our customers

Where our customers use our software products (such as BioSolve® Process) and we host or support those products, we may process personal data on their behalf. In those circumstances, the customer is the data controller and we act as a data processor, processing data strictly in accordance with their instructions and our data processing agreement.

2. WHAT DOES THIS POLICY COVER?

We at Biopharm Services Limited take your personal data seriously. This Policy:

  • sets out the types of personal data that we collect about you;
  • explains how and why we collect and use your personal data;
  • explains how long we keep your personal data for;
  • explains when, why and with whom we will share your personal data;
  • sets out the legal basis we have for using your personal data;
  • explains the effect of refusing to provide the personal data requested;
  • explains the different rights and choices you have when it comes to your personal data; and
  • explains how we may contact you and how you can contact us.

3. WHAT PERSONAL DATA DO WE COLLECT ABOUT YOU?

3.1 General Business and Enquiry Data

We collect the information necessary to respond to inbound enquiries, product sales enquiries, account management processes, technical support, product and service developments and accounting enquiries. This typically includes:

  • Name
  • Business email address
  • Job title and role
  • Organisation / company name
  • Telephone number
  • Details of your enquiry or request
  • Communication preferences

3.2 E-commerce Data

When you purchase products or services via our e-commerce platform, we collect:

  • Name
  • Email address
  • Postal address
  • Billing address
  • Job title
  • Company name
  • Department
  • Communication preferences
  • Details of purchases made on the e-commerce website

Payment card information is processed securely by Stripe, our third-party payment service provider. We do not store full payment card details.

3.3 Licensing and Subscription Data

We operate in-house software to manage product licensing and subscriptions. This system retains customer account information, licence status, subscription records and associated contractual documentation.

3.4 CRM Data

We also maintain records within our Customer Relationship Management (CRM) system. This may include:

  • Contact details
  • Communication history
  • Purchase history
  • Licensing information
  • Marketing preferences
  • Event attendance records
  • Dietary requirements provided for user group events

Dietary information is collected solely for organising events safely and appropriately. Where such information reveals health-related data, we rely on your explicit consent.

We do not otherwise intentionally collect sensitive personal data about you.

3.5 Customer Support and Ticket Management

We use a third-party customer support and ticket management platform to manage technical support requests. Where you submit a support enquiry, we may process your name, contact details, company information, details of your query, correspondence, technical information provided in connection with the request and any attachments you choose to provide. This information is retained within our support system to enable us to investigate, manage and resolve technical issues and to maintain service records.

4. WHERE DO WE COLLECT YOUR PERSONAL DATA?

The following are the different sources from which we may collect personal data about you:

  • Directly from you via website forms;
  • Through our e-commerce checkout process;
  • Through account registration;
  • Through cookies and analytics technologies, when you browse our website;
  • By meeting or word of mouth — for example, you may be recommended by a colleague, meet with us at a conference, or provide us with a business card;
  • Through direct correspondence by email or telephone.

5. HOW AND WHY WE USE YOUR PERSONAL DATA

5.1 Core Business Purposes

We use your personal data to respond to your inbound enquiry or to update you on technical information, details of other software and services, meetings/conferences, updates on the services we provide, and news about our company.

In addition, we use your personal data to:

  • Process and fulfil orders;
  • Manage product licensing;
  • Provide technical support;
  • Maintain customer accounts;
  • Organise and manage user group events;
  • Maintain accounting and tax records;
  • Improve our products and services.

5.2 Communications Preferences

You may opt out of receiving:

  • Event communications;
  • New product launch communications;
  • Newsletters;
  • Telephone calls.

You can object to or opt out of marketing communications at any time by contacting us directly at info@biopharmservices.com.

However, you cannot opt out of receiving email communications that are strictly necessary for contractual, service or account-related purposes, including licence notifications, invoices, security notices, service updates and legal obligations.

6. WHAT LEGAL BASIS DO WE HAVE FOR USING YOUR INFORMATION?

We rely on the following legal bases under the UK GDPR and, where applicable, the EU GDPR:

Contractual necessity:

  • Processing orders, managing licences, providing technical support and maintaining customer accounts.

Legal obligation:

  • Maintaining accounting, tax and financial records as required by UK law (typically for at least six years).

Legitimate interests:

  • Sending product updates, operating CRM activities, improving our products and services, and managing business relationships. We carry out a balancing test to ensure our interests do not override your rights and freedoms.

Consent:

  • Processing dietary/health information for events and setting non-essential cookies.

If you do not provide the personal data necessary, or withdraw your consent where applicable, we may not be able to support you as a customer or provide certain services.

7. HOW LONG DO WE KEEP YOUR PERSONAL DATA FOR?

We retain personal data only for as long as necessary to fulfil the purposes described above or to comply with legal obligations.

Financial and transactional records are typically retained for at least six years in accordance with UK tax and accounting requirements.

If you request deletion of your data, we will delete personal and CRM information. However, we will retain records of e-commerce purchases and associated transactional data where required for accounting, tax or legal purposes.

We securely erase or anonymise personal data when it is no longer required.

8. WHO DO WE SHARE YOUR PERSONAL DATA WITH?

We do not sell your personal data.

We may share your data with trusted third-party providers, including:

  • Stripe (payment processing);
  • CRM providers;
  • Website hosting providers;
  • IT support providers;
  • Customer support platform providers;
  • Accounting service providers;
  • Analytics providers (including Google Analytics).

All third parties are required to process personal data securely and in accordance with applicable data protection laws. Where they act as data processors, we have data processing agreements in place that comply with UK GDPR and, where applicable, EU GDPR requirements.

9. COOKIES AND ANALYTICS

9.1 Cookies

We use cookies to ensure the proper operation of our e-commerce platform and to analyse website performance.

These include strictly necessary cookies (which do not require consent) and analytics cookies (which are only set with your consent).

You may provide or withdraw your consent to non-essential cookies at any time via our cookie banner or cookie settings tool. You may also manage cookies through your browser settings.

For more detail on the specific cookies we use, please see our Cookie Policy [link to separate cookie policy page if applicable].

9.2 Analytics

We use Google Analytics to understand website usage and improve performance. Data collected may include IP address, device type, browser information and pages visited. Google Analytics data is processed in accordance with Google’s data processing terms.

10. INTERNATIONAL DATA TRANSFERS

As we operate globally and use service providers based in the United States and other jurisdictions, personal data may be transferred outside the United Kingdom and the European Economic Area.

Where data is transferred to countries without an adequacy decision, we implement appropriate safeguards, such as:

  • Standard Contractual Clauses (SCCs) approved by the European Commission or the UK International Data Transfer Agreement (IDTA) or UK Addendum, as applicable;
  • The EU–U.S. Data Privacy Framework, the UK Extension to the EU–U.S. Data Privacy Framework, or the Swiss–U.S. Data Privacy Framework, where the recipient is certified; and
  • Supplementary technical and organisational measures where required following a transfer risk assessment.

Specifically:

  • Stripe (United States): Certified under the EU–U.S. DPF; SCCs in place.
  • Google Analytics (United States): Data processed under Google’s data processing terms with SCCs.

The United Kingdom benefits from an EU adequacy decision (renewed in December 2025), meaning personal data can flow freely between the UK and the EU/EEA without additional safeguards. Japan also benefits from a UK adequacy decision, facilitating data transfers between the UK and Japan.

11. EU/EEA PRIVACY RIGHTS

If you are located in the European Economic Area, the EU General Data Protection Regulation (EU GDPR) applies to our processing of your personal data where we offer goods or services to you or monitor your behaviour within the EU/EEA.

Under the EU GDPR, you have the same rights as set out in Section 15 of this Policy (Your Rights), including the right to lodge a complaint with your local supervisory authority.

12. US PRIVACY RIGHTS

As of 2026, twenty US states have enacted comprehensive data privacy laws, including California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Oregon, Texas, Delaware, Florida, New Hampshire, New Jersey, Nebraska, Kentucky, Minnesota, Maryland, and Rhode Island.

While many of these laws include revenue or data-volume thresholds that may not apply to all businesses, we are committed to transparency and extend the following rights to individuals located in the United States, to the extent applicable under their state law:

  • Request confirmation of whether we process your personal data;
  • Request access to the personal data we hold about you;
  • Request deletion of your personal data (subject to legal retention obligations);
  • Correct inaccurate personal data;
  • Request portability of your personal data;
  • Opt out of the sale of personal data (we do not sell personal data);
  • Opt out of targeted advertising (we do not engage in targeted advertising based on personal data);
  • Opt out of profiling in furtherance of decisions that produce legal or similarly significant effects (we do not engage in such profiling).

We do not sell personal data. We do not engage in cross-context behavioural advertising.

California residents may additionally request information regarding the categories of personal data collected, disclosed and retained in the preceding 12 months.

To exercise your rights, please contact us at: info@biopharmservices.com. We will verify your identity before processing your request and respond within the timeframes required by applicable law.

13. JAPAN PRIVACY RIGHTS (APPI)

Where we process personal data of individuals located in Japan, we comply with the Act on the Protection of Personal Information (APPI), as amended.

This section applies where we offer goods or services to individuals in Japan, or where we acquire personal information of individuals located in Japan in connection with our business activities.

13.1 Your Rights under APPI

In accordance with the APPI, individuals in Japan have the right to:

  • Know their personal data held by Biopharm Services;
  • Request disclosure of the purposes for which their personal data is used;
  • Request revision, correction, amendment or deletion of their personal data;
  • Request the cessation of use of their personal data if it is used for a purpose other than the one originally stated, or if it was acquired by unlawful means;
  • Access our record of data transfers to third parties;
  • Request that we cease transferring their personal data to third parties where we no longer need to use the data, a data breach has occurred, or there is a likelihood of infringement of their rights or lawful interests.

13.2 Cross-Border Transfers from Japan

Where we transfer personal data of individuals in Japan outside of Japan, we do so subject to one or more of the following safeguards:

  • Transfer to a country recognised by Japan’s Personal Information Protection Commission (PPC) as having an adequate level of data protection (the United Kingdom and EEA member states are recognised as adequate by the PPC);
  • Ensuring the receiving entity has implemented systems conforming to the standards required by the APPI; or
  • Obtaining explicit consent from the individual after providing information about the data protection regime of the receiving country.

13.3 Sensitive Personal Information

We will obtain explicit consent before collecting or processing any “Special Care-Required Personal Information” as defined under the APPI (including information relating to race, creed, social status, medical history, criminal record, or the fact of having suffered damage from a crime).

13.4 Contact for Japan-related Enquiries

Individuals in Japan may exercise their rights by contacting us at: info@biopharmservices.com or by writing to our UK address set out in Section 17.

14. AUTOMATED DECISION-MAKING

We do not carry out automated profiling or automated decision-making that produces legal or similarly significant effects.

15. YOUR RIGHTS

Depending on your location and applicable law, you may have some or all of the following rights in relation to your personal data:

  • The right to be informed about how we use your personal data;
  • The right to access your personal data;
  • The right to rectify inaccurate or incomplete data;
  • The right to erasure (“the right to be forgotten”);
  • The right to restrict processing;
  • The right to object to processing (including direct marketing);
  • The right to data portability;
  • The right to withdraw consent at any time;
  • The right to lodge a complaint with a supervisory authority.

We will respond to your request within one month, where required by applicable law. In complex cases, we may extend this period by a further two months, but we will inform you of any extension within the first month.

You have the right to lodge a complaint with:

  • The UK Information Commissioner’s Office (ICO) — https://ico.org.uk
  • Your local EU/EEA data protection authority (if you are located in the EU/EEA)
  • The Japan Personal Information Protection Commission (PPC) — if you are located in Japan
  • Your state Attorney General or relevant authority (if you are located in the United States)

16. HOW WILL WE CONTACT YOU?

We may contact you by phone or email. If you prefer a particular contact method (and it is compatible with our contractual obligations), please let us know.

17. HOW CAN YOU CONTACT US?

If you have any questions about this Policy, wish to exercise your rights, or are unhappy with how we have handled your information, please contact us at:

Biopharm Services Limited

Address: Unit 11, Chess Business Park, Moor Road, Chesham, Bucks, HP5 1SD, United Kingdom

Email: info@biopharmservices.com

Telephone: +44 (0)1494 578011

You may also lodge a complaint with the UK Information Commissioner’s Office (ICO), the Japan Personal Information Protection Commission (PPC), or your local supervisory authority, where applicable.