Privacy policy

1. Introduction and Overview

Virion X Limited (“Virion X”, “we”, “us” or “our”) is committed to protecting and respecting the privacy, confidentiality and data protection rights of the individuals and organisations with whom we interact.

This Privacy Policy sets out how we collect, process, store and protect your personal information in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

This policy applies when you:

  • Visit or interact with our website.
  • Contact us with scientific, technical or commercial enquiries.
  • Request quotations or place orders for our biological materials and research reagents, including pseudotyped viruses (“Products”).
  • Engage our laboratory testing, scientific development and assay services (“Services”).

2. Who We Are (Data Controller)

Virion X Limited is the Data Controller responsible for your personal information.

  • Legal entity name: Virion X Limited
  • Company registration number: 16265591
  • Registered office address: Virion X Ltd, JMS building, Biology Road, Falmer, Brighton, East Sussex, BN1 9QG, United Kingdom.
  • Data protection & privacy contact email: privacy@virionx.com

3. What Information We Collect

We only collect personal information that is necessary, proportionate and relevant to deliver our Products and Services and communicate effectively with the scientific research community. We may collect the following categories of personal information:

A. Information you provide to us directly

Contact and professional identification:

  • Full name and title (e.g. Dr, Prof.).
  • Job title, department and institutional affiliation.
  • Professional/institutional email address and business telephone number.

Order, billing and logistics data:

  • Purchase order numbers, billing addresses, VAT numbers and accounts payable contact details.
  • Delivery addresses, delivery contact names and telephone numbers for courier dispatch.
  • Note: We do not process or store credit/debit card numbers; commercial payments are made via bank transfer or invoice.

Scientific and project communications:

  • Communications relating to custom pseudotype virus design, assay specifications, viral target parameters and sample submission sheets.

B. Technical information collected automatically

When you visit our website, our server and hosting infrastructure may automatically record basic technical connection logs:

  • Internet Protocol (IP) address.
  • Browser type and version.
  • Time zone setting and operating system.
  • Pages visited, access dates/times and referring URLs.

C. Important note on sensitive data

All Products and Services provided by Virion X Limited are strictly for research use only. We do not provide clinical diagnostic services and do not collect, process or require patient medical records, clinical trial participant identifiers or special category personal data. Please ensure that all samples and correspondence submitted to us are strictly de-identified or research-grade.

4. How We Use Your Data

We process your personal data for the following lawful purposes:

  • To fulfil orders for products or services.
  • To respond to enquiries.
  • To manage contracts or research collaborations.
  • To send operational or regulatory updates.
  • To improve our website and services.
  • To comply with legal obligations.

We do not sell your personal data and we do not use your data for profiling or automated decision-making.

5. Legal Basis for Processing

Under Article 6 of the UK GDPR, we rely on the following lawful bases to process your personal information:

  • Contractual necessity: To perform contracts, fulfil orders, deliver scientific assay services and coordinate logistics and cold-chain shipping of biological materials.
  • Legitimate interests: To respond to research enquiries and scientific consultations, maintain website security and integrity, prevent fraud and provide relevant updates to existing customers.
  • Legal obligation: To comply with statutory accounting, HMRC tax compliance and other regulatory or legal requirements.
  • Consent: For optional communications, newsletters or where consent is specifically requested or required by law (which you may withdraw at any time).

6. Sharing Your Information

We never sell, rent or trade personal information to third parties for marketing or advertising purposes.

We share personal data strictly on a confidential, need-to-know basis with trusted third-party service providers:

  • Specialist couriers and logistics partners: Temperature-controlled, cold-chain and express courier services for the physical transport of reagents and samples.
  • IT and infrastructure providers: Secure cloud hosting, encrypted email servers and document management providers.
  • Professional advisors: Our certified accountants, auditors, insurers and legal counsel operating under strict confidentiality obligations.
  • Law enforcement and regulatory authorities: Only where required by applicable UK law, court order, export control regulations or biosafety authorities.

All third parties are contractually bound to protect your data and only use it as instructed.

7. International Data Transfers

Virion X Limited is located in the United Kingdom. In the course of operating our business, personal information may occasionally be transferred to or processed by service providers (such as cloud hosting or communication platforms) or research collaborators located outside the UK.

Where data is transferred internationally outside the UK, we ensure adequate protection is in place through:

  • Transferring to countries recognized by the UK Government as providing an adequate level of data protection.
  • Implementing standard contractual safeguards, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

8. Data Security

We have implemented technical and organisational security measures designed to protect your personal data against accidental loss, unauthorised access, misuse, alteration or disclosure:

  • Full encryption across our website and data transmissions.
  • Multi-factor authentication and encryption on email and business cloud storage.
  • Strict access permissions limited to authorised staff on a need-to-know basis.

9. Data Retention

We only keep personal information for as long as is necessary to fulfil the purposes for which it was collected or to satisfy legal, statutory and accounting obligations. Typically, client information is retained for no more than 6 years. Upon expiry of the relevant retention period, data is securely destroyed or permanently anonymised.

10. Your Legal Rights (UK GDPR)

Under UK data protection legislation, you have significant rights regarding your personal information:

  • Right of access (subject access request): You have the right to request a copy of the personal information we hold about you.
  • Right to rectification: You can ask us to correct or update any inaccurate or incomplete personal information.
  • Right to erasure (“Right to be Forgotten”): You can request that we delete your personal information where there is no compelling legal reason for us to keep it.
  • Right to restrict processing: You have the right to ask us to suspend or restrict how we use your data in certain circumstances.
  • Right to data portability: You may request that we provide your personal information in a structured, commonly used, machine-readable format to you or another provider.
  • Right to object: You have the right to object to our processing of your personal information where we rely on legitimate interests or where processing is for direct marketing.
  • Right to withdraw consent: Where processing is based on your consent, you can withdraw your consent at any time.

To exercise any of these rights, please email us at privacy@virionx.com. We will respond promptly.

11. Cookies and Online Tracking

We use essential cookies for site functionality and Google Analytics for anonymous usage tracking. You can manage cookie preferences through your browser.

We handle cookies and tracking on our website in the following ways:

  • No intrusive tracking: We do not use third-party advertising trackers, behavioural profiling cookies or data-broker pixels.
  • Essential cookies: Our website may use standard functional cookies necessary to ensure secure navigation, prevent spam and maintain site functionality.
  • Browser controls: You can set your browser to refuse or delete cookies at any time via your browser settings.

12. Links to Third-Party Websites

Our website may occasionally provide links to academic journal publications, universities or external partner resources. We do not control these third-party websites and are not responsible for their privacy practices. We encourage you to read the privacy notice of every website you visit.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our laboratory operations, legal obligations or regulatory requirements. Any updates will be published on our website.

14. How to Contact Us or Lodge a Complaint

If you have any questions, concerns or requests regarding this Privacy Policy or our data protection practices, please contact us using the information provided in section 2 of this policy.

If you are unhappy with how we have handled your personal information, you have the right to lodge a complaint with the UK supervisory authority:

  • Information Commissioner’s Office (ICO)
  • Website: ico.org.uk/make-a-complaint
  • Helpline: +44 303 123 1113
  • Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF