Privacy policy

Clinical testing is covered separately

What we collect

If you open a portal account

Your name, work email address, telephone number, company name, and the billing and shipping addresses you give us. If you add colleagues, the same for them.

When you place an order

Product names, batch and lot numbers, labeled contents, the composition you declare, any photographs you upload, and any notes you add. These describe your products, and we treat them as commercially confidential.

Automatically

Your IP address, browser and device details, and the pages you request. We record sign-in attempts, successful and failed, and keep an audit record of changes made to accounts and orders.

We do not collect card numbers. See Payments.

How we use it

• To carry out the testing you order and to issue your certificates.
• To send the notifications you have asked for: order updates, certificates, payment receipts.
• To take payment and to raise invoices.
• To keep the laboratory records we are required to keep as an accredited facility.
• To keep the service secure, including detecting misuse of accounts.
• To answer you when you contact us.

We do not sell your information, and we do not use it for advertising.

Payments

Card payments are processed by Stripe. Your card number, expiry date and security code are entered directly into Stripe's own secure fields and never reach our servers. What we store is Stripe's reference for the payment, the card brand, the last four digits, and whether it succeeded.

Stripe handles that information as a separate controller under its own privacy policy, and may check the payment for fraud on our behalf.

Who else sees it

A limited set of parties, each for a stated reason:

Stripe

To process card payments.

Cloudflare

To tell a person from an automated script on the contact form. It receives your IP address for that check and nothing else.

Our email provider

To deliver the notifications you have asked for.

Google

Analytics for our public pages. It is told which page was viewed, roughly where in the world you are, and what browser you used. It is not loaded in the client portal, so it is never told anything about your orders or your certificates.

Anyone you invite

Colleagues you add to your organization can see your orders and certificates.

Anyone you give a certificate to

Certificates carry a verification code. Anyone holding it can confirm the certificate against our record. That is the point of it, and it is your decision who receives one.

We may also disclose information where the law requires it, or to establish or defend a legal claim. If we are ever compelled to hand over your data, we will tell you unless we are legally prohibited from doing so.

Cookies

We use the cookies the site needs to function, and Google Analytics on our public pages. There is no advertising. Analytics is not loaded in the client portal, where the address of a page can name an order, a sample or a certificate.

Session

Keeps you signed in as you move between pages. Expires when you sign out or after a period of inactivity.

CSRF token

Stops another website submitting forms on your behalf.

Stripe

Set on the payment step by Stripe, to process the transaction and detect fraud.

Cloudflare Turnstile

Set on the contact form to tell a person from an automated script. Cloudflare receives your IP address for that check alone; it is not used to build a profile of you or to show advertising.

Google Analytics

Set on our public pages to count visits and show us which pages are read. Not set in the client portal.

You can block the analytics cookies in your browser, or with Google's own opt-out add-on, and everything else on the site will carry on working. Blocking the rest will stop you signing in. Your acknowledgement of our cookie notice is stored in your browser's local storage rather than in a cookie, so dismissing it does not itself set one.

How long we keep it

Certificates of analysis, and the order records behind them, are retained long term. They are laboratory records, and third parties verify them against our system for years after issue. We cannot delete a certificate on request without breaking every verification code already printed on your product.

Sign-in records are kept for around 90 days. Technical fault records are kept while they are unresolved and for about 90 days after. Audit records of changes to accounts and orders are kept for several years.

Security

Traffic is encrypted in transit. Passwords are hashed and never stored in a readable form, and we check new passwords against known breached password lists. Accounts lock after repeated failed sign-in attempts. Your uploaded photographs and certificates are stored outside the public web root and are served only after we have checked that the account requesting them owns them.

No system is perfectly secure. If we become aware of a breach affecting your information, we will tell you.

Your choices

• You can see and correct your company and contact details in your account at any time.
• You can turn off order updates, certificate notices, payment receipts and promotional email under Notifications in your account. Security and account notices cannot be switched off.
• You can ask for a copy of the information we hold about you.
• You can ask us to close your account. Certificates and laboratory records are retained as described above; we will explain exactly what is kept and why.

Depending on where you live, you may have further rights over your personal information. Contact us and we will tell you what applies and act on it.

Children

This site and the portal are for businesses. They are not directed at children and we do not knowingly collect information from anyone under 18.

Changes

If we change this policy we will update the date at the top. If a change materially affects how we handle your information, we will tell account holders directly rather than relying on you to notice.

Contact us