1. Who we are
Bac3Gel, Lda. ("Bac3Gel", "we") is responsible for the personal data processed through www.bac3gel.com (the "Website") and described in this Privacy Policy. Bac3Gel is a private limited company incorporated under Portuguese law, registered under legal entity number 516010085, that develops and sells in vitro models and culture products for microbiome research.
- Registered office: Edifício de Inovação II, Laboratório 2, Avenida Jacques Delors 411-421, 2740-122 Porto Salvo, Portugal
- Email: contact@bac3gel.com
- Phone: (+351) 918 658 193
We have not appointed a Data Protection Officer, as the law does not require one for our activities. Questions about this policy or your data go to contact@bac3gel.com.
This policy follows Regulation (EU) 2016/679 (the "GDPR"), Portuguese Law 58/2019, which implements it, and Portuguese Law 41/2004 on privacy in electronic communications, which covers cookies and email marketing.
2. The data we collect
We collect only what you give us and, if you accept analytics cookies, how you use the Website. You can read the Website without giving us any personal data.
We do not ask for sensitive data, such as health data. Our products are for research use, so please do not send us personal data about patients or sample donors.
Fields marked as mandatory are needed to answer the relevant request or process an order. Billing information required by law must also be provided. Without these details, we may be unable to deal with your request, fulfil the order or issue the invoice. Newsletter subscriptions and consent to non-essential cookies are optional.
3. Why we use it, and on what legal basis
Each use of your data rests on one of the legal bases in Article 6(1) of the GDPR.
Where we rely on consent, you can withdraw it at any time: through the cookie settings on the Website, the unsubscribe link in our emails, or by writing to contact@bac3gel.com. Withdrawing does not affect what was done before.
Where we rely on legitimate interest, you can object, and we will stop unless we have compelling grounds to continue.
We do not take decisions about you based solely on automated processing, including profiling, within the meaning of Article 22 of the GDPR. We do not sell personal data.
5. Who receives your data
We share personal data only with the service providers we need to run the Website and our business, and only for the purposes above. Processors act on our instructions under a data processing agreement.
We do not sell or rent personal data, and we do not share it for third-party advertising.
6. Transfers outside the European Economic Area
Several of our providers are based in the United States, and our distributors operate in Japan, India, China, the United States and Canada, so some data may be processed outside the European Economic Area. We transfer it only with a safeguard recognised by the GDPR:
- an adequacy decision of the European Commission, including the EU-U.S. Data Privacy Framework for US providers certified under it, and the decisions covering Japan and Canada; or
- the European Commission's Standard Contractual Clauses (2021), with additional measures where needed.
You can ask for a copy of the safeguard that applies by writing to contact@bac3gel.com.
7. How long we keep it
We keep personal data only as long as the purpose needs it, then delete or anonymise it.
We may keep data longer when we need it to establish, exercise or defend a legal claim, for as long as the claim can be brought.
8. Your rights
You can ask us at any time to:
- give you access to, and a copy of, the personal data we hold about you;
- correct data that is wrong or incomplete;
- delete your data, where we no longer need it or have no legal basis to keep it;
- restrict how we use it while a question about it is resolved;
- send data you gave us to you or to another organisation, in a common machine-readable format;
- stop using it for direct marketing, or for purposes based on our legitimate interest;
- withdraw any consent you have given.
Write to contact@bac3gel.com or to our registered office. We answer within one month; for complex requests we may need two more months and will tell you why. We may ask you to confirm your identity before acting. Exercising your rights is free, unless a request is clearly unfounded or excessive.
If you think we have not handled your data properly, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), Avenida D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt, or to the authority where you live or work.
9. Security, children, other websites and changes
Security. We protect personal data with measures suited to the risk. The Website is served only over encrypted connections (HTTPS). Access to our systems is limited to staff who need it and are bound by confidentiality. Our providers are chosen for their security standards, and we review our measures regularly. If a breach puts your data at risk, we will notify the CNPD within 72 hours of becoming aware of it where the law requires, and tell you without undue delay if it is likely to put your rights at high risk.
Children. The Website and our products are intended for professionals. We do not knowingly collect data from anyone under 16.
Other websites. The Website links to sites we do not control, such as LinkedIn, journal publishers, our distributors, and the HubSpot and Fillout pages for booking and quotes. Their own privacy policies apply there.
Changes. We may update this policy when our services or the law change. The date of the current version is shown below. We will tell customers by email about any significant change.