1. Who we are
Mach-Bio B.V. rents laboratory equipment and provides training at BioPartner 3, Galileiweg 8, 2333 BD Leiden, the Netherlands. We are registered with the Dutch Chamber of Commerce under number 99046350.
For the personal data described in this notice, Mach-Bio is the controller, which means we decide why it is used and how. We are not the controller of the research data our clients generate on our instruments. Section 5 explains where that line sits.
You can reach us at info@mach-bio.com.
2. What this notice covers
This notice covers the personal data we handle when you visit our website, book training or equipment time, attend training, take an assessment, hold a Certification, or work in our facility.
It also covers the people we deal with at a client organisation, such as whoever makes a Booking or receives an invoice.
Often your employer or your organisation books on your behalf, or names you as a contact for a Booking. Where that happens we receive your details from them rather than from you. That usually means your name, work email address, telephone number and role, and it can also include the instrument and time they have booked for you, what you plan to work on, and any sample or safety information they give us. Everything else in this notice we collect from you directly, or it arises from what you do at our facility.
It does not cover the research data you generate on our instruments. Section 5 explains where that line sits.
Words with a capital letter, such as Booking, User and Certification, mean what our general terms and conditions say they mean.
Where your organisation books for you, we send you this notice with your Booking confirmation, and in any case within one month of receiving your details from them.
3. The personal data we collect
We collect the following about Users and client contacts.
| What | Detail |
|---|---|
| Identity and contact | Your name, work email address, telephone number, the organisation you work for and your role there. |
| Bookings and use | The Bookings you make, the instruments you use, hours booked and used, cancellations, no-shows and late arrivals. |
| Training and certification | Courses attended, online preparation completed, assessment answers and scores, whether you passed, and the Certification you hold and when it expires. |
| Site access | The access pass we issue you and the hours your Certification allows. |
| Billing | Invoices, purchase order references and payment status. |
| Safety and incidents | What you reported or were involved in, and what we did about it. |
| Correspondence | Emails and messages you send us, and our replies. |
| Website and enquiries | What you send us through the website, including your booking and intake answers, and the security records the site keeps, such as a scrambled form of your network address used to limit repeated attempts. Our cookie notice lists what the site keeps in your browser. |
We do not routinely collect special category data, which under the GDPR means things like health data, racial or ethnic origin, religion or trade union membership. Please do not send it to us.
There is one exception. If you are injured or exposed in an incident at our facility, the incident record will say so, and that is health data. We handle it because health and safety law requires us to record and investigate what happened, and because we may need it to bring or defend a claim.
Do you have to give us this?
Your identity, training and access details are a condition of using the facility. We cannot train you, certify you or let you on site without them. Anything else is optional, and not giving it only means we cannot do the particular thing it was for.
4. Why we use it, and our legal basis
The purposes below cover the same processing our general terms describe, grouped so that each group can carry a legal basis. Every purpose needs one under the GDPR, and this is ours.
| Why we use it | Legal basis |
|---|---|
| Taking and administering your Bookings, and sending you messages about them | Performance of a contract, where you book in your own name. Where your employer books, our legitimate interest in serving them |
| Delivering training, running competency assessments and recording whether you passed | Our legitimate interest in making sure only trained and competent Users operate the equipment, and in being able to show that we checked |
| Issuing and checking Certification, and controlling access to the facility | Our legitimate interest in keeping the facility and the people in it safe |
| Invoicing and collecting payment | Performance of the contract with whoever is invoiced, and a legal obligation to keep the records |
| Investigating safety incidents and equipment damage | Our legitimate interest, and a legal obligation where an incident must be reported |
| Keeping the records the law requires us to keep | A legal obligation |
| Running our website, keeping it secure and seeing that it works | Our legitimate interest in having a website that works and is not attacked |
Two of these have a direct effect on you. If you do not pass an assessment we cannot certify you for that instrument, so you cannot book it on your own until you have had further training and passed. We tell the organisation you work for whether you passed, because they are paying for the training and they need to know what their people may use. You can ask us to look at a result again, and you can object to our using your data in this way, which section 10 explains.
Where we rely on legitimate interest, we have weighed it against your interests first. You can object, and section 10 says how. Ask us if you would like to see how we weighed it.
Certification is not decided by a computer. The assessment is scored automatically and you need at least 80% to go forward, but whether you are certified is decided by a Mach-Bio trainer who has seen you work. If you think a score was wrong, tell us and a person will look at it again.
5. Research data you bring to the lab
Under our general terms the research data generated on our instruments belongs to the Client, subject to any separate written agreement. Where that data contains personal data, the Client is the controller of it and we are not. We do not decide what goes onto an instrument or what happens to it afterwards.
Two rules follow from that, and both are also in our general terms.
Do not bring personal data that identifies a living person onto our instruments or systems unless we have agreed to it in writing first. Where we agree, we put a data processing agreement in place with the Client Organisation before the Booking.
Data left on instrument computers is temporary. We may delete it 30 days after the Booking, and the transfer links we create expire after seven days. Export what you need and keep your own copy.
6. Who we share it with
We share personal data with:
- the organisation you work for, which sees your Bookings, the hours you used, no-shows, your Certification status and the invoices behind them, and which we tell if you are involved in a safety incident at our facility
- the booking platform we use to manage instrument time and access
- our email and office software provider
- our website and hosting provider
- our payment provider, where a payment is made through one
- our accounting software and our accountant, for invoicing and the records we are required to keep
- BioPartner, the landlord of our building, where site access requires it
- the engineers who service our instruments, where fixing or maintaining an instrument means they can see what is on it
- our insurers and advisers, if there is a claim or an incident
- public authorities, where the law requires it
Our suppliers handle the data to provide their service to us. The booking platform we use for instrument time also handles it under its own terms, as a separate controller, and its own privacy notice applies to that.
We do not sell personal data and we do not use it for advertising.
7. Where your data is held
We are based in the Netherlands and prefer suppliers that hold data in the European Economic Area.
Our website and its booking database run on servers in Frankfurt, Germany, and our hosting provider keeps its backups in France.
Some of the services we use are run by companies based outside the EEA, or with support teams outside it. Before we use a service that way we check which transfer safeguard applies to it: either a decision by the European Commission that the country protects data adequately, or the standard data protection clauses the Commission has approved.
Write to us at info@mach-bio.com and we will tell you which applies to a particular service and give you the details of the protection in place.
8. How long we keep it
| What | How long | Why |
|---|---|---|
| Invoices, and the booking records behind them | 7 years from the end of the financial year | Required by Dutch tax law. |
| Identity and contact details | While you are an active User, and 5 years after your last Booking | We keep these with your training record for as long as we keep that record, so a certificate we issued can be matched to the person who holds it. |
| Training, assessment and certification records | While you are an active User, and 5 years after your last Booking | Covers the life of a Certification and the 12 month window our general terms give for notifying a claim. |
| Safety and incident records | 5 years after the incident is closed | Health and safety law requires us to record incidents, and a personal injury claim can be brought years after the event. |
| Access pass records | While the pass is valid, and 12 months after it expires | So we can establish who had access to the facility during a period we may need to investigate. |
| Enquiries and correspondence | 24 months where they lead to no Booking, otherwise with the Booking record | So we can pick up a conversation you come back to, and show what we told you. |
| Website security records | About 2 days. Unconfirmed bookings and sign-in codes are deleted about an hour after they expire, and a portal sign-in ends after 12 hours | So the site can limit repeated attempts and keep sign-ins safe. Our hosting provider's own access logs follow its schedule, which we do not extend. |
| Data on instrument computers | May be deleted 30 days after the Booking | Stated in our general terms. |
| Data transfer links | Expire after seven days | Stated in our general terms. |
If you only ever made an enquiry and never booked, tell us and we will remove your details sooner.
When a period ends we delete the data or strip it of anything that identifies you, unless we still need it for a claim or an investigation that is running.
9. How we protect it
Access to client data is limited to the people who need it for their work, and we keep each client's data separate from every other client's. That separation is a commitment we make in our general terms, not just a practice.
Our confidentiality obligation to a Client continues for five years after that Client's last Booking.
10. Your rights
Under the GDPR you can ask us to do any of the following.
- ask for a copy of the personal data we hold about you
- have it corrected if it is wrong
- have it deleted, where we are not required to keep it
- limit what we do with it while a question about it is open
- receive it in a portable form, or have us send it to another provider, where that applies
- object to our using it, where we rely on legitimate interest
- withdraw your consent at any time, where we rely on consent, by writing to us
Write to info@mach-bio.com. We answer within one month. If your request is complicated we may need longer, and we will tell you why inside that first month.
We may ask you to confirm who you are before we act, so that we do not hand your data to someone else.
11. Complaints
If you are unhappy with how we handle your personal data, tell us first and we will try to put it right.
You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl.
12. Cookies
Our website's use of cookies is described in a separate cookie notice, published alongside this one.
13. Changes to this notice
We update this notice when what we do changes. The version and the dates are at the top. Where a change matters to you, we will tell you by email before it takes effect.
14. How to contact us
| Legal name | Mach-Bio B.V. |
| Registered address | Galileiweg 8, 2333 BD Leiden, the Netherlands |
| Chamber of Commerce number | 99046350 |
| VAT number | NL868765405B01 |
| General email | info@mach-bio.com |
| Training email | training@mach-bio.com |
| Billing email | billing@mach-bio.com |
| Website | www.mach-bio.com |