Booby Biome ("We") are committed to protecting and respecting your privacy. This policy together with our terms and conditions, sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the below carefully to understand our practices regarding your personal data and how we will treat it. For the purposes of the Data Protection Act 2018 and the UK GDPR, the data controller is BoobyBiome,  Unit 3, 21 Portland Rise, London, United Kingdom, N4 2PT.

We collect or use the following information for service updates or marketing purposes:

• Names and contact details

• Marketing preferences

​​

We collect or use the following information for scientific or historical research purposes, for statistical purposes or for archiving in the public interest:

​

• Names and contact details

• Addresses

• Personal information used for administration of research

• Personal information used for the purpose of research

• Records of consent, where appropriate

​​

We collect or use the following information to comply with legal requirements:

​

• Name

• Contact information

We collect or use the following information from people who express an interest in becoming a breast-milk donor via our website:

• Name and email address

We use this information only to contact you about next steps in the donation process. We do not collect health, lifestyle, or research data via our website. If you go on to take part in our research programme, you will receive a separate Participant Information Sheet explaining in full how your research data (including health information) is collected, used, and protected. The research is run jointly with University College London (UCL), which acts as a joint data controller for research data. UCL’s data protection officer can be contacted at data-protection@ucl.ac.uk. The lawful basis for this interest registration is your consent, which you can withdraw at any time by contacting us using the details at the top of this notice.

We collect or use the following information as part of our outreach survey:

• Names and contact details

• Country

• Phone number (optional)

• Baby status and baby feeding status or plan

• How you heard about us

We collect or use the following information for user research, including interviews, branding and website surveys, and beta testing:

• Names and contact details

• Postal address (for beta testers receiving products only)

• Audio and video recordings of interviews and research sessions

• Transcripts of those recordings

• Survey responses and feedback

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.
Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:
 

• Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.

• Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.

• Your right to erasure - You have the right to ask us to delete your personal information. Read more about the right to erasure.

• Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information. Read more about the right to restriction of processing.

• Your right to object to processing - You have the right to object to the processing of your personal data. Read more about the right to object to processing.

• Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. Read more about the right to data portability.

• Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.
   

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data
Our lawful bases for collecting or using personal information for service updates or marketing purposes are:
 

• Consent: We have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
   

Our lawful bases for collecting or using personal information for scientific or historical research purposes, for statistical purposes or for archiving in the public interest are:
 

• Consent: We have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
   

Our lawful bases for collecting or using personal information for legal requirements are:
 

• Legal obligation: We have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
   

Our lawful bases for collecting or using personal information for recruitment purposes are:
 

• Legal obligation: We have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
   

Our lawful bases for collecting or using personal information for our breast-milk donor research programme are:
 

• Consent: We have permission from you after we gave you all the relevant information, including a separate participant information sheet and consent form. We rely on your explicit consent for health information and information about racial or ethnic origin. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
   

Our lawful bases for collecting or using personal information for user research and product testing are:
 

• Consent: We have permission from you after we gave you all the relevant information. We ask for your consent before we record any interview or research session. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
   

Our lawful bases for collecting or using personal information for our outreach survey are:
 

• Consent: We have your permission after providing you with all relevant information. You can withdraw your consent at any time. All data protection rights apply, except the right to object.
   

Our lawful bases for collecting or using personal information for user research, interviews, branding and website surveys, and beta testing are:
 

• Consent: We have your permission after providing you with all relevant information, including details of any recording and the AI transcription tool used. We ask for your explicit consent before recording any interview or research session. You may withdraw consent at any time. All data protection rights apply, except the right to object.
   

• Contract: For beta testers, we need your postal address to send you the product. Processing this data is necessary to fulfil our agreement with you as a participant.

Directly from you (including through our website, donor interest registration, outreach survey, and user research activities)

Information about children

Our website and services are directed at adults. We do not knowingly collect personal information directly from children under 18.
However, some of the information you give us is about your baby or child. For example a child’s dietary requirements, allergies, health conditions, or information about your child’s microbiome. We collect this information from you as the parent or guardian, and we treat it as your child’s personal information.

Because some of this information is about children and includes health information, we handle it with particular care. We only use it for the purposes described in this notice, we rely on your consent where appropriate, and we keep it no longer than necessary. If you have any questions about how we use information about your child, or you would like us to delete it, please contact us using the details at the top of this notice.

How long we keep information

We keep your personal information for no longer than is necessary for the purposes we collected it for. The periods below are our standard retention periods. We may keep information for longer where the law requires it, or where we need it to establish, exercise or defend legal claims.
 

• Marketing preferences and consent records: Until you unsubscribe or withdraw your consent, after which we keep a limited record of your preference so that we can continue to honour it.

• Research data, including health and racial or ethnic origin information: For the duration of the relevant research project and for any archival period set out in our research consent and ethics approval, after which it is deleted or anonymised.

• Information about children (for example a child’s date of birth and health information): Kept only for as long as needed for the purpose it was provided, and then deleted in line with the relevant retention period above.

• Call recordings: For up to 12 months.

• Recruitment information: For unsuccessful applicants, up to 12 months after the recruitment decision; for successful applicants, this becomes part of the employment record.

• Website and cookie data: For the lifetime of the relevant cookies and, for analytics, for up to 26 months (see the Cookies section below).

• Research participant and breast-milk donor data: For the duration of the relevant research project and for any archival period set out in our participant information sheet, consent form and ethics approval, after which it is deleted or anonymised.

• User research and product-testing data: For the duration of the research and then deleted or anonymised, unless you ask us to delete it sooner.

• Interview recordings (audio and video): Kept only until we have produced and checked the transcript, and in any event no longer than 12 months, after which the recording is deleted.