Privacy Policy

Version 2 — effective 1 July 2025 (supersedes Version 1 dated 24 November 2022)

This Privacy Policy explains how PHARMAFOOTPATH LTD ("PharmaFootpath", "we", "our", "us") collects, uses, shares and safeguards personal data when you visit www.pharmafootpath.com (the "Website") or use any of our products or services (the "Service"). Please read it together with our Terms & Conditions (Version 2 – effective 1 July 2025).

1. Who we are and controller / processor roles

Role	Context	Legal entity
Controller	Account details (name, email), billing, marketing subscriptions, Website analytics	PharmaFootpath Ltd (Company No. 14504862, Portland House, 113-116 Bute Street, Cardiff, Wales, CF10 5EQ.)
Processor	Personal data you upload or provide in connection with the Service	PharmaFootpath Ltd acting on your documented instructions under Clause 22 of our Terms

For all queries: hello@pharmafootpath.com.

2. What data we collect

3. How we collect data

Directly from you – when you create an account, upload data, complete a form, contact support or subscribe to marketing.
Automatically – via cookies, server logs and similar technologies when you browse the Website.
Third‑party sources – business contact databases and public registries (for B2B lead generation, legitimate interest).

Category	Examples
Identification	Name, job title, company
Contact	Business email address, telephone number
Account & Usage	Username, password, usage logs (timestamps, features accessed, API calls), support‑ticket communications
Technical	IP address, browser type/version, operating system, device identifiers
Cookies & Analytics	See Cookie Schedule below

Purpose	Lawful basis
Provide, operate and secure the Service	Contract (Art 6 (1)(b))
Create and manage your account	Contract
Process payments & refunds	Contract / Legal obligation (tax)
Improve and develop the Service, prevent abuse, generate aggregated analytics	Legitimate interest (to run our business)
Send product updates & B2B marketing	Consent or Soft‑opt‑in (PECR Reg 22(3))
Respond to enquiries & support tickets	Legitimate interest / Contract
Comply with legal obligations (e.g. AML, sanctions)	Legal obligation

You may withdraw consent or object to processing at any time (§ 11).

5. Automated research tools (AI)

We use third‑party AI services (currently OpenAI GPT models) solely to perform background research on publicly available corporate information. No personal data provided by you is transmitted, uploaded or disclosed to those AI services.

Affiliates & group companies – internal business administration.
Cloud hosting, IT & security providers.
Professional advisers (lawyers, accountants, insurers).
Public authorities – where required by law or court order.

We contractually require all processors to protect personal data and act only on our instructions.

7. International transfers

Where we transfer personal data outside the United Kingdom or European Economic Area we rely on:

the UK International Data Transfer Agreement (IDTA); or
the EU Standard Contractual Clauses (SCC) plus UK Addendum;
other safeguards recognised under UK GDPR.

You may request a copy of the relevant transfer mechanism via hello@pharmafootpath.com.

8. Security

We implement appropriate technical and organisational measures, including:

TLS 1.2+ encryption in transit; AES‑256 encryption at rest.
Access controls, MFA and role‑based permissions.
Incident‑response procedures. Suspected breaches? Email hello@pharmafootpath.com.

9. Data retention

Data set	Retention period
Account & billing records	6 years after last transaction (UK tax law)
Customer‑provided personal data (processor)	Deleted or returned within 30 days of contract termination, unless retention required by law
Support tickets & usage logs	24 months for troubleshooting & audit
Marketing consent records	Until you withdraw consent + 2 years

Back‑ups may persist for up to 90 days.

10. Cookies

We use essential, functional and analytical cookies. A real‑time list is displayed in our Cookie Preference Centre (link in footer). You can adjust your browser to refuse cookies; some features may not work.

11. Your rights

Access * Rectification * Erasure * Restriction * Data‑portability * Object / withdraw consent

Contact hello@pharmafootpath.com to exercise rights. You may lodge a complaint with the UK Information Commissioner’s Office (ICO) – see https://ico.org.uk.

12. Business transfers

If we sell or restructure our business, personal data may be transferred to the buyer subject to this Privacy Policy.

13. Changes & version control

We review this notice annually. Updates will be posted here and, where appropriate, notified to you by email.
Last reviewed 1 July 2025 — Next review due 1 July 2026.

14. Jurisdiction & dispute resolution

This notice is governed by English law. Consistent with our Terms (Clause 27), disputes may be referred either to the courts of England & Wales or, at either party’s election, to LCIA arbitration seated in London. The English version prevails.