What we know about you, and why.
We collect as little personal information as we can, use it only for the reasons set out here, and never sell it. This page says exactly what we hold, why, for how long, and what you can ask us to do about it.
- The controller is Booby Biome Ltd. Write to info@boobybiome.com about anything on this page.
- Marketing and research always rest on your consent, and you can withdraw it at any time. Orders and accounts rest on the contract you make with us.
- Information about your baby is treated as sensitive. We ask for it only when it is needed, rely on your explicit consent, and keep it no longer than necessary.
Who we are.
Booby Biome Ltd, Unit 3, 21 Portland Rise, London N4 2PT, is the data controller for the personal information described on this page. You can contact us at info@boobybiome.com or by post at that address. We have not appointed a statutory data protection officer; the founders are responsible for data protection and the same address reaches them.
Where this page mentions research, that research is run jointly with University College London, which acts as joint controller for research data. Its own privacy information applies to that data alongside ours.
What we collect, and why.
Everything we hold came from you, through this site, our forms, our surveys or our research sessions. Each purpose below shows what we collect, why, the lawful basis we rely on under UK data protection law, and how long we keep it.
Joining the waitlist
- What
- Your email address, and the date you joined.
- Why
- To tell you when BYOMI launches and give waitlist members first access.
- Basis
- Consent. You can withdraw it at any time using the unsubscribe link in any email, or by emailing us.
- How long
- Until you unsubscribe or ask us to delete it. We then keep a minimal record of your choice so we can honour it.
Buying from us
- What
- Name, email, delivery and billing address, phone number if you give it, what you ordered, and your payment method. Card details go straight to our payment provider; we never see the full card number.
- Why
- To take payment, deliver your order, handle returns and answer questions about it.
- Basis
- Contract: we need this to fulfil your order. Legal obligation for the tax and accounting records we must keep.
- How long
- Order records for six years after the end of the financial year they fall in, as company and tax law requires.
Creating an account
- What
- Name, email, a password we cannot read, your addresses and order history.
- Why
- So you can see your orders, reorder quickly and manage your details.
- Basis
- Contract: providing the account you asked for.
- How long
- Until you close the account, or after three years without use, when we will email you first.
Marketing emails
- What
- Name, email and your marketing preferences.
- Why
- To send you news about BYOMI, the science and our research, if you have asked for it.
- Basis
- Consent. Every email has an unsubscribe link.
- How long
- Until you unsubscribe or withdraw consent, then a minimal record of your preference.
Asking us something
- What
- Whatever you include in your message, and your contact details.
- Why
- To answer you.
- Basis
- Legitimate interests: responding to people who contact us. You can object at any time.
- How long
- Up to two years after our last exchange, unless the correspondence relates to an order or a complaint.
Registering interest as a breast milk donor
- What
- Name and email address only. We do not collect health, lifestyle or research information through this site.
- Why
- To contact you about the next steps in the donation process.
- Basis
- Consent, which you can withdraw at any time. If you go on to take part in our research programme you will receive a separate Participant Information Sheet explaining in full how research data, including health information, is collected and protected. That research is run jointly with University College London (UCL), which acts as joint data controller for research data. UCL’s data protection officer can be contacted at data-protection@ucl.ac.uk.
- How long
- Interest registrations for 12 months if you do not go on to take part. Research data for the duration of the project and any archival period set out in the consent form and ethics approval, then deleted or anonymised.
Taking part in user research
- What
- Contact details, survey responses, and, with your explicit agreement first, audio or video recordings of interviews and their transcripts. A postal address if we send you a product to test.
- Why
- To understand how parents store and feed expressed milk, and to test BYOMI, its packaging and this website before launch.
- Basis
- Consent, given before any recording starts and including details of the transcription tool used. Contract for the address we need to post a test product to you.
- How long
- Recordings until the transcript has been produced and checked, and no longer than 12 months. Everything else for the duration of the research, then deleted or anonymised, or sooner if you ask.
Applying to work with us
- What
- Your CV, application and interview notes.
- Why
- To consider your application.
- Basis
- Legitimate interests: recruiting fairly. Legal obligation for right-to-work checks.
- How long
- Unsuccessful applications for 12 months after the decision. Successful applications become part of your employment record.
Keeping the site secure and understanding how it is used
- What
- Technical information such as IP address, browser type, pages viewed and how you arrived. Cookies are described separately in our Cookie policy.
- Why
- To keep the site working and secure, and, with your consent, to see how it is used so we can improve it.
- Basis
- Legitimate interests for security and fault-finding. Consent for analytics and marketing cookies, asked for when you first visit.
- How long
- Security logs for up to 12 months. Analytics data for as long as the analytics provider retains it, set out in the Cookie policy once confirmed.
Where we rely on legitimate interests, we have checked that our interest does not override your rights, and you can object at any time. We do not make decisions about you by automated means alone.
Information about your baby.
This site is for adults, and we do not knowingly collect information directly from anyone under 18. Some of what you tell us, though, is about your baby or child: their age, how they are fed, or, in research, health information and information about their microbiome. We collect it from you as their parent or guardian and treat it as their personal information.
Because it concerns children and can include health information, we handle it with particular care. We ask for it only when a purpose above needs it, rely on your explicit consent, use it for nothing else, and keep it no longer than that purpose requires. If you have questions about how we use information about your child, or you would like us to delete it, contact us at the address above.
Who we share it with.
We share personal information only with organisations that work for us under contract, and only what each one needs. They may not use it for their own purposes.
- Shopify hosts this site and processes orders, accounts and payments on our behalf.
- Google Workspace provides our email, document storage and collaboration tools, so correspondence and internal documents containing personal information are stored there.
- Typeform runs the online forms and surveys we use for outreach and user research.
- Accuro converts recordings of research interviews into written transcripts, and returns them to us.
- Delivery, payment, email and analytics providers for the launch site are to be confirmed and will be named here before publication.
We also share information where the law requires it, for example with HM Revenue & Customs, or to protect our legal rights. UCL receives research data as joint controller, as described above. We never sell personal information.
Information that leaves the UK.
Some of the organisations above process information outside the United Kingdom. When that happens we rely on one of the safeguards UK law allows:
- Typeform processes data in Spain, in the European Economic Area, which the UK government has assessed as providing adequate protection.
- Shopify is headquartered in Canada, which is covered by UK adequacy regulations for commercial organisations. Confirm against Shopify’s data processing addendum before publication.
- Google Workspace and Accuro may process data in the United States. Safeguard to be confirmed: the UK Extension to the EU-US Data Privacy Framework where the provider is certified, otherwise the UK International Data Transfer Agreement.
You can ask us for a copy of the safeguards that apply to any transfer.
How we keep it safe.
We limit access to personal information to the people and providers who need it, use secure systems with access controls, and choose providers that are contractually required to protect it. Research recordings are stored separately from everything else. No online service can be completely secure, so we review our measures regularly, and if a breach were ever likely to put you at risk we would tell you and the Information Commissioner’s Office without delay.
Your rights.
UK data protection law gives you rights over your personal information. Some depend on the lawful basis we rely on, but in every case you can ask, and we will explain what applies.
- Access. Ask for a copy of the personal information we hold about you.
- Rectification. Ask us to correct anything inaccurate or incomplete.
- Erasure. Ask us to delete your information. We may need to keep some, for example order records the law requires.
- Restriction. Ask us to limit how we use it while a concern is resolved.
- Objection. Object to processing based on legitimate interests, and to direct marketing at any time.
- Portability. Ask for the information you gave us in a form you can take elsewhere.
- Withdrawing consent. Where we rely on your consent, withdraw it at any time. That does not affect anything done before you withdrew it.
To use any of these rights, email info@boobybiome.com. We will respond without undue delay and within one month, and we will not charge you. If a request is complex we may need up to two further months, and we will tell you why.
How to complain.
If you are unhappy with how we have used your information, please tell us first at info@boobybiome.com. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, on 0303 123 1113, or by writing to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Changes to this policy.
When we change how we use personal information, we will update this page and the date at the top. If a change affects you, we will make it obvious on the site or tell you directly rather than leaving you to find it.
Prototype · launch-site processors and transfer safeguards marked “to be confirmed” must be completed before publication · internal only