This policy explains the personal data processed through celsusanalysis.com and in the course of our academic analysis services. The controller is Celsus Research & Analysis Services Ltd (“Celsus”), Office 5530, 182–184 High Street North, East Ham, London E6 2JA, United Kingdom; registered in England and Wales, company no. 12514103. Contact: info@celsusanalysis.com, +44 7520 643 583.
In short: we run no advertising networks, no visitor analytics and no profiling, and we never sell personal data. We collect what we need to quote for your study and to deliver the analysis you commission.
What we process and why
| Data | Purpose | Lawful basis | Retention |
|---|---|---|---|
| Contact form: name, e-mail, study type, message, language, IP address | Answering your enquiry, scoping the work and sending a quote | Steps at your request prior to a contract; legitimate interests (responding to enquiries) | Kept in our mailbox for as long as the relationship lasts |
| E-mail and WhatsApp correspondence | Agreeing the scope and communicating during the project | Performance of a contract | Duration of the relationship plus limitation periods |
| Datasets and documents you send for analysis | Carrying out and reporting the agreed analysis | Performance of a contract | Deleted on completion at your request |
| Agreement and payment records: name, e-mail, fee, payment status | Contracting, invoicing and accounting | Performance of a contract; legal obligation | Six years, in line with UK statutory accounting record-keeping |
| Server logs: IP address, user agent, requested URL | Security, abuse prevention and fault diagnosis | Legitimate interests (keeping the service secure) | Maximum 14 days, then deleted automatically |
| Outreach e-mails: e-mail address, unsubscribe token | Telling researchers about our analysis services | Consent or legitimate interests; every message carries an unsubscribe link | After unsubscribing, the address is kept only on a suppression list |
Who we share it with
We do not sell personal data and we do not share it for advertising. To run the service we rely on:
- Our hosting provider — the website and our mail server run on a server hosted in the European Union (France). The mail server is our own; correspondence is not handed to a third-party e-mail provider.
- Stripe — when you pay by card the details go directly to Stripe. Card numbers never reach our server and are never stored by us.
- Google Fonts and jsDelivr — your browser loads the page fonts and interface libraries from these services, which discloses your IP address to them.
- Public authorities — only where we are legally required to disclose.
International transfers
Our server is in France, so website and e-mail data are processed in the EEA under the UK’s adequacy regulations. Stripe processes payment data in the EEA and the United States under its own safeguards, including standard contractual clauses.
Security
The site and all endpoints run over HTTPS. The contact form is protected by a hidden honeypot field and a per-IP rate limit rather than a CAPTCHA. The admin panel is not exposed to the internet. We sign a non-disclosure agreement on request.
Your rights
Under UK GDPR you may request access to your personal data, rectification, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests. Where processing relies on consent you may withdraw it at any time. Write to info@celsusanalysis.com and we will respond within one month. You may also complain to the Information Commissioner’s Office (ico.org.uk).
Changes
When this policy changes, the date at the top of the page changes with it. Clients with active projects are told about material changes by e-mail.