Privacy Policy

1. Introduction

Brainfloss UK Private Limited ("Brainfloss," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our virtual lab platform ("Service").

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using the Service, you consent to the collection and use of information in accordance with this Privacy Policy.

2. Data Controller

Brainfloss UK Private Limited

Unit 66, The Grange
1 Central Road
Morden, SM4 5PQ
United Kingdom

Telephone: 02080582908

Email: labs@brainfloss.com

Data Protection Officer: dpo@brainfloss.com

3. Information We Collect

3.1 Information You Provide

We collect information that you voluntarily provide when you:

• Create an account: Name, email address, organization name, phone number
• Use the Service: Virtual machine configurations, uploaded files, course materials
• Contact us: Messages, feedback, support requests
• Make payments: Billing address, payment method details (processed by third-party payment processors)

3.2 Information Collected Automatically

When you use the Service, we automatically collect:

• Usage data: IP address, browser type, device information, operating system
• Log data: Access times, pages viewed, actions taken within the Service
• Performance data: VM usage, resource consumption, session duration
• Cookies and tracking technologies: See our Cookie Policy below

3.3 Information from Third Parties

We may receive information from:

• Authentication providers (if you use single sign-on)
• Payment processors
• Cloud infrastructure providers (AWS)

4. How We Use Your Information

We use your personal data for the following purposes:

4.1 Service Provision

• To create and manage your account
• To provide access to virtual lab environments
• To process your transactions and manage billing
• To deliver customer support

4.2 Service Improvement

• To analyze usage patterns and improve the Service
• To develop new features and functionality
• To monitor and ensure platform performance and security

4.3 Communications

• To send service-related notifications and updates
• To respond to your inquiries and requests
• To send marketing communications (with your consent)

4.4 Legal and Security

• To comply with legal obligations
• To protect against fraud and abuse
• To enforce our Terms of Service
• To protect the rights and safety of our users

5. Legal Basis for Processing (UK GDPR)

We process your personal data based on the following legal grounds:

• Contract performance: To provide the Service you have requested
• Legitimate interests: To improve our Service, prevent fraud, and ensure security
• Legal obligation: To comply with applicable laws and regulations
• Consent: For marketing communications and non-essential cookies (you may withdraw consent at any time)

6. Data Sharing and Disclosure

6.1 Service Providers

We share data with trusted third-party service providers who assist us in operating the Service:

• Cloud hosting: Amazon Web Services (AWS)
• Payment processing: Stripe or similar payment processors
• Email services: For sending transactional and marketing emails
• Analytics: To understand usage patterns

These providers are contractually bound to protect your data and use it only for the purposes we specify.

6.2 Legal Requirements

We may disclose your information if required by law or in response to:

• Court orders or legal processes
• Requests from government authorities
• Protection of our legal rights
• Prevention of fraud or illegal activity

6.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity. We will notify you of any such change in ownership.

6.4 With Your Consent

We may share your information with third parties when you explicitly consent to such sharing.

7. International Data Transfers

Your data may be transferred to and processed in countries outside the United Kingdom, including the United States, where our cloud infrastructure providers operate.

When we transfer data internationally, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the UK Information Commissioner's Office
• Adequacy decisions recognizing equivalent data protection standards
• Binding corporate rules

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• Encryption of data in transit and at rest
• Regular security assessments and penetration testing
• Access controls and authentication mechanisms
• Employee training on data protection
• Incident response procedures

However, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.

9. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy:

• Account data: Until you delete your account, plus 30 days
• Billing records: 7 years (as required by UK tax law)
• Usage logs: 12 months
• Marketing data: Until you unsubscribe or request deletion

After the retention period, we will securely delete or anonymize your personal data.

10. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

10.1 Right of Access

You can request a copy of the personal data we hold about you.

10.2 Right to Rectification

You can request correction of inaccurate or incomplete personal data.

10.3 Right to Erasure

You can request deletion of your personal data in certain circumstances.

10.4 Right to Restrict Processing

You can request that we limit how we use your personal data.

10.5 Right to Data Portability

You can request a copy of your data in a machine-readable format.

10.6 Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

10.7 Right to Withdraw Consent

Where processing is based on consent, you can withdraw it at any time.

10.8 Right to Lodge a Complaint

You have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: https://ico.org.uk
Phone: 0303 123 1113

10.9 Exercising Your Rights

To exercise any of these rights, please contact our Data Protection Officer at dpo@brainfloss.com. We will respond within one month of your request.

11. Cookie Policy

11.1 What Are Cookies

Cookies are small text files placed on your device when you visit our website. They help us provide and improve the Service.

11.2 Types of Cookies We Use

Essential Cookies

Required for the Service to function properly. These cannot be disabled.

• Authentication and session management
• Security features
• Load balancing

Functional Cookies

Enhance your experience by remembering your preferences.

• Language preferences
• Display settings
• Previously selected options

Analytics Cookies

Help us understand how you use the Service (requires consent).

• Page views and navigation patterns
• Feature usage statistics
• Performance monitoring

Marketing Cookies

Used to deliver relevant advertisements (requires consent).

11.3 Managing Cookies

You can control cookies through your browser settings. Note that disabling certain cookies may affect Service functionality. Most browsers allow you to:

• View what cookies are stored
• Delete cookies
• Block cookies from specific sites
• Block third-party cookies
• Delete all cookies when you close the browser

11.4 Third-Party Cookies

Some cookies are placed by third-party services, such as analytics providers. These are subject to the third party's privacy policies.

12. Children's Privacy

The Service is not intended for children under 13 years of age. We do not knowingly collect personal data from children under 13. If you believe we have collected data from a child under 13, please contact us at dpo@brainfloss.com.

13. Marketing Communications

We may send you marketing communications about our products and services if you have consented or where we have a legitimate interest.

You can opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in our emails
• Updating your preferences in your account settings
• Contacting us at labs@brainfloss.com

Note: You will continue to receive essential service-related communications even if you opt out of marketing.

14. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service at least 30 days before they take effect.

The "Last Updated" date at the top of this page indicates when the Privacy Policy was last revised. Your continued use of the Service after changes take effect constitutes acceptance of the updated Privacy Policy.

16. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

Email: dpo@brainfloss.com (Data Protection Officer)
General inquiries: labs@brainfloss.com
Phone: 02080582908
Address: Brainfloss UK Private Limited, Unit 66, The Grange, 1 Central Road, Morden, SM4 5PQ, United Kingdom