Skip to policy
Legal · Privacy

Ailurus Privacy Policy

How Ailurus handles personal information across our website, forms, commercial relationships, and scientific projects.

Jump to a section

1. Scope and who is responsible

This Privacy Policy explains how AILURUS LTD, company number SC748751, with its registered office at Summit House, 4–5 Mitchell Street, Edinburgh, Scotland, EH6 7BD ("Ailurus," "we," "us," or "our"), collects, uses, shares, stores, and protects personal information.

Unless a separate notice or contract states otherwise, AILURUS LTD is responsible for personal information collected through ailurus.bio and related Ailurus websites (the "Website"), enquiries, forms, orders, customer relationships, and projects.

Ailurus works with its Affiliates to operate the Website, manage communications and information systems, perform research and development, deliver products and services, and support customers. "Affiliate" has the meaning given in the Ailurus General Terms and Conditions (the "Terms"). An Affiliate may process personal information for Ailurus or may be separately responsible for particular processing where stated in an applicable form, checkout, Quote, order confirmation, contract, or jurisdiction-specific notice.

This Policy applies to Website visitors and to individual contacts at customers, prospective customers, suppliers, collaborators, and other organisations. It does not apply to Ailurus personnel or job applicants where a separate notice is provided.

Our Website and ordinary commercial services are intended for adults acting in a professional or organisational capacity. They are not directed to children, and we do not knowingly collect children's personal information through them.

2. Privacy, confidentiality, and intellectual-property boundaries

Personal-information law, contractual confidentiality, and intellectual-property rights address different matters.

This Policy explains how Ailurus processes information relating to identified or identifiable individuals. It does not determine who owns scientific materials, sequences, project data, Results, inventions, models, or other intellectual property. It also does not create an additional licence or expand any right granted to Ailurus.

Ownership, licences, permitted internal research and development, confidentiality, return or destruction of information, and protection of Customer Materials and Results are governed by the applicable Terms, Quote, order confirmation, and other contract. In particular, Sections 9 and 10 of the Terms govern Customer Materials, Results, Project metadata, derived features, internal research and development, model training, aggregated or anonymised insights, service providers, and confidentiality.

Where Customer Materials, Results, Project metadata, derived features, or other project information contain personal information, Ailurus also processes that personal information as described in this Policy and subject to mandatory law. Nothing in this Policy overrides contractual confidentiality protections or authorises processing, access, transfer, or disclosure prohibited by applicable law.

3. Information we collect and where it comes from

We may collect the following categories of information.

Contact and professional information

This may include your name, professional email address, telephone number, organisation, department, role or job title, country or region, and communication preferences.

Enquiry, form, and communication information

This may include information submitted through Website forms or sent by email or other communication channels, such as the nature of your enquiry, messages, requested products or services, quote requirements, support correspondence, attachments, acknowledgements, and marketing choices.

Webflow forms used on the Website may retain the information submitted through them. Depending on the form, this can include contact details, organisational information, project context, safety and submission confirmations, and synthetic, recombinant, or non-human protein or nucleotide sequences.

Order, transaction, and fulfilment information

This may include billing and shipping addresses, order contents, Quote and contract information, payment status, tax and customs information, delivery information, and transaction history. Payment-card information is generally processed by payment providers; Ailurus may receive limited payment confirmation, billing, and transaction information rather than complete card details.

Scientific and project information

This may include project requirements, research context, Customer Materials and Results in digital or informational form, synthetic or recombinant nucleotide or amino-acid sequences, non-human sequences, protein names and types, construct requirements, safety rationales, Project metadata, derived features, experimental information, reports, and related correspondence.

Website and technical information

This may include IP address, cookie or similar identifiers, browser and device information, approximate location, referring pages, pages visited, interactions, session information, consent choices, and security or diagnostic logs.

Information obtained from other sources

We may receive information from your employer or organisation, another person involved in an enquiry or project, payment and logistics providers, distributors, scientific service providers, publicly available professional sources, and Ailurus Affiliates. If you provide personal information about another person, you should be authorised to do so and provide them with this Policy where appropriate.

4. Why we use personal information and our lawful bases

We use personal information for the following purposes:

  • to respond to enquiries and take steps requested before entering into a contract;
  • to prepare Quotes, accept and administer orders, provide products and services, perform projects, deliver Results, process payments, arrange shipping, and provide support;
  • to verify authority to submit materials or place an order and to assess feasibility, safety, compliance, and appropriate use;
  • to manage customer, supplier, collaborator, and other professional relationships;
  • to operate, maintain, secure, troubleshoot, and improve the Website, forms, communications systems, and services;
  • to measure Website use and understand how visitors interact with the Website;
  • to conduct quality control, evaluation, benchmarking, validation, internal scientific and technological research, model development and testing, and product or service improvement, subject to Section 5;
  • to send requested updates and, where permitted, information about Ailurus products, services, research, or events;
  • to maintain records, enforce agreements, establish or defend legal claims, prevent fraud or misuse, and comply with legal, regulatory, tax, accounting, export-control, biosafety, sanctions, and other obligations; and
  • to protect the rights, safety, property, and security of individuals, Ailurus, customers, and others.

Under UK and EEA data-protection law, our lawful bases may include:

  • contract: processing necessary to take requested pre-contract steps or perform a contract;
  • legitimate interests: operating and securing our business, responding to professional enquiries, managing relationships, improving products and services, and conducting appropriately safeguarded scientific and technological research, where those interests are not overridden by individual rights;
  • legal obligation: meeting applicable legal and regulatory requirements; and
  • consent: where we ask for consent, including for particular cookies, marketing, or processing that requires consent.

Other jurisdictions may provide different grounds. Where applicable law requires consent, separate consent, an additional condition, or another specific authorisation, we will rely on that ground before carrying out the relevant processing. You may withdraw consent at any time, without affecting processing already carried out lawfully before withdrawal.

We do not use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.

5. Scientific and project information

Ordinary submission scope

Our ordinary Website forms and commercial intake processes are designed for synthetic, recombinant, or non-human sequences and related scientific information. Do not submit identifiable human genetic information, patient information, protected health information, human biological samples, or information subject to human-genetic-resources controls through an ordinary Website form unless Ailurus has expressly agreed in writing to an approved process for that information.

We may reject, quarantine, restrict, or delete material submitted outside this scope and may request additional authorisations, ethics documentation, regulatory information, or contractual safeguards.

Internal research, development, and model use

As permitted by the applicable contract, including Section 9.5 of the Terms, scientific and project information may be used for internal research and development, evaluation, benchmarking, quality control, validation and testing, model training and fine-tuning, improving products and services, developing new products and services, and producing Generalized Improvements or aggregated or anonymised insights.

Customer and personal identifiers are not intended to be used as model inputs or research features for those activities. We seek to exclude, remove, separate, or restrict access to direct customer and personal identifiers before using project information for internal research or model development. Removing direct identifiers does not necessarily make information anonymous. Where remaining information can still be related to an identifiable individual, we continue to treat it as personal information and apply this Policy.

Aggregated or anonymised information is treated as such only where individuals and customers are not reasonably identifiable and Customer Materials or Results cannot reasonably be reconstructed using reasonably available means. The contractual limitations and confidentiality protections in the Terms continue to apply independently of whether information is personal information.

6. How we share information

We may disclose personal information to the following recipients where necessary for the purposes described above:

  • Ailurus Affiliates and authorised personnel providing management, Website administration, communications, IT, customer support, finance, operations, scientific work, R&D, or model-development support;
  • Website, cloud, communications, collaboration, analytics, and IT providers, including providers such as Webflow, Feishu, and Google Analytics;
  • payment, accounting, tax, banking, logistics, customs, and delivery providers involved in transactions and fulfilment;
  • scientific and project service providers, such as synthesis, laboratory, manufacturing, analysis, or technical contractors engaged to support an order or authorised internal activity;
  • professional advisers and insurers, including lawyers, accountants, auditors, consultants, and insurers;
  • distributors, collaborators, or transaction counterparties where necessary for a requested relationship or service;
  • courts, regulators, law-enforcement bodies, government authorities, and other recipients where disclosure is required or permitted by law or reasonably necessary to protect rights, safety, or security; and
  • prospective or actual transaction parties and advisers in connection with a financing, investment, reorganisation, merger, acquisition, or transfer of all or part of a business, subject to appropriate confidentiality and data-protection measures.

Service providers processing personal information for Ailurus are required to use it only for authorised purposes, protect it appropriately, and comply with applicable contractual and legal requirements. Some recipients, such as payment providers, carriers, professional advisers, authorities, or transaction counterparties, may act as independent controllers under their own notices and legal duties.

We do not sell personal information. We do not publicly disclose a customer's identity, Customer Materials, or Results through the internal-use rights described in the Terms, except where the customer has authorised the disclosure or disclosure is otherwise permitted by the applicable contract or required by law.

7. International processing and transfers

Ailurus operates internationally. Ailurus, its Affiliates, authorised personnel, and service providers may process or access personal information in the United Kingdom, the European Economic Area, the United States, mainland China, and other countries relevant to our operations or the requested service.

For example, Website and form information may be processed or stored through Webflow in the United States, communications and collaboration information may be processed or stored through Feishu in mainland China, and Website measurement information may be processed through Google Analytics infrastructure. Authorised Ailurus personnel may access these systems from their working locations.

The privacy and data-protection laws of the recipient country may differ from those in your location. Where a transfer is restricted, we use or require an applicable transfer mechanism and supplementary safeguards. Depending on the relevant law and circumstances, these may include adequacy regulations or decisions, standard contractual clauses, the UK International Data Transfer Agreement or UK Addendum, contractual and organisational safeguards, transfer risk or data-protection assessments, regulatory filings, certification, a PRC standard contract or security assessment, and consent or separate consent where required.

Where PRC law requires specific information about an overseas recipient, a separate consent, or a particular cross-border procedure, that information and choice may be provided through the relevant form, transaction, contract, or just-in-time notice.

You may contact support@ailurus.bio for more information about the safeguards relevant to your personal information.

8. How long we keep information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including providing products and services, maintaining the relationship, conducting appropriately safeguarded research, meeting legal and regulatory obligations, resolving disputes, enforcing agreements, and protecting security.

Retention depends on the category and context:

  • enquiry and form information is generally retained while we evaluate and respond to the request and for a reasonable period afterward to manage follow-up, records, and potential claims;
  • customer, order, contract, payment, shipping, tax, and accounting records are retained for the applicable contractual, statutory, audit, and claims periods;
  • support and professional communications are retained while relevant to the relationship, project, compliance obligations, or potential disputes;
  • marketing preferences and suppression records may be retained for as long as necessary to honour the person's choices;
  • cookie, analytics, security, and technical records are retained according to their purpose, configuration, consent status, and security needs; and
  • project information may be retained as permitted or required by the applicable contract, including the Terms, for project performance, support, quality control, internal R&D, model development, Generalized Improvements, and aggregated or anonymised insights.

A contractual right to retain or use non-personal scientific or project information does not by itself justify retaining associated personal identifiers indefinitely. Where personal identifiers are no longer needed, we may delete them, separate them from retained project information, or anonymise the information. Information in backups and disaster-recovery systems is deleted or overwritten in the ordinary course, subject to appropriate access restrictions while retained.

9. Security

We use technical and organisational measures designed to protect personal information against accidental or unlawful loss, destruction, alteration, unauthorised disclosure, or access. Measures may include access controls, role-based permissions, authentication, encryption in transit or at rest where appropriate, provider and contractor controls, confidentiality obligations, backups, monitoring, and incident-response procedures.

Access is limited to authorised Ailurus personnel, Affiliates, and providers who require it for an approved purpose. Our group is currently small, but access is governed by purpose and authorisation rather than being unrestricted merely because a person works with an Ailurus entity.

No transmission or storage system is completely secure. You should use appropriate channels and avoid submitting sensitive or out-of-scope information through ordinary Website forms.

10. Your rights and complaints

Depending on your location, the information involved, and the lawful basis, you may have rights to:

  • be informed about processing;
  • request access to or a copy of your personal information;
  • request correction of inaccurate or incomplete information;
  • request deletion in applicable circumstances;
  • request restriction of processing;
  • object to processing based on legitimate interests and object to direct marketing at any time;
  • receive certain information in a portable format;
  • withdraw consent where processing is based on consent;
  • ask about international-transfer safeguards; and
  • complain to a data-protection authority.

These rights are subject to legal conditions, exemptions, and the rights of others. They do not automatically require deletion of non-personal project information, records that must be retained by law, or information retained under an applicable exception. Contractual ownership, licence, confidentiality, and return or destruction rights are addressed separately under the applicable contract.

To exercise a privacy right, contact support@ailurus.bio. We may need to verify your identity and authority before acting. We will respond within the period required by applicable law.

If UK data-protection law applies, you may complain to the UK Information Commissioner's Office at ico.org.uk. If you are located elsewhere, you may also have the right to complain to the authority responsible for data protection in your location. We encourage you to contact us first so that we can try to address the concern.

11. Cookies, analytics, and marketing

The Website uses or may use cookies and similar technologies for:

  • functions necessary to provide, secure, and operate the Website;
  • remembering preferences and consent choices;
  • measuring Website use, performance, and interactions; and
  • marketing or other optional purposes if introduced and permitted.

We currently use Google Analytics to understand Website use. Google Analytics may collect a cookie identifier, approximate location, browser and device information, session statistics, traffic source, and interaction events. We configure and use analytics subject to applicable consent, information, objection, and data-protection requirements.

Where consent is required, non-essential cookies or similar technologies will not be activated until the user has made the applicable choice. Where applicable law permits narrowly configured statistical technologies without consent, we will provide clear information and a simple way to object. You can manage available choices through the Website's cookie controls and through your browser settings. Disabling some technologies may affect Website functions.

If you subscribe to news, offers, product updates, research updates, or event information, we may use your contact details and preferences to send those communications. You may unsubscribe at any time using the link in the message or by contacting support@ailurus.bio. Service, order, project, security, or legal communications are not marketing and may continue where necessary.

12. Changes and contact

We may update this Policy to reflect changes in our operations, corporate structure, services, technologies, or legal requirements. The updated version will be posted on this page with a revised date. Where required, we will provide additional notice or obtain consent before materially different processing begins.

If responsibility for processing changes through a reorganisation or transaction, the responsible entity will continue to protect personal information and will provide notice where required by law.

Questions, requests, or complaints about this Policy or Ailurus's processing of personal information may be sent to:

AILURUS LTD
Company number SC748751
Summit House, 4–5 Mitchell Street
Edinburgh, Scotland, EH6 7BD
Email: support@ailurus.bio

This Policy explains personal-information processing. Contractual confidentiality, ownership, and licences are governed separately by the applicable Ailurus General Terms and order documents.

Skip to policy
Legal · Privacy

Ailurus Privacy Policy

How Ailurus handles personal information across our website, forms, commercial relationships, and scientific projects.

Jump to a section

1. Scope and who is responsible

This Privacy Policy explains how AILURUS LTD, company number SC748751, with its registered office at Summit House, 4–5 Mitchell Street, Edinburgh, Scotland, EH6 7BD ("Ailurus," "we," "us," or "our"), collects, uses, shares, stores, and protects personal information.

Unless a separate notice or contract states otherwise, AILURUS LTD is responsible for personal information collected through ailurus.bio and related Ailurus websites (the "Website"), enquiries, forms, orders, customer relationships, and projects.

Ailurus works with its Affiliates to operate the Website, manage communications and information systems, perform research and development, deliver products and services, and support customers. "Affiliate" has the meaning given in the Ailurus General Terms and Conditions (the "Terms"). An Affiliate may process personal information for Ailurus or may be separately responsible for particular processing where stated in an applicable form, checkout, Quote, order confirmation, contract, or jurisdiction-specific notice.

This Policy applies to Website visitors and to individual contacts at customers, prospective customers, suppliers, collaborators, and other organisations. It does not apply to Ailurus personnel or job applicants where a separate notice is provided.

Our Website and ordinary commercial services are intended for adults acting in a professional or organisational capacity. They are not directed to children, and we do not knowingly collect children's personal information through them.

2. Privacy, confidentiality, and intellectual-property boundaries

Personal-information law, contractual confidentiality, and intellectual-property rights address different matters.

This Policy explains how Ailurus processes information relating to identified or identifiable individuals. It does not determine who owns scientific materials, sequences, project data, Results, inventions, models, or other intellectual property. It also does not create an additional licence or expand any right granted to Ailurus.

Ownership, licences, permitted internal research and development, confidentiality, return or destruction of information, and protection of Customer Materials and Results are governed by the applicable Terms, Quote, order confirmation, and other contract. In particular, Sections 9 and 10 of the Terms govern Customer Materials, Results, Project metadata, derived features, internal research and development, model training, aggregated or anonymised insights, service providers, and confidentiality.

Where Customer Materials, Results, Project metadata, derived features, or other project information contain personal information, Ailurus also processes that personal information as described in this Policy and subject to mandatory law. Nothing in this Policy overrides contractual confidentiality protections or authorises processing, access, transfer, or disclosure prohibited by applicable law.

3. Information we collect and where it comes from

We may collect the following categories of information.

Contact and professional information

This may include your name, professional email address, telephone number, organisation, department, role or job title, country or region, and communication preferences.

Enquiry, form, and communication information

This may include information submitted through Website forms or sent by email or other communication channels, such as the nature of your enquiry, messages, requested products or services, quote requirements, support correspondence, attachments, acknowledgements, and marketing choices.

Webflow forms used on the Website may retain the information submitted through them. Depending on the form, this can include contact details, organisational information, project context, safety and submission confirmations, and synthetic, recombinant, or non-human protein or nucleotide sequences.

Order, transaction, and fulfilment information

This may include billing and shipping addresses, order contents, Quote and contract information, payment status, tax and customs information, delivery information, and transaction history. Payment-card information is generally processed by payment providers; Ailurus may receive limited payment confirmation, billing, and transaction information rather than complete card details.

Scientific and project information

This may include project requirements, research context, Customer Materials and Results in digital or informational form, synthetic or recombinant nucleotide or amino-acid sequences, non-human sequences, protein names and types, construct requirements, safety rationales, Project metadata, derived features, experimental information, reports, and related correspondence.

Website and technical information

This may include IP address, cookie or similar identifiers, browser and device information, approximate location, referring pages, pages visited, interactions, session information, consent choices, and security or diagnostic logs.

Information obtained from other sources

We may receive information from your employer or organisation, another person involved in an enquiry or project, payment and logistics providers, distributors, scientific service providers, publicly available professional sources, and Ailurus Affiliates. If you provide personal information about another person, you should be authorised to do so and provide them with this Policy where appropriate.

4. Why we use personal information and our lawful bases

We use personal information for the following purposes:

  • to respond to enquiries and take steps requested before entering into a contract;
  • to prepare Quotes, accept and administer orders, provide products and services, perform projects, deliver Results, process payments, arrange shipping, and provide support;
  • to verify authority to submit materials or place an order and to assess feasibility, safety, compliance, and appropriate use;
  • to manage customer, supplier, collaborator, and other professional relationships;
  • to operate, maintain, secure, troubleshoot, and improve the Website, forms, communications systems, and services;
  • to measure Website use and understand how visitors interact with the Website;
  • to conduct quality control, evaluation, benchmarking, validation, internal scientific and technological research, model development and testing, and product or service improvement, subject to Section 5;
  • to send requested updates and, where permitted, information about Ailurus products, services, research, or events;
  • to maintain records, enforce agreements, establish or defend legal claims, prevent fraud or misuse, and comply with legal, regulatory, tax, accounting, export-control, biosafety, sanctions, and other obligations; and
  • to protect the rights, safety, property, and security of individuals, Ailurus, customers, and others.

Under UK and EEA data-protection law, our lawful bases may include:

  • contract: processing necessary to take requested pre-contract steps or perform a contract;
  • legitimate interests: operating and securing our business, responding to professional enquiries, managing relationships, improving products and services, and conducting appropriately safeguarded scientific and technological research, where those interests are not overridden by individual rights;
  • legal obligation: meeting applicable legal and regulatory requirements; and
  • consent: where we ask for consent, including for particular cookies, marketing, or processing that requires consent.

Other jurisdictions may provide different grounds. Where applicable law requires consent, separate consent, an additional condition, or another specific authorisation, we will rely on that ground before carrying out the relevant processing. You may withdraw consent at any time, without affecting processing already carried out lawfully before withdrawal.

We do not use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.

5. Scientific and project information

Ordinary submission scope

Our ordinary Website forms and commercial intake processes are designed for synthetic, recombinant, or non-human sequences and related scientific information. Do not submit identifiable human genetic information, patient information, protected health information, human biological samples, or information subject to human-genetic-resources controls through an ordinary Website form unless Ailurus has expressly agreed in writing to an approved process for that information.

We may reject, quarantine, restrict, or delete material submitted outside this scope and may request additional authorisations, ethics documentation, regulatory information, or contractual safeguards.

Internal research, development, and model use

As permitted by the applicable contract, including Section 9.5 of the Terms, scientific and project information may be used for internal research and development, evaluation, benchmarking, quality control, validation and testing, model training and fine-tuning, improving products and services, developing new products and services, and producing Generalized Improvements or aggregated or anonymised insights.

Customer and personal identifiers are not intended to be used as model inputs or research features for those activities. We seek to exclude, remove, separate, or restrict access to direct customer and personal identifiers before using project information for internal research or model development. Removing direct identifiers does not necessarily make information anonymous. Where remaining information can still be related to an identifiable individual, we continue to treat it as personal information and apply this Policy.

Aggregated or anonymised information is treated as such only where individuals and customers are not reasonably identifiable and Customer Materials or Results cannot reasonably be reconstructed using reasonably available means. The contractual limitations and confidentiality protections in the Terms continue to apply independently of whether information is personal information.

6. How we share information

We may disclose personal information to the following recipients where necessary for the purposes described above:

  • Ailurus Affiliates and authorised personnel providing management, Website administration, communications, IT, customer support, finance, operations, scientific work, R&D, or model-development support;
  • Website, cloud, communications, collaboration, analytics, and IT providers, including providers such as Webflow, Feishu, and Google Analytics;
  • payment, accounting, tax, banking, logistics, customs, and delivery providers involved in transactions and fulfilment;
  • scientific and project service providers, such as synthesis, laboratory, manufacturing, analysis, or technical contractors engaged to support an order or authorised internal activity;
  • professional advisers and insurers, including lawyers, accountants, auditors, consultants, and insurers;
  • distributors, collaborators, or transaction counterparties where necessary for a requested relationship or service;
  • courts, regulators, law-enforcement bodies, government authorities, and other recipients where disclosure is required or permitted by law or reasonably necessary to protect rights, safety, or security; and
  • prospective or actual transaction parties and advisers in connection with a financing, investment, reorganisation, merger, acquisition, or transfer of all or part of a business, subject to appropriate confidentiality and data-protection measures.

Service providers processing personal information for Ailurus are required to use it only for authorised purposes, protect it appropriately, and comply with applicable contractual and legal requirements. Some recipients, such as payment providers, carriers, professional advisers, authorities, or transaction counterparties, may act as independent controllers under their own notices and legal duties.

We do not sell personal information. We do not publicly disclose a customer's identity, Customer Materials, or Results through the internal-use rights described in the Terms, except where the customer has authorised the disclosure or disclosure is otherwise permitted by the applicable contract or required by law.

7. International processing and transfers

Ailurus operates internationally. Ailurus, its Affiliates, authorised personnel, and service providers may process or access personal information in the United Kingdom, the European Economic Area, the United States, mainland China, and other countries relevant to our operations or the requested service.

For example, Website and form information may be processed or stored through Webflow in the United States, communications and collaboration information may be processed or stored through Feishu in mainland China, and Website measurement information may be processed through Google Analytics infrastructure. Authorised Ailurus personnel may access these systems from their working locations.

The privacy and data-protection laws of the recipient country may differ from those in your location. Where a transfer is restricted, we use or require an applicable transfer mechanism and supplementary safeguards. Depending on the relevant law and circumstances, these may include adequacy regulations or decisions, standard contractual clauses, the UK International Data Transfer Agreement or UK Addendum, contractual and organisational safeguards, transfer risk or data-protection assessments, regulatory filings, certification, a PRC standard contract or security assessment, and consent or separate consent where required.

Where PRC law requires specific information about an overseas recipient, a separate consent, or a particular cross-border procedure, that information and choice may be provided through the relevant form, transaction, contract, or just-in-time notice.

You may contact support@ailurus.bio for more information about the safeguards relevant to your personal information.

8. How long we keep information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including providing products and services, maintaining the relationship, conducting appropriately safeguarded research, meeting legal and regulatory obligations, resolving disputes, enforcing agreements, and protecting security.

Retention depends on the category and context:

  • enquiry and form information is generally retained while we evaluate and respond to the request and for a reasonable period afterward to manage follow-up, records, and potential claims;
  • customer, order, contract, payment, shipping, tax, and accounting records are retained for the applicable contractual, statutory, audit, and claims periods;
  • support and professional communications are retained while relevant to the relationship, project, compliance obligations, or potential disputes;
  • marketing preferences and suppression records may be retained for as long as necessary to honour the person's choices;
  • cookie, analytics, security, and technical records are retained according to their purpose, configuration, consent status, and security needs; and
  • project information may be retained as permitted or required by the applicable contract, including the Terms, for project performance, support, quality control, internal R&D, model development, Generalized Improvements, and aggregated or anonymised insights.

A contractual right to retain or use non-personal scientific or project information does not by itself justify retaining associated personal identifiers indefinitely. Where personal identifiers are no longer needed, we may delete them, separate them from retained project information, or anonymise the information. Information in backups and disaster-recovery systems is deleted or overwritten in the ordinary course, subject to appropriate access restrictions while retained.

9. Security

We use technical and organisational measures designed to protect personal information against accidental or unlawful loss, destruction, alteration, unauthorised disclosure, or access. Measures may include access controls, role-based permissions, authentication, encryption in transit or at rest where appropriate, provider and contractor controls, confidentiality obligations, backups, monitoring, and incident-response procedures.

Access is limited to authorised Ailurus personnel, Affiliates, and providers who require it for an approved purpose. Our group is currently small, but access is governed by purpose and authorisation rather than being unrestricted merely because a person works with an Ailurus entity.

No transmission or storage system is completely secure. You should use appropriate channels and avoid submitting sensitive or out-of-scope information through ordinary Website forms.

10. Your rights and complaints

Depending on your location, the information involved, and the lawful basis, you may have rights to:

  • be informed about processing;
  • request access to or a copy of your personal information;
  • request correction of inaccurate or incomplete information;
  • request deletion in applicable circumstances;
  • request restriction of processing;
  • object to processing based on legitimate interests and object to direct marketing at any time;
  • receive certain information in a portable format;
  • withdraw consent where processing is based on consent;
  • ask about international-transfer safeguards; and
  • complain to a data-protection authority.

These rights are subject to legal conditions, exemptions, and the rights of others. They do not automatically require deletion of non-personal project information, records that must be retained by law, or information retained under an applicable exception. Contractual ownership, licence, confidentiality, and return or destruction rights are addressed separately under the applicable contract.

To exercise a privacy right, contact support@ailurus.bio. We may need to verify your identity and authority before acting. We will respond within the period required by applicable law.

If UK data-protection law applies, you may complain to the UK Information Commissioner's Office at ico.org.uk. If you are located elsewhere, you may also have the right to complain to the authority responsible for data protection in your location. We encourage you to contact us first so that we can try to address the concern.

11. Cookies, analytics, and marketing

The Website uses or may use cookies and similar technologies for:

  • functions necessary to provide, secure, and operate the Website;
  • remembering preferences and consent choices;
  • measuring Website use, performance, and interactions; and
  • marketing or other optional purposes if introduced and permitted.

We currently use Google Analytics to understand Website use. Google Analytics may collect a cookie identifier, approximate location, browser and device information, session statistics, traffic source, and interaction events. We configure and use analytics subject to applicable consent, information, objection, and data-protection requirements.

Where consent is required, non-essential cookies or similar technologies will not be activated until the user has made the applicable choice. Where applicable law permits narrowly configured statistical technologies without consent, we will provide clear information and a simple way to object. You can manage available choices through the Website's cookie controls and through your browser settings. Disabling some technologies may affect Website functions.

If you subscribe to news, offers, product updates, research updates, or event information, we may use your contact details and preferences to send those communications. You may unsubscribe at any time using the link in the message or by contacting support@ailurus.bio. Service, order, project, security, or legal communications are not marketing and may continue where necessary.

12. Changes and contact

We may update this Policy to reflect changes in our operations, corporate structure, services, technologies, or legal requirements. The updated version will be posted on this page with a revised date. Where required, we will provide additional notice or obtain consent before materially different processing begins.

If responsibility for processing changes through a reorganisation or transaction, the responsible entity will continue to protect personal information and will provide notice where required by law.

Questions, requests, or complaints about this Policy or Ailurus's processing of personal information may be sent to:

AILURUS LTD
Company number SC748751
Summit House, 4–5 Mitchell Street
Edinburgh, Scotland, EH6 7BD
Email: support@ailurus.bio

This Policy explains personal-information processing. Contractual confidentiality, ownership, and licences are governed separately by the applicable Ailurus General Terms and order documents.