Privacy policy

This policy covers wetwareworld.com and the correspondence that follows from it. Wetware World is the controller of the personal data described here, in GDPR terms, we determine what is collected and why. Suppliers we approach on your behalf are separate controllers of anything we pass to them, which is covered in clause 5 and in confidentiality and your specification.

We have not appointed a data protection officer. We are not at a scale that requires one under Article 37. Privacy requests go to a monitored inbox: [email protected].

Three categories.

Submissions are stored. A quote request is written to a record so that it can be sourced against, quoted, and referenced later. Retention of that record is governed by clause 6.

We do not ask for and do not want: government identifiers, financial account details through the web form, health information about identifiable individuals, or anything about a research subject. Where your specification concerns human-derived material, describe the material and the consent framework, not the donor. Do not send us identifiable donor data.

We do not profile or score you. No automated decision with legal or similarly significant effect is made about you. A person reads every quote request.

This site is hosted on Cloudflare Pages, and the form endpoint runs on Cloudflare's platform. Cloudflare, as hosting provider and processor, handles the request traffic for every page load and form submission, including the associated request logs and its own security and bot-mitigation processing. Cloudflare operates a global network, so traffic is served from the nearest point of presence.

The full list of processors, as at 2026-09-01:

• Cloudflare, site hosting, form endpoint, request logs, DDoS and bot mitigation, and storage of submitted quote requests.
• Our email provider, receipt and storage of correspondence, quotations and attachments.
• Google Fonts, the site loads webfonts from Google's font hosts, which means your browser makes a request to those hosts carrying your IP address and user agent. We do not receive that data. Where your institution disallows this, self-hosting of the fonts can be discussed.

There is no customer relationship management platform, no marketing automation, no advertising network, no session recorder, and no data broker receiving anything from us. This clause is updated before any addition to the list is switched on.

The full statement is at confidentiality and your specification.

By default, suppliers receive an anonymised version of your requirement. The technical content goes out; your name, your institution and your contact details do not. The quote form carries a checkbox that lets you opt in to your specification being shared under a supplier's standard confidentiality terms. Leaving it unticked means we circulate the anonymised version. Where the material requires the end user to be named, such as a controlled cell line, a material transfer agreement or an export end-use check, anonymity is not available. This is stated before anything is circulated.

A quote request will be deleted earlier on request, unless it is attached to an order we are legally required to keep records of. See clause 7.

If you are in the UK, the EU, or another jurisdiction with equivalent law, you have the right to:

• ask what we hold about you, and get a copy;
• have inaccurate data corrected;
• have data erased, where we have no overriding legal obligation to keep it;
• restrict or object to processing carried out on the basis of legitimate interest;
• receive data you gave us in a portable, machine-readable form;
• withdraw consent at any time, without that affecting anything done before you withdrew it;
• complain to your supervisory authority, in the UK, the Information Commissioner's Office.

How to make a request. Email [email protected] with the word privacy in the subject line, stating the request. No form, portal or account is required. We respond within one month, as the GDPR requires.

We may verify identity before releasing a copy of data. For a quote request this normally means replying from the email address the request came from. Identity documents are not required.

Under the California Consumer Privacy Act as amended, you may request disclosure of the categories and specific pieces of personal information we have collected, request deletion, request correction, and not be discriminated against for exercising any of those rights. The categories we collect are set out in clause 2; the business purposes are in clause 3.

We have not sold personal information, and we have not shared it for cross-context behavioural advertising, in the preceding twelve months. Because we do not sell or share, no do-not-sell mechanism is offered.

We do not process sensitive personal information for the purpose of inferring characteristics. Make a CCPA request the same way as any other, at [email protected]. An authorised agent may act for you with written authorisation.

Sourcing is international. Where we approach a supplier outside your region, the technical content of your requirement goes with the enquiry, and where you have opted in to identity disclosure your contact details go with it. Our host operates a global network, so request handling may occur outside your country.

Where personal data leaves the UK or the EEA we rely on an adequacy decision where one exists, and otherwise on the standard contractual clauses in our processor and supplier agreements. Where a supplier's location is a constraint for your institution, state it on the quote request and we will restrict circulation by geography.

The site is served over TLS. Access to submitted requests and to the correspondence mailbox is limited to the people who need it, currently a small number. Attachments are stored with the request rather than on personal machines.

We do not hold a formal information security management system, an ISO 27001 certification, a SOC 2 report, or a penetration test report. Security questionnaires required by your institution before submitting a specification will be completed on request.

Report a vulnerability in this site to [email protected]. We will not pursue legal action against a good-faith reporter.

This is a business-to-business site for laboratory procurement. It is not directed at children and we do not knowingly collect data from anyone under sixteen. Data collected from a person under sixteen will be deleted on notification.

When this policy changes, the effective date at the foot of the page changes with it. For a change that materially affects how we handle data already submitted, we email people with an open request or an active account.

Enquiries: [email protected].