Privacy Notice

Who we are

This portal is operated by two BioChill entities, one per market — the entity you contract with is the one that is your data controller for the personal data described below. Their names, addresses and tax/registration identifiers are shown at the bottom of this notice, read live from our own records so they always match what appears on your purchase order.

What we hold

Your name, telephone number, billing and shipping addresses, and email address, as supplied on your account.

The name and designation of whoever accepts each purchase order on your account's behalf.

Your order history and the pricing attached to your account.

Why, and on what basis

To perform the ordering contract between you and BioChill — taking, quoting, confirming and fulfilling your purchase orders (Article 6(1)(b) UK GDPR; the equivalent basis under the Australian Privacy Principles).

To meet our own tax and accounting retention obligations (Article 6(1)(c) UK GDPR / legal obligation under the APPs).

For security: sign-in records, IP addresses and login-throttling counters, kept for around 90 days, under our legitimate interest in keeping accounts safe from unauthorised access (Article 6(1)(f) UK GDPR).

We never use your data for advertising or profiling, and we do not sell or share it for marketing purposes.

Who it's shared with

Railway — our hosting provider, running the application and database that hold this data.

Resend — our email delivery provider, for order notifications.

Xero — for AU orders only, as part of our accounting. UK customer data never reaches Xero.

No advertising or analytics provider ever receives this data.

International transfers

Your account and order records rest in the European Economic Area, in Amsterdam. The EEA is covered by UK adequacy, so for UK customers that storage is not an international transfer at all; for Australian customers it is an overseas disclosure, protected by the provider safeguards described below.

Railway, our hosting provider, is a US company. The data itself stays in Amsterdam, but Railway's own staff can reach it in order to run and support the service, and that access is a transfer to the United States. The safeguard for it is our Data Processing Agreement with Railway.

Resend, our email delivery provider, is a US company that stores its data in the United States — not only a message in transit, but the delivery logs and account records attached to it, which carry your name and email address. For Resend this is where the data lives, rather than occasional access to data held elsewhere. The transfer is permitted because Resend is certified under the EU-US Data Privacy Framework and its UK Extension.

Xero receives Australian order data only. No UK customer data ever reaches it, so it raises no UK transfer question.

Retention

Order records are kept for the statutory tax retention period in the relevant market (around 5 years for the Australian Tax Office, around 6 years for HMRC VAT records).

Contact records are kept for the life of our trading relationship, plus that same retention period afterwards.

Sign-in and security records are kept for around 90 days.

Your rights

You can ask us to access or correct the personal data we hold about you, and you can object to how we use it. If you're unhappy with how we've handled a request, you can complain to the relevant supervisory authority (see Contact, below).

Erasure is qualified, not absolute: because we're required to keep order records for tax purposes, we can't delete them on request (Article 17(3)(b) UK GDPR covers exactly this case). What we can do instead is deactivate your account — this stops all access to it while your records are retained for as long as we're required to keep them — and correct any inaccurate details you flag to us.

Cookies

This portal uses one strictly-necessary cookie, to keep you signed in. We run no analytics and no third-party tracking, so no cookie consent banner is needed or shown.

If you are a BioChill staff user

This section covers what this portal holds about our own staff, not employment more generally.

We hold your name, username and work email address, which account each of your sign-ins resolved to (plus the IP address, kept for around 90 days), and a record of which orders you quoted, cancelled or exported.

Contact

For any question about this notice or your data, email contact@biochill.com, or write to the relevant entity's address below.

If you're in the UK, you can also contact the Information Commissioner's Office (ICO). If you're in Australia, you can contact the Office of the Australian Information Commissioner (OAIC).

Changes

We revise this notice in place and update the date below when we do. We'll tell you directly about any material change rather than relying on you checking back here.

The entities behind this portal