1. Scope of this notice
This notice covers personal information collected when you browse MyDNABank informational websites, join our waiting list, choose to receive a newsletter or contact our team. Visitors include individuals and representatives of laboratories, biobanks, pharmaceutical companies and research organisations.
The consumer, laboratory and research-partner pages use different forms and services, as explained below. Participant accounts, genomic uploads, clinical services and research participation require additional information specific to those activities. This notice does not authorise genomic research or replace participant consent.
2. Who is responsible
MYDNABANK HOLDINGS LTD , a company registered in Cyprus under registration number HE436711, operates these websites under the MyDNABank brand.
Registered address: Vyzantiou 40-42, 1st floor, Office 103, Egkomi, 2432 Nicosia, Cyprus.
Email: hello@mydnabank.io .
For the website activities described here, we determine why and how personal information is used and act as the data controller. This role does not establish our role for every laboratory or research programme. Programme responsibilities are addressed separately.
3. What we receive and where it comes from
- Waiting list: the visible registration field collects your email address. The form submits through Constant Contact.
- Laboratory enquiries: the form requests organisation, name, email, role and message. Research-partner forms request the contact and project details shown on the relevant page.
- Correspondence: information you send by email, including your message, signature and attachments.
- Technical information: website requests and enabled services expose information such as IP address, browser and device information, requested pages and request times.
- Consumer-page analytics: Google Analytics records website interactions, including configured call-to-action events.
We receive enquiry information directly from you. Technical information is generated by your browser and website services. Do not include genomic files, medical records or unnecessary information about another person in a general enquiry.
4. Contact forms and registrations
Our laboratory and research-partner forms prepare a message in your email application. You choose whether to send the message to hello@mydnabank.io. We receive your enquiry once you send it, and handle the resulting correspondence through Google Workspace.
Waiting-list registrations are submitted through Constant Contact. The information collected and the purpose of the registration are explained beside the form. Please provide only the details needed for your enquiry or registration.
5. Purposes and legal grounds
- Waiting-list updates: to respond to your registration and communicate about availability. We rely on your consent to the communications described when you join.
- Optional newsletters: to send the newsletter you separately choose to receive. We rely on consent. Waiting-list registration alone is not permission for unrelated newsletters.
- Business enquiries: to respond, assess a proposed partnership and maintain relevant correspondence. We rely on our legitimate interest in communicating with prospective partners and managing business relationships.
- Requests for an individual contract: where you personally request steps towards a contract, processing necessary for those steps relies on that purpose. An employee contacting us for an organisation is not automatically an individual contracting party.
- Website security and operation: to investigate errors, maintain availability and address misuse. We rely on legitimate interests in operating and protecting the website, subject to your rights.
- Optional analytics and tracking: consent is the basis for optional device tracking where required. Our intended analytics purpose is understanding use of the consumer website.
- Legal duties and claims: to comply with applicable legal obligations, or protect and exercise legal rights where a legitimate interest applies.
You are not obliged to join the waiting list or contact us. Without a usable reply address or sufficient details, we might be unable to respond or assess your request. You have the right to object to processing based on legitimate interests.
6. Waiting-list and newsletter choices
Waiting-list communications concern the service you registered interest in. A general newsletter requires a separate, optional choice. Declining a newsletter does not remove your waiting-list registration.
To stop communications, use an unsubscribe option included in the message or email hello@mydnabank.io. Specify whether your request concerns the waiting list, newsletter or both. Withdrawing marketing consent does not prevent replies to a question you send us or communications necessary for an existing agreement.
We retain only the minimum suppression information needed to respect an unsubscribe or objection. Unsubscribing and requesting deletion are related but distinct actions.
9. Hosting and international processing
The confirmed hosting server for mydnabank.io is in Frankfurt, Germany. This location does not mean all email, mailing-list, analytics, support or backup processing stays in Germany or the European Economic Area.
Our providers operate international services. Processing locations depend on the service and account arrangements. A website server location alone does not establish the location of every recipient.
Where personal information is transferred outside the European Economic Area, applicable transfer requirements must be met. Relevant safeguards include an applicable adequacy decision or approved contractual safeguards, with further measures where required. Contact hello@mydnabank.io for information about the arrangements applicable to your data and how to obtain relevant safeguards.
10. Retention and deletion
- Unconverted partnership enquiries: 24 months after the last meaningful contact. If discussions become a contractual relationship, relevant records follow the retention requirements for that relationship.
- Waiting-list records: while the waiting list operates, with an annual review of continued need. Withdrawal or closure of the list triggers review and removal of records no longer needed.
- Newsletter records: until unsubscribe, with an annual review of inactive subscriptions and continued need.
- Suppression records: only the minimum information needed to prevent unwanted future communications, retained while necessary to honour the preference.
- Security logs and backups: governed by the relevant provider settings and operational need. Records needed for a specific security incident or legal claim are assessed separately.
Relevant legal duties or disputes sometimes require specific records to be retained longer. Such retention is limited to the information and purpose requiring it. Removal from an active mailbox or mailing list does not necessarily remove backup copies immediately. We assess the systems involved when handling a deletion request.
11. Protecting your information
We limit use of website contact information to the purposes described in this notice. Access should be restricted to people and providers who need the information for those purposes, with safeguards appropriate to the information and service involved.
General website forms and email are intended for enquiries. Please do not send genomic files, clinical records or other sensitive information through these channels. A genomic service or research programme requires its own approved process.
No online service guarantees absolute security. If you suspect an unintended disclosure or misuse of your information, contact hello@mydnabank.io. Describe the concern without unnecessarily resending sensitive material.
12. Your rights and requests
Under applicable data protection law, rights include:
- Access to your personal information and information about its use.
- Correction of inaccurate or incomplete information.
- Erasure where the relevant conditions apply.
- Restriction of processing in specified circumstances.
- Objection to processing based on legitimate interests, and to direct marketing.
- Data portability where processing is automated and based on consent or contract.
- Withdrawal of consent, without affecting the lawfulness of processing before withdrawal.
Send requests to hello@mydnabank.io. Describe the relevant activity and the email address used. We request additional identity information only where needed to verify the request. An authorised representative should provide evidence of authority.
We respond without undue delay and ordinarily within one month. Where the law permits an extension for complexity or the number of requests, we explain the reason within the initial period. Requests are generally free. Any applicable exception, refusal or charge will be explained along with the available complaint route.
For information handled under a laboratory or research programme, identify the programme so the request reaches the responsible organisation. This website notice does not override those responsibilities.
13. Younger visitors
Visitors of all ages are welcome to ask questions, join the waiting list and express interest in our newsletter. Where the law requires parental authorisation for a child’s subscription, that authorisation is required before we rely on consent to send those communications.
If you are unsure whether you need permission, ask a parent or guardian to help before subscribing. A parent or guardian who believes a child has subscribed without the required authorisation should contact hello@mydnabank.io so we can review the registration and stop or remove it where appropriate.
Sending an enquiry or joining a mailing list does not enrol anyone in genomic testing or research. Any future service involving a child requires separate age-appropriate information and permissions.
14. Complaints and contact
Please contact us if you have a concern. You also have the right to complain directly to a supervisory authority, including where you live or work or where an alleged infringement occurred, as applicable.
Our Cyprus supervisory authority is the Office of the Commissioner for Personal Data Protection . Email: commissioner@dataprotection.gov.cy .
15. Changes to this notice
We update this notice when relevant processing or requirements change and revise the date shown above. Where a change requires further notice or a new permission, publishing revised text alone does not replace those steps.