Privacy Notice
Last updated: 31 July 2026
1. Who we are
This notice is provided by Extracellular Ltd ("Extracellular", "we", "us"), a company registered in England and Wales.
- Company number: 13964988
- Registered office: Science Creates Old Market, Midland Road, Bristol, Bristol, BS2 0JZ, United Kingdom
- Registered with the Information Commissioner's Office (ICO), registration number: ZB565675
- Privacy enquiries: dpo@extracellular.com
Extracellular is the data controller for the personal data described in this notice. We are responsible for deciding how and why it is used.
2. What this notice covers
This notice explains how we handle personal data collected through this website, including our contact form.
Separate notices apply to:
- Job applicants — see our Candidate Privacy Notice (applications are handled through BambooHR — see section 4.5)
- Employees and workers — provided directly to staff
- Client and supplier contacts — set out in the relevant contract or provided on request
3. What we don't do
We think it is as useful to state this plainly as to list what we do collect:
- We do not use analytics or tracking cookies. We do not run Google Analytics or any equivalent, and we do not track your behaviour across sites or over time.
- We do not use advertising or marketing cookies, and we do not build profiles of visitors.
- We do not sell personal data, and we do not share it with third parties for their own marketing purposes.
- We do not make automated decisions about you, and we do not carry out profiling.
Because we set no non-essential cookies, you will not see a cookie consent banner on this site. See section 6.
4. What we collect, why, and on what basis
4.1 Enquiries submitted through our contact form
| What we collect | Your name, your email address, and the content of your message. Your IP address is processed in transit as part of delivering and securing the form. |
| Why | To read, respond to, and keep a record of your enquiry. |
| Lawful basis | Article 6(1)(f) — our legitimate interests in responding to people who contact us about our services. We consider this to have a minimal privacy impact, since you choose what to tell us and we use it only to reply. |
| Is it required? | Providing this information is voluntary, but we cannot respond to an enquiry without a way to reach you. |
Form submissions are passed by a Cloudflare Worker to Resend, which delivers the message to our mailboxes hosted on Microsoft 365. The Worker does not itself store your submission.
4.2 Security and bot protection
| What we collect | Your IP address and technical information about your request, processed by Cloudflare Turnstile to distinguish genuine visitors from automated traffic. |
| Why | To protect this website and our contact form from spam, abuse, and automated attacks. |
| Lawful basis | Article 6(1)(f) — our legitimate interests in maintaining the security and availability of our website. |
Turnstile does not set cookies and does not track you across websites.
4.3 Website hosting and delivery
| What we collect | Your IP address, the pages you request, and standard technical information such as browser type, recorded in server and network logs. |
| Why | To deliver this website to you, keep it available, and detect and investigate security incidents. |
| Lawful basis | Article 6(1)(f) — our legitimate interests in operating a secure and functioning website. |
4.4 Team profiles published on this site
Where this website shows the name, role, photograph, or biography of a member of our team, that information is published with their knowledge. Our team members can ask us to change or remove their profile at any time by contacting us at the address in section 1.
4.5 Careers
If you apply for a role with us, your application is handled through BambooHR, our recruitment and HR platform, and is governed by our Candidate Privacy Notice rather than this one. BambooHR hosts our data in Ireland.
5. Who we share your information with
We use the following service providers, who process personal data on our instructions only and are bound by written contracts requiring them to keep it secure and to use it for no other purpose.
| Provider | What they do | Where the data is held |
|---|---|---|
| Cloudflare, Inc. | Website delivery, DNS, bot protection (Turnstile), and the contact form function | United States and its global network |
| Resend, Inc. | Delivers contact form submissions to our mailboxes | United States |
| Microsoft | Email and document storage (Microsoft 365) | United Kingdom |
| Sanity AS | Content management for this website | Belgium |
| BambooHR, LLC | Recruitment and HR platform (job applications only) | Ireland |
We may also disclose personal data where we are legally required to do so, or where necessary to establish or defend legal claims.
6. Cookies
This website uses only cookies that are strictly necessary for it to function or to keep it secure. We do not set analytics, advertising, or tracking cookies, and we do not use similar technologies for those purposes.
Because we set no non-essential cookies, we do not ask for cookie consent. If this changes, we will update this notice and introduce a consent mechanism before setting any such cookies.
7. Transfers outside the UK
Some of our providers are based in, or hold data in, countries outside the United Kingdom. Where that happens we make sure an appropriate safeguard recognised under UK data protection law is in place:
- Cloudflare and Resend (United States) — transfers are made under the UK Extension to the EU–US Data Privacy Framework, under which both are certified.
- Microsoft — transfers are made under the EU Data Boundary and/or the UK Extension to the EU–US Data Privacy Framework.
- BambooHR — our data is held in Ireland, which is covered by UK adequacy regulations. Where BambooHR accesses data from the United States, that transfer is made under the UK Extension to the EU–US Data Privacy Framework.
- Sanity (Norway) — Norway is within the European Economic Area and is covered by UK adequacy regulations, so no additional safeguard is required.
You can ask us for more detail about any of these safeguards using the contact details in section 1.
8. How long we keep your information
| Information | Retention |
|---|---|
| Contact form submissions held by our email delivery provider | 30 days |
| Enquiry correspondence in our mailboxes | 12 months from our last contact with you, unless the enquiry leads to a business relationship, in which case it is kept under our client records retention period |
| Website and security logs | In line with our providers' standard log retention periods |
| Team profile information | For as long as the individual works with us, and until the website is next updated |
9. Your rights
Under UK data protection law you have the right to:
- Access the personal data we hold about you, and receive a copy of it
- Rectification — have inaccurate data corrected and incomplete data completed
- Erasure — ask us to delete your personal data in certain circumstances
- Restriction — ask us to limit how we use your personal data in certain circumstances
- Object to our processing where we rely on legitimate interests, including an absolute right to object to direct marketing
- Data portability — receive certain data in a portable format, where applicable
- Withdraw consent at any time, where we rely on consent
These rights are not absolute and some apply only in particular circumstances. To exercise any of them, contact us using the details in section 1. We will respond within one month, and will tell you if we need longer or need more information from you to identify your data.
There is no charge for making a request.
10. Complaints
If you are unhappy with how we have handled your personal data, please tell us first using the contact details in section 1. We will acknowledge your complaint within 30 days and respond as quickly as we can.
You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at any time:
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Contacting us first does not affect your right to complain to the ICO.
11. Changes to this notice
We will update this notice when our practices change, and will revise the date at the top. Where changes are significant, we will make that clear on this page.