Privacy Notice
Last updated: 1 October 2026
This notice explains how Z2 Biopharma Solutions Limited ("Z2", "we", "us") collects and uses personal data when you visit z2biopharma.com, contact us or work with us. We handle personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
Z2 Biopharma Solutions Limited is the data controller. We are a company registered in England and Wales, company number 17411863. Registered office: Artisans' House, 7 Queensbridge, Northampton, Northamptonshire, NN4 7BF, United Kingdom.
For any question about this notice or your personal data, e-mail enquiries@z2biopharma.com.
2. The personal data we collect
- Enquiries through the contact form: your name, organisation, e-mail address, phone number (if you give one), the topics you select and your message.
- E-mail and other correspondence: your contact details and whatever you choose to send us.
- Client and supplier relationships: business contact details, and the information needed to deliver, invoice and manage our services.
- Technical data: when you load a page, our hosting and security providers receive your IP address and basic browser information in order to deliver the site and protect it from abuse.
We do not ask for special category data (such as health information), and we ask you not to include confidential or patient-identifiable information in the contact form.
3. How we use it and our lawful bases
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Replying to your enquiry and sending you a confirmation e-mail | Legitimate interests – responding to people who contact us; or steps taken at your request before entering into a contract |
| Providing consultancy and training services, invoicing and account management | Performance of a contract |
| Keeping business, accounting and tax records | Legal obligation |
| Keeping the website secure and blocking spam | Legitimate interests – protecting our website and the people who use it |
We do not sell personal data, use it for automated decision-making or profiling, or add you to a marketing list because you sent an enquiry.
4. Who we share it with
We use a small number of service providers who process data on our behalf, under contract:
- GitHub (GitHub Pages) – hosts the website.
- Cloudflare – receives contact form submissions and runs the Turnstile spam check.
- Resend – sends the enquiry to us and the confirmation e-mail to you (EU region).
- Microsoft 365 – our business e-mail.
- Google Fonts – supplies the fonts used on the site; your browser requests them directly from Google.
Where a project needs specialist input, we may share relevant business contact details with consultants or specialist partners working with us under confidentiality agreements. We may also disclose data where the law requires it, or to professional advisers.
5. International transfers
Some of these providers are based in, or may process data in, countries outside the UK, including the United States. Where that happens we rely on safeguards recognised under UK data protection law, such as UK adequacy regulations (including the UK–US data bridge) or the International Data Transfer Agreement / Addendum.
6. How long we keep it
- Enquiries that do not lead to work: normally up to 24 months after our last contact with you.
- Client and supplier records: for the length of the relationship and normally six years afterwards, to meet legal, accounting and tax requirements.
- Technical logs: held by our providers for short periods under their own retention schedules.
7. Cookies and similar technologies
This website does not use advertising or analytics cookies and does not track you across other sites. The contact page loads Cloudflare Turnstile, which may set a strictly necessary cookie or use browser storage to tell real visitors from automated spam. Because this is essential for the form's security, it does not require consent. You can block or delete cookies in your browser settings; the rest of the site will still work.
8. Your rights
Under UK GDPR you have the right to:
- ask for a copy of the personal data we hold about you (access);
- ask us to correct data that is inaccurate or incomplete;
- ask us to erase your data, or to restrict how we use it, in certain circumstances;
- object to processing based on legitimate interests;
- ask for your data in a portable format, where this applies;
- withdraw consent at any time, where we rely on consent.
To use any of these rights, e-mail enquiries@z2biopharma.com. We will respond within one month. There is normally no charge.
9. Complaints
If you are unhappy with how we have handled your personal data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint.
10. Security
The website is served over HTTPS, access to our systems is restricted, and we use reputable providers with their own security controls. No method of transmission over the internet is completely secure, so please do not send sensitive information through the contact form.
11. Changes to this notice
We may update this notice from time to time. The date at the top shows when it was last changed.