1. Controller and processor roles
For personal data used to operate our public sites, manage Bayes Pharma accounts, respond to business inquiries, secure the Services and administer our own business, Bayes Pharma generally acts as controller (or the equivalent role under local law).
Where Bayes Pharma processes personal data contained in Customer Content solely on the documented instructions of a customer organization, Bayes Pharma generally acts as processor and the customer acts as controller. The applicable customer agreement and DPA govern that processing.
Privacy and legal requests may be sent to info@bayespharma.com.
2. Purposes and lawful bases
| Purpose | Typical lawful basis |
|---|---|
| Provide accounts, trials, contracted software and requested support | Contract or steps taken at your request before entering a contract; legitimate interests for business-user administration where appropriate |
| Security, fraud prevention, diagnostics and service integrity | Legitimate interests in protecting Bayes Pharma, customers and users; legal obligations where applicable |
| Respond to business enquiries, demos and partnership requests | Legitimate interests and/or steps requested before contract |
| Optional analytics and similar non-essential technologies | Consent where required |
| Service, security and account communications | Contract, legitimate interests or legal obligation as applicable |
| Direct marketing | Consent where required, or legitimate interests where permitted, with an easy right to object/unsubscribe |
| Legal compliance and claims | Legal obligation and/or legitimate interests in establishing, exercising or defending legal claims |
Where we rely on legitimate interests, we consider the purpose, necessity and impact on individuals and do not use that basis where your interests or fundamental rights override ours.
3. Your data-protection rights
Subject to applicable law and exceptions, you may have rights to:
- be informed about how your personal data is used;
- access your personal data and obtain a copy;
- correct inaccurate or incomplete personal data;
- request erasure;
- restrict processing;
- receive certain data in a portable format;
- object to processing based on legitimate interests and object at any time to direct marketing;
- withdraw consent at any time, without affecting processing already carried out lawfully before withdrawal; and
- obtain safeguards in relation to certain solely automated decisions with legal or similarly significant effects.
We may need to verify identity and authority before fulfilling a request. Statutory exceptions and retention duties can limit a request.
4. Direct marketing and the right to object
You can unsubscribe from marketing using the link in a message or by contacting us. Where direct marketing is based on legitimate interests, you may object at any time and we will stop that marketing. Service, security and account messages are not marketing and may continue when necessary to operate your account or meet legal obligations.
5. Automated decision-making
Bayes Pharma’s professional software may use statistical models or AI-assisted features, but our public service terms require qualified human review for governed scientific, clinical, quality and regulatory decisions. We do not intend public website/account processing to subject individuals to a solely automated decision that produces legal or similarly significant effects.
If a contracted customer workflow uses automated processing in a way that engages specific legal rights, the customer’s intended use, DPA and local governance must address those requirements.
6. International transfers
Personal data may be processed outside the country where it was collected, including where Bayes Pharma or its service providers support customers across Europe, the United States and India. Where a restricted international transfer requires a safeguard, we use an appropriate mechanism such as an adequacy decision, EU Standard Contractual Clauses, a UK-approved transfer mechanism/addendum, or another lawful transfer basis.
Where appropriate, we also use transfer assessments and supplementary technical, contractual or organizational safeguards. Enterprise customers can request relevant transfer terms through the Data Processing & International Transfers page.
7. Retention
We retain personal data only as long as necessary for the relevant purpose, contract, security/audit requirements and legal obligations. Customer Content retention follows the customer agreement and instructions, subject to lawful exceptions.
8. Complaints to a supervisory authority
You may complain to the data-protection authority in the country where you live, work, or where you believe an infringement occurred. We encourage you to contact us first so we can try to resolve the issue, but doing so does not remove your right to contact a regulator.
9. DPO and representative information
We do not publish a Data Protection Officer or Article 27 representative on this page unless one has been formally designated and is legally required for the relevant activity. If a European or UK representative is required for a specific processing activity or contracting structure, the applicable notice or customer documentation will provide those details.
10. Contact
Email info@bayespharma.com with your country/region, relationship to Bayes Pharma and the right or question you want addressed.
85586 Poing, Germany