Privacy Policy

1. Purposes and Legal Grounds

The way we process and collect data through our platform is in conformity with the GDPR (Regulation (EU) 2016/679). We process personal data only where we have a lawful basis under Article 6 GDPR. The legal bases we rely on, and the purposes they cover, are:

• Performance of a contract (Art. 6(1)(b)) — to create and manage your user account, deliver the CryoCloud services you have subscribed to, process your image data and analysis jobs, and provide support.

• Legitimate interests (Art. 6(1)(f)) — to log processing jobs and web/server data for security, troubleshooting, billing, fraud prevention, and to improve and optimize our platform. You may object to processing based on legitimate interests at any time (see "View, Modify, or Delete Personal Data" below).

• Compliance with a legal obligation (Art. 6(1)(c)) — to retain records and respond to lawful requests from authorities where required by EU or Member State law.

• Consent (Art. 6(1)(a)) — where we ask for it specifically (for example, optional communications). You may withdraw consent at any time without affecting the lawfulness of prior processing.

The following measurements have been implemented to comply with the GDPR.

• Data protection by design & default: Privacy and data protection principles are safeguarded by implementing technical and organizational measures from the design stage to the deployment of our platform.

• Transparency: We believe in the importance of being transparent with our data flow organization as well as to how access to data is structured.

• Data Protection Officer: We have appointed a Data Protection Officer (DPO) as the first point of contact for any concerns or questions related to our personal data practices, including requests to exercise your rights under the GDPR. You may contact the DPO via hi@cryocloud.io.

• Privacy Statement: We hold a privacy statement with all users of our platform describing all GDPR rights.

• Duty to report data breaches: We hold a data breach procedure that includes the GDPR rules of communicating data breaches.

2. Type of Data Collected

The types of data collected through our platform are:

• Processing logs: all analysis jobs will be logged, containing e.g. runtime and the resources used, to ensure business operation, i.e., allow us to provide and troubleshoot errors, monitor & bill the resources you used for analysis, and optimize our application

• Web Data: We collect information that your browser sends whenever you visit our platform. This log data may include information such as your computer's Internet Protocol address, browser type, browser version, the pages of our website that you visit, and the time and date of your visit.

• Personal data: We collect personal data required to create the user account for the CryoCloud Dashboard. Personal data is defined as any information which are related to an identified or identifiable natural person.

3. Storage, Retention, and Deletion

Records of the personal data collected are processed by CryoCloud B.V. as data controller. We retain personal data only for as long as necessary for the purposes for which it was collected and in line with the following criteria:

• Account data (name, email, organization): for the duration of your subscription and for 24 months after account closure, after which the account is deleted or anonymized.

• Image data and analysis outputs (3D density maps, .pdb models, processing logs): for the duration of your subscription; on termination, you may export or delete this data via the dashboard, and we delete it within 30 days of account closure unless you instruct otherwise.

• Web/server logs (IP, browser, timestamps): retained for up to 12 months for security, fraud prevention, and troubleshooting.

• Billing and tax records: retained for at least 7 years (or the period required under applicable Dutch/EU tax and accounting law).

• Support correspondence: retained for up to 36 months after closure of the relevant ticket.

• Where we are required by law to retain data for a longer period, we will do so only for that purpose. After the applicable retention period, data is deleted or irreversibly anonymized.

4. Image Data Ownership, IP, and Access

You will maintain full ownership of all the image data that you upload and process, including resulting 3D density maps and .pdb protein models. You will retain all intellectual property rights associated with your data.

You will maintain access to data at any time and will have the option to request the download or deletion of datasets. If you have a request for deletion or download that cannot be accessed via the web -app, please contact us at hi@cryocloud.io.

5. Cookies

Cookies are files with a small amount of data, which may include an anonymous unique identifier. We use functional cookies that are essential for optimizing the users’ navigation on the platform. These cookies also support the website security and basic functionality. If we ever introduce non-essential cookies, we request your consent through a cookie banner before they are set, and you are able to withdraw consent.

6. Data to Third Parties

We share personal data with the following categories of recipients, who act as our processors under written data processing agreements that include the safeguards required by Article 28 GDPR:

• Cloud hosting and storage providers — to host the platform and store image data and analysis outputs.

• Customer support and communication tools — to handle support tickets and product communications.

• Analytics and product telemetry — limited to functional usage data; no advertising trackers.

• Payment and billing providers — to process subscription payments where applicable.

• Professional advisers — legal, accounting, and audit firms, on a confidential basis.

We do not sell personal data and do not share it with third parties for their own marketing or other commercial purposes. We may also disclose personal data where required by law or to respond to valid legal processes.

7. View, Modify, or Delete Personal Data

Under the GDPR you have the following rights in relation to your personal data, which you may exercise free of charge by contacting us at hi@cryocloud.io. We will respond within one month of your request (extendable by two further months for complex requests, in which case we will inform you).

• Right of access (Art. 15) — to obtain confirmation of whether we process your personal data and a copy of that data, together with information about the processing.

• Right to rectification (Art. 16) — to have inaccurate personal data corrected and incomplete data completed.

• Right to erasure / "right to be forgotten" (Art. 17) — to have your personal data deleted in the circumstances set out in the GDPR.

• Right to restriction of processing (Art. 18) — to require us to limit how we process your data in defined circumstances.

• Right to data portability (Art. 20) — to receive the personal data you have provided to us in a structured, commonly used, machine-readable format and to transmit it to another controller.

• Right to object (Art. 21) — to object at any time to processing based on our legitimate interests; we will stop unless we demonstrate compelling legitimate grounds that override your interests.

• Right to withdraw consent (Art. 7(3)) — where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.

• Right not to be subject to automated decision-making (Art. 22) — see the section on automated decision-making below.

• Right to lodge a complaint with a supervisory authority (Art. 77) — see "Filing a Complaint" below.

Many of these rights can be exercised directly through your account settings; for the others, please contact us at hi@cryocloud.io.

8. Filing a Complaint

Users may file a complaint with our Data Protection Officer via email at hi@cryocloud.io. In case you may have a serious concern regarding data privacy, you may always contact "Autoriteit Persoonsgegevens" (https://autoriteitpersoonsgegevens.nl), or the Data Privacy Agency/Authority of your respective country.

9. Privacy Policy Version

If we make any material changes to this Privacy Policy, we will notify you through the email address you have provided us, giving you a reasonable period to review the changes before they take effect. Your continued use of the service after we post any modifications to the Privacy Policy on this page will constitute your acknowledgment of the modifications and your consent to abide and be bound by the modified Privacy Policy.