Privacy Policy

Who we are

OMIKS is a biological data analysis office registered in Italy. For the purposes of data protection law, the Data Controller is:

Michael Giolai
Strada Colterenzio 27, 39057 Appiano sulla Strada del Vino (BZ), Italy
VAT number: IT-03212780211
Email: enquiries@omiks.it

All data protection matters are handled by OMIKS. Contact us at the address above for any privacy-related enquiry. We process personal data in accordance with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), the Italian Data Protection Code (Legislative Decree No. 196/2003, as amended by Legislative Decree No. 101/2018), and other applicable EU and Italian law.

We have assessed that, at our current scale, appointing a Data Protection Officer is not required under Article 37 GDPR. We review this periodically.

One important distinction: depending on the project, OMIKS may act either as a Data Controller or as a Data Processor on behalf of a client.

For website enquiries, invoicing, and business communications, we act as Data Controller – we decide what data to collect and why.

For client projects involving personal data, we act as Data Processor – we process data only according to your instructions, under a written agreement. You remain the Data Controller and retain full responsibility for the data you send us.

Is your research data personal data?

Not always – and the distinction matters.

Data that is personal data under GDPR – and therefore subject to this policy in full – includes:

• Your name, email address, and institutional affiliation
• Research metadata linked to identifiable individuals
• Human genomic, health, or biometric data where individuals could be identified
• Pseudonymised datasets where re-identification is still reasonably possible

Data that typically falls outside GDPR includes:

• Data genuinely anonymised so that no individual can be identified
• Data from non-human organisms – plant, bacterial, fungal, environmental
• Environmental samples with no link to any identifiable person

A note on genomic data: human sequencing data can be personal data even when it looks anonymised, because individuals can sometimes be re-identified from genomic sequences alone. If your project involves human-derived samples, please tell us before sending data. We will make sure the right safeguards are in place.

Your responsibility: you must accurately describe the nature of any data you submit to us. Where the data involves identifiable individuals – including research participants – you remain responsible for establishing a valid legal basis for processing under GDPR and for ensuring those individuals have been appropriately informed, unless a valid research exemption applies.

Where you provide us with data relating to research participants who were not directly involved in our engagement – for example, sequencing data from a patient cohort – you, as Data Controller, are responsible for meeting the notice requirements under Article 14 GDPR. We support this by applying pseudonymisation and the additional safeguards required under Article 89 GDPR for scientific research processing. Where a Data Protection Impact Assessment is required under Article 35 GDPR, we will assist you on request.

What data do we collect?

From clients and contacts:

• Your name, email address, and institutional or company affiliation
• Research or bioinformatics data you submit for analysis
• Project communications, specifications, and technical documentation

Providing your name and email address is necessary for us to respond to your enquiry or deliver a service. Without this, we cannot process your request.

From website visitors:

When you visit this website, certain technical information is processed automatically. This includes anonymised and hashed IP addresses, pages visited, approximate geographic region, browser type, device type, and referral source. This data is collected by WP Statistics, a self-hosted analytics tool running in our own WordPress database. No data is sent to any third party. IP addresses are anonymised and hashed before storage – we cannot identify you individually from this data.

We also collect basic server logs and security-related metadata for website operation and fraud prevention. This is standard infrastructure processing and is necessary to keep the site running securely.

We do not use cookies for advertising or behavioural profiling. A cookie notice is displayed on your first visit explaining what cookies are set and why. You can manage your preferences at any time.

We do not use automated decision-making that produces legal or significant effects on individuals.

Health, genetic, and other sensitive data

Some bioinformatics projects involve what GDPR calls special category data – health data, genetic data, biometric data, or similar. These categories receive stronger protection under Article 9 GDPR.

If your project involves any of these data types, a written Data Processing Agreement must be in place before data is transferred to us. You, as Data Controller, are responsible for identifying and documenting a valid legal basis under both Article 6 and Article 9 GDPR, and for meeting any additional requirements under Italian law – in particular the Garante Provvedimento No. 146/2019, which sets out specific national conditions for processing genetic data including requirements around retention, destruction of biological samples, and research documentation.

We apply enhanced access controls, confidentiality measures, and security protections to all sensitive data. We process it only under your documented instructions.

Our services are not directed at minors. If a project involves data relating to a person under 18, please notify us in advance so that the additional requirements under Article 8 GDPR and applicable Italian law can be addressed.

Why we process your data

We process personal data only for the following purposes:

• Responding to enquiries and scoping project requests
• Delivering bioinformatics and data analysis services
• Project communication and collaboration
• Invoicing, contract administration, and accounting
• Compliance with legal and tax obligations
• Maintaining the security and integrity of our systems

For client projects, data is processed solely for the purposes you define and document in the relevant agreement.

We do not use your data for our own research, publication, benchmarking, or marketing without a separate written agreement and a valid legal basis.

The legal basis for processing

Under GDPR, every processing activity requires a legal basis. Here is what we rely on:

• Contract performance (Article 6(1)(b)): processing necessary to deliver the service you have engaged us for, or to take steps before signing an agreement
• Legal obligation (Article 6(1)(c)): processing required by Italian law – primarily accounting, tax, and invoicing obligations
• Legitimate interests (Article 6(1)(f)): professional communication, record keeping, website security, and service administration – where our interests do not override yours
• Consent (Article 6(1)(a)): where we specifically ask for and rely on your consent – for example, for non-essential cookies

For special category data, the applicable Article 9 GDPR condition is your responsibility as Data Controller and must be documented in the project agreement before processing begins.

You can request further information about our legitimate interest assessments by emailing enquiries@omiks.it.

How long we keep your data

• Project data and deliverables: retained for the duration of the project plus 90 days after completion, to allow for download and handover. Longer retention requires written agreement.
• Special category data: deleted or securely anonymised promptly after project completion unless continued retention is required by law or your written instruction.
• Invoices, contracts, and accounting records: retained for up to 10 years as required under Article 2220 of the Italian Civil Code.
• Website analytics data: retained only as long as necessary for operational purposes.
• Server logs and security records: retained for a limited period for operational and security purposes only.

If you request deletion of your data, we will assess and fulfil that request where legally permissible.

How we protect your data

We apply appropriate technical and organisational measures to protect your data against unauthorised access, disclosure, alteration, loss, or destruction. In practice this means:

• Secure storage environments located within the EU where possible
• Access controls and confidentiality obligations
• Security monitoring and risk management procedures
• Secure deletion procedures at project completion
• Personal data breach detection and notification procedures in line with Articles 33 and 34 GDPR

Analysis is normally performed on systems under our control. External infrastructure is used only when required for a project and subject to appropriate contractual and data protection safeguards.

Who else may handle your data?

We use a small number of carefully selected service providers where necessary to operate our business. These are:

• Aruba S.p.A. (Italy, EU) – website hosting, email, and server infrastructure
• Forge12 Interactive GmbH (Germany, EU) – spam and bot protection via SilentShield, which processes visitor IP addresses for security purposes

We may also share personal data with professional advisors – accountants, legal counsel – and with public authorities where required by law.

You can request an up-to-date list of sub-processors at any time. We will notify you of any material changes where required by law or contract.

Does your data leave the EU?

We store and process client data within the European Economic Area as standard. All current sub-processors are EU-based.

If an international transfer becomes necessary for a specific project we will implement appropriate safeguards under Chapter V GDPR, such as Standard Contractual Clauses or an applicable adequacy decision, and will notify you in advance.

Details of any transfer safeguards in use are available on request from enquiries@omiks.it.

NDAs and Data Processing Agreements

We sign Non-Disclosure Agreements as standard before any unpublished data or confidential material is shared. If you have an institutional NDA template, send it through and we will review it.

Where a project involves personal data – including human genomic data – a Data Processing Agreement compliant with Article 28 GDPR must be in place before data transfer begins. This agreement will specify the categories of data involved, the purpose and duration of processing, security and confidentiality obligations, sub-processor arrangements, procedures for data subject rights, breach notification, and deletion or return of data at project completion.

If your institution has a standard DPA template, we are happy to work from that.

Your rights

Under GDPR you have the following rights in relation to your personal data:

• Access: you can ask what data we hold about you
• Rectification: you can ask us to correct inaccurate data
• Erasure: you can ask us to delete your data where there is no legal basis to retain it
• Restriction: you can ask us to limit how we use your data in certain circumstances
• Portability: you can ask for your data in a structured, machine-readable format
• Objection: you can object to processing based on legitimate interests
• Withdrawal of consent: where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing
• No automated decisions: you have the right not to be subject to decisions made solely by automated processing that have legal or significant effects on you

To exercise any of these rights, contact enquiries@omiks.it. We will respond within one month as required under Article 12 GDPR. In complex cases this may be extended by a further two months, with notice provided to you.

Where OMIKS acts solely as Data Processor on a project, requests relating to that project data may be referred to you as Data Controller.

You also have the right to lodge a complaint with the Italian supervisory authority:

Garante per la Protezione dei Dati Personali
Piazza Venezia 11, 00187 Roma, Italy
www.garanteprivacy.it

Questions and updates

If you have questions about this policy or how we handle your data, contact enquiries@omiks.it. We will respond promptly.

This policy may be updated from time to time to reflect legal, technical, or operational changes. The current version is always available on this page. Material changes will be communicated where required by law.