# Privacy notice > What personal data Assemblon holds, why we hold it, who we share it with, and how to ask us to change or delete it. Canonical URL: Last updated: 2026-09-29 # Privacy notice *Last updated: 27 September 2026.* Assemblon Limited ("we", "us") makes synthetic oligonucleotides to order. This notice explains what personal data we hold, why, and what you can do about it. It covers this website, the customer portal, and the ordering process. If anything here is unclear, or you want to exercise any of the rights below, email **privacy@assemblon.co.uk** and a person will answer. ## Who is responsible **Assemblon Limited** is the data controller for the information described here. We are registered in England and Wales, company number **16597943**. Our registered office is Office F13, Atlas Building (R27), Rutherford Appleton Laboratory, Harwell Campus, Didcot, Oxfordshire, OX11 0QX. Write to **privacy@assemblon.co.uk** about anything on this page. We are registered with the Information Commissioner's Office as a data controller, registration reference **ZC025198**. ## What we collect, and why **When you enquire or order.** Your name, work email address, telephone number, organisation, and the delivery and invoice addresses needed to send you goods and bill for them. We need this to perform our contract with you. We cannot make and ship an oligonucleotide without knowing who wants it and where it goes. **Getting in touch creates an account.** So that your quotation, order and invoices have somewhere to live, we create a customer record against your email address the first time you enquire. We do the same the first time you write to us, whether that is by email, on WhatsApp or through the chat widget. You are not signed up to anything and nothing is sent to you because of it. **You never set a password and we never send you one:** when you want to see what is there, you sign in with a one-time code we email you, or by following the link in our reply. **The sequences you order.** These are commercially sensitive and we treat them as such. We do not sell them, we do not share them for anybody else's purposes, and we do not publish them. Inside the company they are visible to the staff producing your order. They leave our own servers in three places, all of them listed in the table further down. - The quotations and invoices we email you carry your own order, and go out through our email provider like any other message we send you. - The AI assistant our staff use to draft replies can look your order up while it does so, so an order's details can reach the AI provider, sequences included. - If you report a problem from the portal, what we capture is a picture of the screen you were on, which may well be your own order. That is the whole of it. Each of those providers handles it only for the purpose listed against them. **When you pay.** Payments are handled by our payment providers. We never see or store your full card number. **When you contact support.** The content of your messages, so we can answer them and keep a record of what was agreed. Incoming messages are also passed through an AI provider to draft a suggested reply, and that draft is written with your account in front of it. See "AI and your messages" below. **When you verify your email at checkout.** A short-lived code, and a technical fingerprint of your browser. See "Browser fingerprinting" below. **When you report a problem.** The "Report a bug" button in the portal is there so you do not have to describe a fault in words. When you use it we capture, along with what you write: a snapshot of the page as it was on screen, meaning whatever you were looking at, which may be your order, your quotation, your invoice or your sequences; any screenshots you attach; the recent output of your browser's error console; the address of the page; and which browser and window size you were using. We do this to reproduce the fault, and for no other reason. The report is held in our own admin system alongside our other records. It can also be passed to an automated service that tries to reproduce and fix the problem; ask us and we will tell you whether one is connected and who runs it. If you would rather send us a plain description instead, email **privacy@assemblon.co.uk** or reply to any message from us. Nothing is captured that way. **Technical logs.** Standard server logs including IP address, used to keep the service running and to investigate abuse. This site is served through Cloudflare's network, so they see the IP address and the address of each page you request. ## Lawful bases We rely on **performance of a contract** for everything needed to quote, make, ship and invoice your order; **legitimate interests** for security, fraud prevention, answering support messages, keeping our records straight and counting visits to this website; and **legal obligation** for the accounting and customs records we are required to keep. Where we rely on legitimate interests, we have considered your interests too. You can object at any time using the contact address above. ## Browser fingerprinting When you ask us for a verification code at checkout, and again when you enter one, we calculate a fingerprint of your browser and store it as a salted, one-way hash. Those two requests are the only ones it travels with. It is not sent while you are filling the form in, and not while you are browsing the site. We do this for one reason: to detect somebody working through verification codes automatically. It is used only to rate-limit those requests. It is never used to build a profile of you, to track you across websites, or for advertising. The hash is salted with a secret only we hold, so it cannot be matched against any other system, and it is deleted when the verification code it belongs to expires. ## Website statistics and product analytics We count visits to this website, and we do it without storing anything on your device. For each page you open we record the page, the page you came from, roughly how long you stayed, your browser type and screen size, and the country your connection is in. We use the network address your browser connects from to find that country and the organisation whose network it is, such as a university, and remove the last part of the address before anything is kept. It is not linked to your name, your email or your account, and there is no advertising network here, no tracking across websites and no recording of what you do on a page. We rely on **legitimate interests**: knowing which pages are read and how people find us is how we decide what to improve. If your browser sends Do Not Track or Global Privacy Control, nothing is counted, and the **Website statistics** switch at the foot of every page turns it off for your browser. You can also object by email. Customers are not recorded in the portal. We run product analytics there only for our own staff working in the admin system, so it observes how we use our software, not how you use it. One consequence of that. Those recordings are of staff screens, and staff screens have your data on them. We mask it: your name, contact details, addresses, prices and sequences are recorded as blanks, not as text. Masking works from a list of what we know to hide, so a stray detail can still appear, and recordings made before we added it in September 2026 are not masked. It is our own system, on our own servers, and only our own people can watch it back; but it is a place your data can end up, and you should know rather than be surprised. ## AI and your messages When you write to us by email, on WhatsApp or through the chat widget, your message is sent to an AI provider, which drafts a possible reply. The provider is Anthropic in the ordinary case; some models we can select instead are run by OpenAI or Google. Everything goes through OpenRouter, which routes the request to whichever of them is in use. The draft is written with your account open in front of it. To answer "where is my order?" the assistant looks the order up, so what reaches the provider is not only your message: it can include your name, your addresses, your quotations, orders, invoices and shipments, and the sequences on them. **The draft is never sent to you automatically.** It lands as a private note inside our own support system, where a member of staff reads it, edits it, or throws it away and writes something better. A person decides what you actually receive. Nothing about you is decided by a machine. Pricing, credit, and whether we accept an order are all human decisions, so you are not subject to automated decision-making of the kind data protection law gives you a specific right to challenge. If you would rather your messages were not processed this way, say so. You can object to anything we base on legitimate interests. ## Cookies and browser storage Browsing this website stores your basket, your theme, where you left a helper panel and any sequences you add to an order from our tools. Signing in adds a cookie that keeps you signed in. The portal remembers more again: which sidebar section you opened, how wide you dragged a column, and where you had got to in a help guide. All of it is the interface remembering how you left it. There are **no advertising or tracking cookies** on the website or in the portal, and our website statistics store nothing on your device at all, which is why you have not been asked to dismiss a cookie banner. The [cookies and browser storage page](/cookies) sets out what is stored on each part of the site, what it is for, and what breaks if you clear it. ## Who we share data with We do not sell your data, and we do not share it for advertising. We use the following providers, each only for the purpose listed: | Provider | What they receive | Why | | --- | --- | --- | | Stripe, Revolut | Name, email, payment details | Taking payment | | Resend | Email address, message content, and the quotation or invoice attached to it | Sending quotes, invoices, verification codes and updates | | Microsoft | The content of email you send to or receive from us | It hosts the mailbox our support desk is connected to | | Cloudflare | IP address, requested page | Serving and protecting this website | | FedEx, DHL, Royal Mail (Pro Shipping) | Name, delivery address, telephone, email address | Delivering your order and clearing customs | | FedEx | An address you or we typed in | Checking and tidying an address before we use it, including addresses we never end up shipping to | | Companies House | An organisation name or number you type into one of our forms | Filling in your registered address for you | | OpenRouter, and Anthropic, OpenAI or Google behind it | Your support messages, and what your account holds: name, addresses, quotations, orders, invoices, shipments and the sequences on them | Drafting a reply for a member of staff to review | | LlamaCloud | Supplier invoice documents | Reading the invoices our own suppliers send us | Two notes on that table. LlamaCloud is listed for completeness: it processes documents our suppliers send **us**, not anything you send us. And the Companies House lookup runs on our public forms before you have signed in to anything. If you trade under your own name rather than a company's, what is sent is your name. Our support desk, file storage, website statistics, product analytics and database all run on our own servers rather than a third party's, so your conversations, files and records are not passed to anybody in order to hold them. The one exception is email: our support desk collects it from a mailbox hosted by Microsoft, which is why they are in the table. ## Where your data goes Some of the providers above are United States companies: Stripe, Cloudflare, Resend, Microsoft, OpenRouter, Anthropic, OpenAI, Google, LlamaCloud and FedEx. Data we send them may therefore be processed outside the UK. For the transfers we make in the ordinary course of business, we rely on the safeguards UK data protection law provides: an International Data Transfer Agreement, or the UK Addendum to the European Commission's standard contractual clauses, or the UK government's finding that a particular country protects data adequately. Which of these applies depends on the provider. Ask us and we will tell you what covers a specific one. We will not claim more than that, because there is one place it does not yet hold. Our staff have an internal AI assistant, and one of the services it can be pointed at is a subscription we hold no processing agreement with. Anything a customer wrote is blocked from reaching it, and that block is in the software rather than in a policy. But a member of staff working there can still look a record up while they are in it. We know about it, it is recorded in our own register of what we do with personal data, and it is under review. If you would rather your data were not processed that way at all, say so and we will make sure it is not. ## How long we keep it Order, invoice and customs records are kept for **at least seven years**, because UK tax and customs law requires it. That is a floor, not a promise to delete on the day it passes. We would rather tell you that than quote a deletion date nothing in our systems enforces. Ask us after that and we will delete what we are no longer required to hold. Verification codes, sign-in links and the other short-lived tokens the site issues are deleted when they expire; a job sweeps the expired ones out every hour. Enquiries that do not become orders, support conversations and server logs are kept while they are useful and reviewed periodically. That is the honest description; a fixed number nothing enforces would not be. If you want your data removed sooner, ask: we will do it wherever we are not legally required to keep it. ## Your rights You can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or send it to someone else. You can object to processing we base on legitimate interests, and withdraw consent where we relied on it. If you have an account, the portal already shows you your own orders, quotations, invoices and credit balance. That is often the fastest way to see what we hold. Email **privacy@assemblon.co.uk** and we will respond within one month. If you are unhappy with our answer you can complain to the Information Commissioner's Office at [ico.org.uk](https://ico.org.uk/make-a-complaint/), though we would rather you gave us the chance to put it right first. ## Changes If we change how we use personal data we will update this page and change the date at the top. --- Website and LIMS by Alex Soldatkin alex.soldatkin@gmail.com