Privacy Policy & Consumer Data Notice

1. Corporate Identity and Data Controller

The data controller responsible for your personal information is:

• Legal Entity Name: EV Enterprises Limited
• Trading Name / Platform: Biopharma Provenance
• Company Identifier: NZBN 9429046144102
• Jurisdiction of Incorporation: New Zealand (New Zealand Companies Office)
• Data Protection & Privacy Contact: privacy@biopharmaprovenance.com
• General Support Contact: support@biopharmaprovenance.com

2. Distinguishing Consumer Data from Scientific Research Data

Biopharma Provenance provides data-as-a-service (DaaS) products for computational biology, translational genomics, and biopharma due diligence. We draw a strict boundary between:

• Scientific & Regulatory Datasets (Zero PII/PHI): Our data shares and Snowflake listings aggregate public-domain scientific, structural, genomic, and pharmacovigilance records (Ensembl, gnomAD, RCSB PDB, UniProtKB, ChEMBL, ClinicalTrials.gov, and aggregate openFDA FAERS safety signals). These datasets contain zero Personally Identifiable Information (PII) and zero Protected Health Information (PHI).
• Consumer Personal Data: The personal information collected from individuals visiting our website, subscribing through enterprise cloud marketplaces, or reaching out for enterprise licensing and customer support, governed by the terms below.

3. Personal Data We Collect

We only collect personal information that is reasonably necessary to provide our services and operate our business:

• Voluntary Inquiries and Communications: When you contact us via email (support@biopharmaprovenance.com), schedule a technical consultation, or request customized data cuts, we collect your name, corporate email address, organization/firm, job title, and the contents of your message.
• Marketplace Account & Transaction Identifiers: When you subscribe to our data products via the Snowflake Marketplace, Snowflake Provider Studio, AWS Data Exchange, or Databricks Marketplace, we receive non-sensitive transaction confirmation metadata (such as your organization's Snowflake account locator, subscription tier, and procurement timestamp). We do not collect or store your raw payment card or banking details; all billing is processed directly by the respective marketplace operator.
• Technical & Log Data: When you access biopharmaprovenance.com, our hosting and CDN infrastructure (e.g. Cloudflare) automatically logs standard network requests, including IP address, browser type and version, referral source, page interaction timestamps, and device operating system.
• Cookies and Local Storage: We maintain a minimal cookie policy. We only utilize strictly necessary session and performance cookies required for site rendering, security DDoS mitigation, and state preservation. We do not use third-party invasive ad-tracking trackers or data-broker pixels.

4. How We Use Consumer Personal Data

We process your personal data for the following legitimate business purposes:

• To respond to your inquiries, schedule provider vetting calls, and provide enterprise technical support.
• To deliver, verify, and maintain our data shares, API endpoints, and Snowflake Native App listings.
• To fulfill contractual obligations and adhere to Service Level Agreements (SLAs).
• To monitor network security, prevent unauthorized access, mitigate DDoS threats, and maintain platform integrity.
• To comply with regulatory, tax, and legal requirements under New Zealand law and international trade guidelines.

5. Legal Bases for Processing (GDPR & International Standards)

Under the European Union General Data Protection Regulation (GDPR), UK GDPR, and similar international frameworks, we process your personal data under the following lawful bases:

• Contractual Performance: Processing necessary to fulfill our obligations under terms agreed upon with your organization.
• Legitimate Interests: Processing necessary to ensure infrastructure security, resolve technical customer inquiries, and manage commercial relationships.
• Legal Compliance: Processing required to adhere to statutory accounting, audit, and tax obligations.
• Consent: Where you have expressly provided consent for direct communications, which may be withdrawn at any time.

6. Data Sharing and Third-Party Disclosures

We do not sell, rent, or trade your personal data. We disclose personal data only to trusted service providers operating under strict confidentiality and security agreements:

• Hosting & Edge Infrastructure: Cloudflare, Inc. (providing content delivery, DDoS protection, and SSL encryption).
• Marketplace Platforms: Snowflake Inc. (processing marketplace subscriptions and entitlements).
• Communications: Secure enterprise email and calendaring providers for customer support correspondence.
• Legal & Regulatory Authorities: When strictly required by law, subpoena, or lawful governmental directive.

7. In-Container Snowflake Native App Execution

For customers deploying our data via the Snowflake Native Application Framework: all analytical queries, scoring models, and target validations execute natively within the consumer's own isolated Snowflake Virtual Warehouse. No proprietary consumer search queries, target gene identifiers, or proprietary pipeline data leave your Snowflake tenant or transmit back to EV Enterprises Limited.

8. Data Retention and Security

We employ industry-standard technical and organizational security controls to protect personal data against loss, misuse, and unauthorized access:

• All web communications and API calls require HTTPS with modern TLS 1.3 encryption.
• Access to support mailboxes and customer metadata is restricted to authorized personnel via multi-factor authentication (MFA).
• We retain personal contact data only for as long as necessary to maintain active commercial accounts and meet tax and legal retention requirements (typically up to 7 years for financial records).

9. Your Rights (GDPR, CCPA/CPRA, and New Zealand Privacy Act 2020)

Depending on your location, you hold statutory rights regarding your personal data:

• Right of Access & Portability: You may request a copy of the personal information we hold about you in a structured, machine-readable format.
• Right to Rectification: You may request correction of inaccurate or incomplete personal records.
• Right to Erasure ("Right to be Forgotten"): You may request that we delete your personal data, subject to legal compliance exceptions.
• Right to Restrict or Object: You may object to or request restriction of our processing of your personal data.
• Right to Non-Discrimination: We do not discriminate against individuals who exercise their statutory privacy rights.

To exercise any of these rights, contact us at privacy@biopharmaprovenance.com. We will respond to verified requests within thirty (30) calendar days.

10. Children's Privacy

Our services are strictly directed to life-sciences professionals, enterprises, and research institutions. We do not knowingly solicit or collect personal information from individuals under the age of 18.

11. Updates to this Policy

We may update this Privacy Policy from time to time to reflect operational, legal, or regulatory changes. The "Effective Date" at the top of this document indicates the date of latest revision. Continued use of our website or services following an update signifies acceptance of the revised terms.

12. Contact and Inquiries

If you have questions, concerns, or requests regarding this Privacy Notice or our data handling practices, please direct your correspondence to: