PRIVACY POLICY
Privacy Policy
Last updated: 13 May 2026
1. Who We Are
1.1. Cellvanta (a UK-registered company; company registration number to be added once available) is a boutique advisory capability for biotech, supporting development, execution and investment decisions in advanced therapies and adjacent programmes.
1.2. As part of our strategic collaboration and partnership activities, we are developing relationships with specialist collaborators and institutions both within and outside the UK, including in the GCC region. We have ambitions to support programmes and partnerships globally, and our international footprint is expected to grow over time.
1.3. Data Controller:
Cellvanta
United Kingdom
Email: hello@cellvanta.co.uk
Website: www.cellvanta.co.uk
1.4. We are committed to protecting your personal data and to being transparent about how we collect and use it. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. What Personal Data We Collect
2.1. Contact Form
2.1.1. When you submit our website contact form, we collect the following personal data:
a) First name and last name
b) Email address
c) Organisation name
d) Your role or category (Founder, Team, Investor, Institution, or Other)
e) The content of your message
f) Whether you have opted in to receive occasional Cellvanta perspectives by email
2.2. Website Usage Data
2.2.1. Our website is hosted by Squarespace. When you visit our website, Squarespace automatically collects certain technical data, which may include:
a) Information about your browser, network, and device
b) Web pages you visited prior to arriving at our website
c) Web pages you view while on our website
d) Your IP address
e) Clickstream data, including links clicked, pages visited, scrolling, searches, and timestamps
2.2.2. This data is collected by Squarespace to enable the website to function correctly and to protect and improve their platform and services. Please refer to Squarespace's Privacy Policy at www.squarespace.com/privacy for further information.
2.3. Cookies and Similar Technologies
2.3.1. Our website uses cookies and similar technologies - small files that download to your device when you visit a website. We use:
a) Necessary cookies: Required for the website to function. These are always active.
b) Analytics and performance cookies: Used to understand site traffic and activity. These are only placed if you accept analytics cookies in our cookie banner.
2.3.2. You can accept or decline analytics cookies via the cookie banner displayed on our website. You can change your preference at any time by clearing your cookies and reloading the site.
3. How We Use Your Personal Data and Our Lawful Basis
3.1. We process your personal data for the following purposes and on the following legal grounds under Article 6 of the UK GDPR:
3.2. Purpose: To respond to your enquiry or message submitted via our contact form. Lawful basis: Legitimate interests (Article 6(1)(f)) - it is in our and your mutual interest to respond to business enquiries.
3.3. Purpose: To arrange and conduct an initial exploratory call.
Lawful basis: Legitimate interests (Article 6(1)(f)) - to progress a potential business relationship.
3.4. Purpose: To assess whether there is a fit between your needs and our services.
Lawful basis: Legitimate interests (Article 6(1)(f)).
3.5. Purpose: To communicate with you about our services, engagements, or opportunities relevant to your enquiry.
Lawful basis: Legitimate interests (Article 6(1)(f)).
3.6. Purpose: To fulfil obligations under a scope of work or contract.
Lawful basis: Performance of a contract (Article 6(1)(b)) - where you have entered into a formal engagement with us.
3.7. Purpose: To operate and improve our website.
Lawful basis: Legitimate interests (Article 6(1)(f)) - to ensure our website functions correctly and securely.
3.8. Purpose: To send occasional Cellvanta perspectives by email (where you have opted in via our contact form).
Lawful basis: Consent (Article 6(1)(a)). You may withdraw consent and unsubscribe at any time using the link provided in every email we send.
3.9. Our legitimate interests: We have a legitimate interest in receiving, managing and responding to business enquiries from potential clients, investors, and partners, and in operating our website effectively. We have assessed that these interests do not override your rights and interests as an individual.
3.10. Contracted engagements: Where a formal engagement proceeds, the specific nature, scope, and requirements of the work - including any activities involving strategic collaboration, partnership advisory, or specialist introductions will be set out in a mutually agreed scope of work or contract. Where Cellvanta processes personal data on behalf of a client (acting as a data processor under UK GDPR), a Data Processing Agreement (DPA) will be put in place separately from this Privacy Policy. Wherever practical, client data is handled in anonymised form.
3.11.We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
4. Who We Share Your Data With
4.1. We do not sell your personal data. We may share your personal data with the following categories of third parties, only to the extent necessary:
4.2. Squarespace, Inc. Our website hosting provider. Squarespace processes your data to provide hosting, analytics, and related website services on our behalf. Squarespace is based in the United States; see Section 6 regarding international transfers. Privacy policy: www.squarespace.com/privacy.
4.3. Microsoft Corporation. We use Microsoft 365 services, including Outlook, SharePoint and related productivity tools, to manage business communications, documents and operational workflows. Microsoft may process personal data on our behalf in accordance with applicable data protection laws. Privacy statement: www.microsoft.com/en-gb/privacy.
4.4. Google LLC. We use Google Analytics 4 to understand how visitors use our website. Google may process aggregated and anonymised usage data on our behalf. Analytics cookies are only loaded if you accept them via our cookie banner. Privacy policy: https://policies.google.com/privacy?hl=en-GB.
4.5. LinkedIn (a Microsoft company). We use LinkedIn for our company page presence and the LinkedIn Insight Tag to understand visitor activity from LinkedIn and to support audience-based retargeting. LinkedIn may process personal data on our behalf for these purposes. The LinkedIn Insight Tag is only loaded if you accept analytics cookies via our cookie banner. Privacy policy: www.linkedin.com/legal/privacy-policy.
4.6. Professional advisers. Such as legal or compliance advisers, where necessary and bound by confidentiality obligations.
4.7. Trusted collaborators and specialist partners. A core part of our work involves strategic collaboration and partnership advisory activities - connecting founders, capital and institutions with relevant specialist expertise. Where directly relevant to a specific engagement, and where it forms part of the scope of work or contract agreed with you, we may share limited personal data with trusted collaborators or specialist partners. We will inform you before doing so, and will only share what is necessary for the purpose of your engagement. This may include partners based inside or outside the UK, as further described in Section 6.
4.8. We require all third parties to maintain appropriate security measures and to process your personal data only in accordance with our instructions and applicable data protection law.
5. How Long We Retain Your Data
5.1. We will retain your personal data only for as long as is necessary for the purposes described in this policy. Our general retention periods are as follows:
5.2. Contact form enquiries: We retain correspondence and contact data for up to 3 years from the date of last contact, to manage our business relationship and any follow-up engagement. After this period, data is securely deleted or anonymised.
5.3. Contracted engagements: Where a formal scope of work or contract is in place, we will retain relevant personal data for the duration of the engagement and for a reasonable period thereafter, in line with our legal and contractual obligations.
5.4. Website usage and analytics data: Retained in line with Squarespace's and Google Analytics' own retention policies. Please refer to their privacy policies for details.
5.5. Marketing communications: We retain marketing consent and contact details until you withdraw your consent or unsubscribe, whichever is earlier.
5.6. Where we are required by law to retain data for a longer period, we will do so in compliance with that obligation.
6. International Transfers
6.1. Squarespace (United States). Our website is hosted by Squarespace, Inc., which is based in the United States. This means that some of your personal data may be transferred to and processed in the United States. Squarespace ensures that any such transfer is carried out in accordance with UK GDPR requirements, using appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses. Further details are available in Squarespace's Privacy Policy at www.squarespace.com/privacy.
6.2. Microsoft (United States). Microsoft 365 services are operated by Microsoft Corporation, based in the United States. Microsoft ensures appropriate safeguards are in place for any transfers of personal data outside the UK. Further details are available in Microsoft's Privacy Statement at www.microsoft.com/en-gb/privacy.
6.3. Google (United States). Google Analytics is operated by Google LLC, based in the United States. Google ensures appropriate safeguards are in place for any transfers of personal data outside the UK.
6.4. LinkedIn (United States). LinkedIn Corporation (a Microsoft subsidiary) is based in the United States. LinkedIn ensures appropriate safeguards are in place for any transfers of personal data outside the UK.
6.5. Developing international partnerships. As part of our strategic collaboration and partnership advisory activities, we are developing relationships with specialist collaborators and institutions in a number of international markets, including the GCC region. Where relevant to a specific engagement, and where appropriate safeguards are in place, personal data may be shared with trusted collaborators or partners located outside the UK. Where this arises in the context of a contracted engagement, it will be identified and agreed within the relevant scope of work or contract.
6.6. Where any international transfer of personal data occurs, we will ensure that appropriate safeguards are in place as required by UK GDPR, which may include the use of International Data Transfer Agreements (IDTAs), Standard Contractual Clauses, or other legally recognised transfer mechanisms.
6.7. If you would like further information about the safeguards we apply to international transfers, please contact us at hello@cellvanta.co.uk.
7. Your Rights Under UK GDPR
7.1. Under UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:
7.2. Right of access: You have the right to request a copy of the personal data we hold about you (a Subject Access Request).
7.3. Right to rectification: You have the right to request that we correct inaccurate or incomplete personal data.
7.4. Right to erasure: You have the right to request that we delete your personal data, in certain circumstances (the "right to be forgotten").
7.5. Right to restriction of processing: You have the right to request that we restrict the processing of your personal data in certain circumstances.
7.6. Right to data portability: Where processing is based on your consent or on a contract, you have the right to receive your data in a structured, commonly used, and machine-readable format.
7.7. Right to object: You have the right to object to our processing of your personal data where we rely on legitimate interests as our lawful basis. We must stop processing unless we can demonstrate compelling legitimate grounds that override your interests, or unless processing is necessary for legal claims. You have an absolute right to object to your data being used for direct marketing.
7.8. Right to withdraw consent: Where we rely on your consent to process your personal data (including for marketing communications), you have the right to withdraw that consent at any time, including via the unsubscribe link in every marketing email. Withdrawal of consent will not affect the lawfulness of processing carried out prior to withdrawal.
7.9. Right not to be subject to automated decision-making: We do not carry out solely automated decision-making that produces legal or similarly significant effects on you.
7.10. To exercise any of these rights, please contact us at hello@cellvanta.co.uk.
7.11. We will respond to your request within one calendar month. We will not charge a fee for responding to your request unless it is manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable administrative fee.
7.12. We may need to verify your identity before we can respond to your request.
8. How We Keep Your Data Secure
8.1. We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction, alteration, or disclosure. These measures include:
8.2. Our website uses secure HTTPS encryption, provided automatically by Squarespace, ensuring that all data transmitted between your browser and our website is protected.
8.3. Secure cloud-based systems with encryption to store and manage personal data and business information.
8.4. Multi-factor authentication (MFA) for access to business systems and communications platforms.
8.5. Restricted access controls, limiting who within Cellvanta can access personal data to those who need it to carry out their role.
8.6. Regular review of our data handling practices.
8.7. While we take all reasonable steps to protect your data, no transmission over the internet is completely secure. If you have concerns about the security of your information, please contact us.
9. Data You Are Required to Provide
You are not under a statutory or contractual obligation to provide us with personal data via our contact form. However, if you choose not to provide certain information (such as your name, email address, or the nature of your enquiry), we may be unable to respond to your enquiry or to consider whether our services are a fit for your needs. Where a formal scope of work or contract is agreed, certain personal data may be required to fulfil our obligations under that agreement.
10. Third-Party Links
Our website may contain links to third-party websites, including our LinkedIn company page. This Privacy Policy applies only to our website. We are not responsible for the privacy practices of third-party websites and encourage you to read their privacy policies before providing any personal data to them.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the services we provide. When we make changes, we will update the "last updated" date at the top of this policy. We encourage you to review this policy periodically. Where changes are material, we will take appropriate steps to bring them to your attention.
12. How to Complain
12.1. If you have any concerns about how we handle your personal data, or if you believe we have not complied with our obligations under UK GDPR, please contact us in the first instance at hello@cellvanta.co.uk and we will do our best to resolve your concern.
12.2. You also have the right to lodge a complaint with the UK's data protection supervisory authority:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: www.ico.org.uk
Helpline: 0303 123 1113
12.3. You may contact the ICO directly at any time; you are not required to contact us first.
13. Contact Us
If you have any questions about this Privacy Policy or about how we handle your personal data, please contact us:
Cellvanta
Email: hello@cellvanta.co.uk
Website: www.cellvanta.co.uk
LinkedIn: Cellvanta
14. ICO Registration
Cellvanta is an early-stage business and is in the process of registering with the Information Commissioner's Office (ICO) for the data protection fee, as required for UK businesses processing personal data. We are committed to complying with all applicable UK data protection law during and after this registration. Once our ICO registration is confirmed, we will update this Privacy Policy to include the registration reference. If you have questions about this in the meantime, please contact us at hello@cellvanta.co.uk.