Restricted functions
Institutional details and compliance attestations are required before an order request can be submitted.
Privacy notice · Version 2026-07
Researcher data, handled with restraint.
This notice explains the data practices implemented in the website. The operating legal entity, registered address, final service-provider list, retention schedule, international-transfer terms, cookie settings, and jurisdiction-specific statutory notices must be completed before live trading.
Data minimisation
Free-text fields instruct users not to submit patient, research-subject, government-ID, or unnecessary sensitive data.
No payment data
The website does not collect payment-card or bank information. Any later payment link is external and conditional on review.
Manual oversight
Institutional information may be reviewed for eligibility, destination, misuse prevention, and request administration.
Data map
Information collected and why
| Category | Examples | Purpose |
|---|---|---|
| Access attestation | Acceptance version and timestamp stored locally in the browser | Restrict catalogue access until the current research-use restrictions are accepted |
| Order request | Name, professional email, institution, jurisdiction, research purpose, requested products, quantities, indicative prices, notes | Review and administer non-payment research supply requests |
| Request basket | Cart contents maintained by the store platform; product, variant, price, and availability data | Maintain the request basket and retrieve authoritative catalogue data |
| Technical data | Device, browser, page, error, security, and analytics information where enabled | Operate, secure, debug, and understand website performance |
| Correspondence | Messages and metadata sent to the contact address or through authorised channels | Respond to institutional, order, document, and compliance enquiries |
Who controls the data
Illume Research operates the website. The complete legal entity name and registered address must be added before live trading. Privacy enquiries may be sent to illumeresearch@proton.me.
Legal bases and jurisdiction
The lawful basis for each processing activity depends on the operating and user jurisdictions. Potential bases may include steps requested before a contract, legitimate interests in secure and responsible supply, legal obligations, and consent where required. Qualified privacy counsel must confirm the final position.
Service providers and disclosures
Data may be processed by the hosting platform, storefront services, analytics, security, and communications services used to operate the site. Information may also be disclosed where lawfully required or necessary to protect safety, rights, systems, or compliance. The final provider list and contractual safeguards must be documented.
International processing
Service providers or users may be located in different countries. Applicable transfer mechanisms, notices, and safeguards must be confirmed after the operating entity, jurisdictions, and vendors are finalised.
Retention
Request, security, and correspondence records should be retained only as long as needed for review, administration, misuse prevention, dispute handling, and legal obligations. A documented retention schedule and deletion process must be adopted before launch.
Security
Reasonable technical and organisational controls are used, including managed infrastructure. No online system is completely secure. Users should avoid sending sensitive or unnecessary information and should report suspected data issues promptly.
Your choices and rights
Depending on jurisdiction, users may have rights to access, correct, delete, restrict, object, withdraw consent, or obtain a copy of certain data. Requests can be sent to illumeresearch@proton.me and may require identity and authority verification. Rights and exceptions depend on applicable law.
Cookies and local storage
The site uses local storage for the versioned access attestation and the platform cart. Analytics and platform services may use cookies or similar technologies. A jurisdiction-appropriate consent mechanism and detailed cookie inventory must be implemented where required.
No patient or subject data
Do not enter patient information, clinical subject data, protected health information, government identity documents, genetic data, or unnecessary sensitive personal data in request notes or ordinary email.
Age restriction and updates
The site is restricted to users aged at least 18 who also meet any higher applicable legal-age requirement. Material changes to this notice may require a renewed access attestation. The version date will be updated when the notice changes.