Privacy Policy

Introduction

Please read this privacy notice carefully as it contains important information on who we are and how and why we collect, store, use and share your personal information when you use our services.

It also explains your rights in relation to your personal information and how to contact us or supervisory authorities in the event you have a complaint.

We collect, use and are responsible for certain personal information about you. When we do so we are subject to data protection laws which apply to the United Kingdom and we are responsible as ‘controller’ of that personal information for the purposes of those laws.

Key Terms

The following table sets out some key terms that are used throughout this privacy notice:

Personal information we collect about you

If you contact us through our Website or order a Test through our Website, we will need to collect certain personal information about you in order to process your request and provide you with our testing services.

In particular, we collect:

• Identity data: your first name, last name and date of birth;
• Contact data: contact information, including your email address and telephone number;
• Health data; a demographic form (optional) can be filled out when ordering the test or completing sample collection. These data are stored anonymously on our database if informed consent is provided; 
• Financial data: this includes your payment card used to pay for the Test;
• Technical data: technical and usage information about how you use the Website;
• Marketing data: your preferences for receiving marketing communications from us.

The services available through our website are intended for persons 18 years of age and older. We will not knowingly collect, use or disclose personal information relating to children.

Processing your Health Data

Where we process information about your health, this constitutes “special category personal data”. We must ensure we are permitted to collect and process such special category data in accordance with data protection laws, which means:

• we must have your explicit consent;
• the processing must be necessary to protect your (or someone else’s) vital interests where you are physically or legally incapable of giving consent; or
• the processing is necessary to establish, exercise or defend legal claims.

The results of your Test will only be stored by us for a period of 7 days following completion of the Test. We will not retain your Test results for longer than this period, other than in the form of aggregated data (as explained below).

 

 

Aggregated data

We also collect, use and share anonymised, aggregated data which may be derived from your personal information for statistical and analytical purposes. Aggregated data is anonymised and therefore not considered personal information under data protection law as it cannot identify you as an individual.

Aggregated data helps to provide important information and insight into the COVID-19 pandemic, including information about the number of individuals booking and undertaking antibody tests.

We may share aggregated data with public health England or another authority in public health.

 

How your personal information is collected

Most of the above personal information is collected directly from you – either when you book a Test, contact us, request that communications are sent to you or provide us with feedback. Certain information such as your identify data and contact data is required for us to book, confirm and process your Test.

However, in addition to collecting information from you directly, we also collect information from:

• Cookies on our website – for more information on our use of cookies, please see our cookies policy.

 

How and why we use your personal information

Under data protection law, we can only use your personal information if we have a proper reason for doing so, including:

• to comply with our legal and regulatory obligations;
• for the performance of our contract with you or to take steps at your request before entering into a contract;
• for our legitimate interests or those of a third party; or
• where you have given consent.

A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests.

The table below explains what we use (process) your personal information for and our reasons for doing so. In some cases, we may use more than one legal basis for processing your personal information; this will depend on the specific purpose for which you are using your personal information.

Marketing communications

We may use your personal information to send you updates (by email or text message) about our testing services, including the launch of new tests and promotions related to such services if this was explicitly consented to at the time of booking. This consent can be withdrawn at any time.

 

Who we share your personal information with

We share your personal information with:

• companies within our group who need to know the information;
• our third party payment provider – Stripe, who will process your personal data in accordance with their privacy notice, which is available here;
• the clinic(s), medical facility or testing centre where your Test will be undertaken;
• third parties approved by you, such as social media sites which you choose to link to your profile.

We may disclose and exchange information with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations.

We may also need to share some personal information with other parties, such as potential buyers of some or all of our business or during a re-structuring. Usually, information will be anonymised but this may not always be possible. The recipient of the information will be bound by confidentiality obligations.

We will not share your personal information with any other third party.

 

How long your personal information will be kept

We will keep your Test results for a period of 10 years, or as long as necessary:

• to respond to any requests, questions, complaints or claims made by you or on your behalf;
• to show that we treated you fairly;
• to keep records required by law.

We will not retain your personal information for longer than necessary for the purposes set out in this privacy notice.

When it is no longer necessary to retain your personal information, we will delete or anonymise it.

 

Transferring your personal information out of the UK

To deliver services to you, it is sometimes necessary for us to share your personal data outside the UK, for example:

• where your and our service providers located outside the UK (specifically our website hosts, Squarespace, transfer data to the US and our payment processor, Stripe, transfers data globally); or
• if you are based outside the UK;

Under data protection law, we can only transfer your personal data to a country or international organisation outside the UK where:

• the UK government has decided the particular country or international organisation ensures an adequate level of protection of personal data (known as an ‘adequacy decision’); or
• there are appropriate safeguards in place, together with enforceable rights and effective legal remedies for data subjects; or
• a specific exception applies under data protection law.

We may transfer your personal data to certain countries, on the basis of an adequacy decision. These include: all European Union countries, plus Iceland, Liechtenstein and Norway (collectively known as the ‘EEA’); Gibraltar; and Andorra, Argentina, Canada, Faroe Islands, Guernsey, Israel, Isle of Man, Japan, Jersey, New Zealand, Switzerland and Uruguay.

The list of countries that benefit from adequacy decisions will change from time to time. We will always seek to rely on an adequacy decision, where one exists.

Other countries or international organisations we are likely to transfer personal data to do not have the benefit of an adequacy decision. This does not necessarily mean they provide poor protection for personal data, but we must look at alternative grounds for transferring the personal data, such as ensuring appropriate safeguards are in place, including using standard contractual clauses.

Where there is no adequacy decision, we may transfer your personal data to another country or international organisation if we are satisfied the transfer complies with data protection law, appropriate safeguards are in place, and enforceable rights and effective legal remedies are available for data subjects. The safeguards will usually include using legally-approved standard data protection contract clauses.

In the absence of an adequacy decision or appropriate safeguards, we may transfer personal data to a third country or international organisation where an exception applies under relevant data protection law, including:

• you have explicitly consented to the proposed transfer after having been informed of the possible risks;
• the transfer is necessary for the performance of a contract between us or to take pre-contract measures at your request;
• the transfer is necessary for a contract in your interests, between us and another person; or
• the transfer is necessary to establish, exercise or defend legal claims.

We may also transfer information for the purpose of our compelling legitimate interests, so long as those interests are not overridden by your interests, rights and freedoms. Specific conditions apply to such transfers and we will provide relevant information if and when we seek to transfer your personal data on this ground.

For further information on each of those rights, including the circumstances in which they apply, please contact us or see the Guidance from the UK Information Commissioner’s Office (ICO) on individuals’ rights under the General Data Protection Regulation.

If you would like to exercise any of those rights, please:

• contact us using the details below (see the ‘How to contact us’ section); and
• let us have enough information to identify you;
• let us have proof of your identity and address (a copy of your driving licence or passport and a recent utility or credit card bill); and
• let us know what right you want to exercise and the information to which your request relates.

 

Keeping your personal information secure

We have appropriate security measures to prevent personal information from being accidentally lost, or used or accessed unlawfully. We limit access to your personal information to those who have a genuine business need to access it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

If you want detailed information from Get Safe Online on how to protect your information and your computers and devices against fraud, identity theft, viruses and many other online problems, please visit www.getsafeonline.org. Get Safe Online is supported by HM Government and leading businesses.

 

How to complain

We hope that we can resolve any query or concern you may raise about our use of your information.

Complaints should be submitted in writing wherever possible.

Complaints can be sent to:

Data Protection Officer / Data Protection Lead Andrew Shaw Attomarker Ltd 1a Lamarr Building, 3 Babbage Way, Exeter Science Park, Exeter, EX5 2FN info@attomarker.com 01392 579479

The complaint should include:

• The complainant’s name and contact details
• A description of the concern
• Relevant dates and circumstances
• Any supporting evidence

Complaint Handling Procedure

Stage 1 – Acknowledgement

Upon receipt of a complaint, Attomarker Ltd will:

• Acknowledge receipt within five working days.
• Record the complaint in the Data Protection Complaints Register.
• Assign responsibility for investigating the matter.

Stage 2 – Investigation

The appointed investigator will:

• Review the complaint and relevant records.
• Interview relevant personnel where necessary.
• Assess compliance with applicable data protection legislation.
• Determine whether any corrective action is required.

All investigations will be conducted fairly, impartially, and confidentially.

Stage 3 – Response

A written response will normally be provided within one calendar month of receipt of the complaint.

The response will include:

• A summary of the investigation.
• Findings and conclusions.
• Any remedial actions taken or proposed.
• Information about further escalation options.

Where a complaint is particularly complex, the response period may be extended by up to a further two months. The complainant will be informed of the extension and the reasons for it.

Corrective Actions

Where a complaint is upheld, Attomarker Ltd will take appropriate action which may include:

• Correcting inaccurate personal data.
• Updating procedures or controls.
• Providing additional staff training.
• Improving security measures.
• Restricting or ceasing certain processing activities.
• Reporting incidents to the Information Commissioner’s Office where legally required.

If the complainant remains dissatisfied after receiving our response, they may request a further internal review by a senior manager or director not previously involved in the investigation.

The internal review will be completed within 30 days wherever reasonably practicable.

Right to complain to the ICO

Individuals have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if they believe their personal data has been processed unlawfully or their rights have not been respected.

Information Commissioner’s Office (ICO) Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF

Telephone: 0303 123 1113

Website: www.ico.org.uk

We encourage individuals to contact us first so that we have the opportunity to investigate and resolve concerns directly. All complaints and investigations will be documented and retained for a minimum of six years from closure of the complaint, unless a longer retention period is required by law.

Records will include:

• Details of the complaint
• Investigation notes
• Correspondence
• Findings and outcomes
• Corrective actions taken

The complaints handling policy will be reviewed annually or sooner where changes in legislation, regulatory guidance, or business operations require it..

 

Changes to this privacy notice

This privacy notice was published on 7th May 2021 and last updated 10^th August 2026.

 

How to contact us

Please contact us by email or telephone if you have any questions about this privacy notice or the information we hold about you.

 

Our contact details are shown below:

Email: info@attomarker.com

Address: Attomarker Limited, 1A Lamarr Building, 3 Babbage Way, Exeter Science Park, Exeter, EX5 2FN, Devon, UK.