Biolux Therapeutics

Data controller

The data controller is the publisher of this site. Its full details appear in the legal notice.

Company name: Quovis Sàrl
Email: contact@bioluxtherapeutics.com
Data protection officer: None has been appointed.

Data we collect

The site collects personal data in four places, when you fill in a form or sign in. Its hosting also keeps technical logs.

Access requests to the investor, dealer and user spaces

Data: Email address, full name, company and message (optional), space requested, date and outcome of the request, fingerprint of the IP address. If access is granted: email address, space opened, date granted and, where one is set, expiry date.
Purpose: Reviewing your request, which the team is notified of by email; opening the requested space if it is accepted, and letting you know by email; limiting repeated requests.
Legal basis: Steps taken at your request before entering into a contract (GDPR article 6(1)(b)).
Retention: Request refused or not followed up: 3 years after the request. Access granted: for as long as it is open, then 3 years after it closes.

Signing in to a space

Data: Email address, dates the account was created and last signed in; for each open session, IP address and browser used.
Purpose: Signing you in with a link sent to your address, keeping your session open, and restricting each space’s documents to the people who have access to it.
Legal basis: Performance of the service you asked for: access to your space (GDPR article 6(1)(b)).
Retention: Account: for as long as an access is open, then deleted 30 days after it closes. Sessions (IP address, browser): 6 months after the last activity.

LUXe Infinite waiting list

Data: Name, email address, company and country or region (optional), motivation, position on the list, date of sign-up, fingerprint of the IP address.
Purpose: Keeping the LUXe Infinite waiting list and writing to you, in order of sign-up, when access opens for you; the team is notified of each sign-up by email.
Legal basis: Your consent (GDPR article 6(1)(a)), which you may withdraw at any time by asking to be removed from the list.
Retention: Until the product becomes available or until you ask to be removed, and at most 3 years after sign-up.

Biolux Custom Science enquiries

Data: Name, company (optional), email address, subject of the message, date sent, fingerprint of the IP address.
Purpose: Replying to your message and preparing a first conversation about Biolux Custom Science; each message is forwarded to the team by email.
Legal basis: Our legitimate interest in replying to the messages sent to us (GDPR article 6(1)(f)).
Retention: 3 years after the message is sent.

Hosting technical logs

Data: IP address and the approximate location derived from it, browser and operating system, page requested and its parameters, date and time, response code; in case of an error, the site’s technical message, which may include information entered in a form.
Purpose: Running the site, finding its errors and protecting it against abuse.
Legal basis: Legitimate interest: keeping the site secure and running properly (GDPR article 6(1)(f)).
Retention: Up to 1 day in Vercel’s logging tool; Vercel may keep part of them longer for its own obligations, under its privacy policy.

We collect no health data on this site. Please do not send us medical information through the forms.

A form never stores your IP address as such. It keeps only a fingerprint of it — a SHA-256 digest computed with a secret value — used for one thing: limiting how many requests can be sent from the same connection.

Recipients

What you send through a form is read by the Biolux team, which receives a copy by email. The data passes through the providers below, which process it on our behalf.

Vercel

Role: Hosting of the site and its forms
Data location: European Union: forms are processed in Frankfurt, Germany (Vercel’s fra1 region). Vercel is a US company whose primary processing facilities are in the United States.

Supabase

Role: Database, sign-in to the spaces and sign-in links
Data location: European Union: Frankfurt, Germany (AWS eu-central-1 region).

Resend

Role: Sending emails (notifications, access confirmations)
Data location: United States, where Resend’s primary processing operations take place.

OVHcloud

Role: The team’s mailbox, which receives the notifications
Data location: France.

Transfers outside the European Union

Resend, which sends the emails, processes data in the United States. Vercel, a US company, processes the forms in Frankfurt; its agreements nonetheless allow data to be processed in the United States, where its primary processing facilities are. Both state that they comply with the EU-U.S. Data Privacy Framework, which the European Commission found adequate on 10 July 2023, and their data processing agreements include the European Commission’s standard contractual clauses. Supabase keeps the database in Frankfurt; where it processes data outside the European Union, its agreements provide for the same standard contractual clauses. OVHcloud hosts the team’s mailbox in France.

Your rights

Under the conditions set by the GDPR (articles 15 to 22), you can access the data that concerns you, have it corrected or erased, restrict or object to its processing, and receive it in a reusable format.

You can also set instructions for what happens to your data after your death (article 85 of the French Data Protection Act).

To exercise these rights, write to contact@bioluxtherapeutics.com.

You can also lodge a complaint with the competent supervisory authority: the CNIL in France (cnil.fr), the FDPIC in Switzerland (edoeb.admin.ch).

What joining the waiting list involves — and what it does not — is set out on the Waiting list terms page.

The site’s cookies are described on the Cookies page.