Nonte Privacy Notice
Version 1.1, effective 30 October 2026
1. Who we are
Nonte Limited (“Nonte”, “we”, “us”) is a company incorporated in England and Wales with registered number 16363641, whose registered office is at Innovation Centre, Gallows Hill, Warwick CV34 6UW, United Kingdom. Nonte provides a research data management and provenance platform (the “Platform”) to universities, hospitals, research institutes and life science organisations.
You can contact us about this notice or your personal information at privacy@nonte.io or by post at the address above.
2. What this notice covers
We handle personal information in two different capacities, and this notice explains each.
2.1 Data we process for our customers. Organisations that use the Platform (our “Customers”) enter research and study data into it, which may include information about research participants and the people involved in a study. For that data, the Customer decides what is collected and why, and we process it only on the Customer’s instructions under our agreement with them. In data protection terms we act as the Customer’s processor (and, where applicable, as its service provider or business associate). If you are a research participant, or your information is held in a study, the Customer’s own privacy notice applies, and you should contact the Customer to exercise your rights. We will assist the Customer in responding to you. We never sell this data, use it for our own purposes, or use it to train or improve artificial intelligence or machine learning models.
2.2 Data we are responsible for. We decide how and why we use a limited set of information about the people who use the Platform and who contact us. For this information we act as the controller, and the rest of this notice describes how we handle it.
3. Information we collect and why
| Information | Why we use it | Legal basis (UK/EU GDPR) |
|---|---|---|
| Account information: name, work email address, username, Organisation, role and permissions, account status | To create and manage your account, authenticate you, and let your Organisation administer access | Performance of our contract with your Organisation; our legitimate interest in providing a secure service |
| Sign-in and security information: sign-in times, sign-in success or failure, IP address, browser and device type, multi-factor authentication events, session identifiers | To keep the Platform and our Customers’ data secure, detect and investigate misuse, and meet our security commitments | Legitimate interests in securing the Platform; legal obligations |
| Diagnostic and performance information: error reports, page load timings, the screen or function in use when an error occurred, request metadata | To find and fix faults and keep the Platform performing well | Legitimate interests in operating a reliable service |
| Acceptance records: the date and time you accepted the Terms of Use, which identifies the version you accepted | To show that the applicable terms were presented and accepted | Legitimate interests; contract |
| Support and correspondence: your name, contact details and the content of your messages | To respond to support requests and questions | Legitimate interests; contract |
| Website visitors and business contacts: information you send through the contact form on nonte.io, such as your name, email address and message; your cookie choices; and information about your browser used to protect the form from spam | To respond to enquiries, manage business relationships, remember your cookie choices and protect our website from abuse | Legitimate interests; consent where required for cookies |
We do not use the information in this table for advertising, and we do not sell it.
4. Cookies and similar technologies
The Platform uses only the cookies and browser storage it needs to work. Our sign-in service sets session cookies to sign you in and keep your session secure, and the Platform stores your preferences in your browser, such as the study you last used and the table columns you have chosen. We do not use analytics, advertising or cross-site tracking cookies in the Platform. Our website, nonte.io, uses a cookie to remember your cookie choices. Its contact form uses Google reCAPTCHA, which sets cookies and sends information about your browser to Google to check that the form is being used by a person. We do not use analytics or advertising cookies on our website.
5. Who we share information with
5.1 Service providers. We use carefully selected service providers to host and operate the Platform, including cloud hosting, error monitoring and operational logging. They act on our instructions under written contracts that require them to protect the information. Our current list of service providers, with what each does and where it processes data, is published with this notice as the Nonte Sub-processors list.
5.2 Your Organisation. Your Organisation can see your account information and the history of the changes you make in the Platform (the audit trail). We share your sign-in activity with your Organisation when it asks.
5.3 Legal requirements. We may disclose information where the law requires it, or to establish, exercise or defend legal claims. Where a request concerns a Customer’s data, we will tell the Customer where the law allows and disclose only the minimum required.
5.4 Business changes. If Nonte is involved in a merger, acquisition or sale of assets, information may transfer to the new owner, who will remain bound by this notice.
6. Where information is processed
6.1 Each Customer’s Platform data is held in its own database, hosted in the country of that Customer’s deployment: the United States, Canada or the United Kingdom.
6.2 Sign-in, security and diagnostic information about your use of the Platform is kept in the same country as your Organisation’s Platform data, with one exception: for deployments in the United Kingdom and Canada, error reports are processed in the European Union.
6.3 Where personal information is transferred to a country that does not provide an adequate level of protection under the law that applies to it, we use recognised safeguards such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.
7. How long we keep information
| Information | Retention |
|---|---|
| Account information | For as long as your account is active, then deleted within 90 days of your Organisation’s agreement ending or your account being removed, unless your Organisation’s agreement requires otherwise |
| Sign-in and security records | 2 years. Web server, firewall and content delivery logs, which include IP addresses: 1 year. |
| Diagnostic and performance information | 14 days in our logging service, up to 90 days in our error monitoring service, and up to 1 year in application logs |
| Acceptance records | For as long as your account exists. Acceptance events are also kept with sign-in and security records. |
| Support correspondence | 3 years after the request is closed |
Backups containing this information are overwritten on a rolling basis within 35 days. Data we process for Customers (section 2.1) is kept and deleted in accordance with our agreement with each Customer.
8. How we protect information
We encrypt data in transit and at rest, keep each Customer’s database separate, restrict our staff’s access to what their role needs, require multi-factor authentication for administrative access, keep audit logs of administrative actions, and maintain an information security management system aligned with ISO/IEC 27001.
9. Your rights
9.1 Depending on where you live, you may have the right to access the personal information we hold about you, to have it corrected or deleted, to restrict or object to how we use it, and to receive a copy of it in a portable format. To exercise these rights, contact privacy@nonte.io. We will respond within one month, or sooner where the law requires.
9.2 For information held in a study or other Customer data (section 2.1), please contact your Organisation, which controls that data. If you contact us, we will pass your request to the relevant Customer.
9.3 If you are in the UK, you can complain to the Information Commissioner’s Office (ico.org.uk). If you are in the European Union, you can complain to the data protection authority where you live or work. We would appreciate the chance to address your concern first.
10. Children
The Platform is intended for use by professionals and students working in research. It is not intended for children, and we do not knowingly collect information from children as Platform users.
11. Changes to this notice
We will update this notice when our practices change. The current version, with its effective date, is linked from the Platform’s sign-in page. If a change materially affects how we use information about you, we will tell you through the Platform or by email.