1. Introduction
Vanta Bioscience (‘Vanta’, ‘we’, ‘us’, or ‘our’) is a GLP-compliant preclinical contract research organization (CRO) headquartered in India, serving clients in the pharmaceutical, biopharmaceutical, medical device, agrochemical, and specialty chemical sectors across global markets.
We are committed to protecting the privacy and personal data of individuals who interact with our website and communications. This Privacy Policy describes how we collect, use, store, share, and protect personal data in connection with your use of our website (www.vantabioscience.com) and related communications.
Important Distinction: Website Data vs. Client Project Data
This Privacy Policy governs personal data collected through website interactions, inquiries, and related communications only. Data related to contracted research studies, nonclinical programs, and project-specific scientific information is governed exclusively by the terms of the relevant contractual agreements between Vanta Bioscience and its clients — including Non-Disclosure Agreements (NDAs), Confidentiality and Disclosure Agreements (CDAs), and Master Service Agreements (MSAs). Such data is not within the scope of this Policy.
2. Information We Collect
We collect the following categories of personal data solely to the extent necessary for the purposes described in this Policy:
2.1 Business Contact Information
- Full name and professional title
- Company or organization name
- Business email address and telephone number
- Country and region of operation
2.2 Inquiry and Project-Related Information
- Descriptions of services of interest or proposed research scope
- General information submitted through contact forms or email
- Correspondence and communication history relating to service evaluation
2.3 Technical and Usage Data
- IP address and approximate geolocation (country/region level)
- Browser type, operating system, and device information
- Pages visited, referral sources, and session duration on our website
- Timestamps and interaction logs
2.4 Cookies and Tracking Technologies
We use essential cookies to ensure the proper functioning of our website, and analytics cookies to understand aggregate website usage. Please refer to Section 10 (Cookies) for further details.
3. How We Use Your Information
We use personal data collected through our website for the following purposes only:
- Responding to Inquiries: To contact and communicate with individuals who submit business inquiries or requests for information.
- Evaluating Service Requests: To assess the scope, feasibility, and appropriateness of proposed research or service engagements.
- Client Communication:To maintain ongoing communication with prospective and existing clients at the pre-contractual stage.
- Website Improvement: To analyze aggregate usage patterns and improve the functionality, content, and user experience of our website.
- Legal and Regulatory Compliance: To fulfill obligations under applicable laws and regulations, including data protection, GLP compliance, and other regulatory frameworks.
- Security and Fraud Prevention: To detect, prevent, and address technical issues, unauthorized access, or misuse of our website.
4. Legal Basis for Processing (EU/GDPR)
For individuals located in the European Union, processing of personal data is based on one or more of the following lawful grounds under Article 6 of the GDPR:
- Consent (Art. 6(1)(a)):Where you have given clear, informed consent for specific processing activities, such as receipt of communications from us.
- Contractual Necessity (Art. 6(1)(b)):Where processing is necessary for steps taken at your request prior to entering into a contract, or for the performance of a contract to which you are a party.
- Legitimate Interests (Art. 6(1)(f)):Where processing is necessary for our legitimate business interests, including responding to inquiries, improving our website, and maintaining security — provided such interests are not overridden by your rights.
- Legal Obligation (Art. 6(1)(c)): Where processing is required to comply with applicable legal or regulatory obligations.
5. Data Sharing and Disclosure
We do not sell, rent, or trade personal data. We limit sharing of personal data to the following circumstances:
5.1 Service Providers and Technology Partners
We may share personal data with third-party service providers engaged to support our operations, including:
- Website hosting and infrastructure providers
- IT security and data management vendors
- Analytics and performance monitoring tools
- Email communication platforms
All such providers are contractually bound to process personal data only as directed by Vanta Bioscience and in accordance with applicable data protection obligations.
5.2 Legal and Regulatory Authorities
We may disclose personal data where required by law, court order, regulatory authority, or other binding legal process — including under applicable Indian law and, where required, under laws of other jurisdictions applicable to cross-border engagements.
5.3 Confidentiality of Client and Study Data
Client-specific data, research project information, scientific data, and study-related materials are not subject to this Privacy Policy. All such information is treated with strict confidentiality pursuant to the relevant contractual agreements (NDAs, CDAs, MSAs) governing each client engagement. Vanta Bioscience does not disclose, share, or transfer such data except as expressly authorized under those agreements or required by applicable regulatory obligations.
6.International Data Transfers
Vanta Bioscience operates as a global CRO and may receive, store, or process personal data in or from multiple jurisdictions, including India, the European Union, the United States, Asia-Pacific regions, and other countries in which our clients and partners are located.
6.1 Safeguards for EU Data
Where personal data originating from the European Economic Area (EEA) is transferred to India or other countries not recognized by the European Commission as providing an adequate level of data protection, we implement appropriate safeguards, including:
- Standard Contractual Clauses (SCCs) as approved by the European Commission
- Contractual protections with receiving parties that reflect GDPR-equivalent standards
6.2 Transfers Under India's DPDP Act
To the extent applicable, transfers of personal data from India shall be conducted in accordance with the provisions of the Digital Personal Data Protection Act, 2023 (DPDP Act) and any subsequent regulations or cross-border transfer frameworks issued thereunder.
6.3 Other Jurisdictions
For transfers involving data subjects in other jurisdictions, including Australia, Singapore, and other Asia-Pacific regions, we apply reasonable contractual and organizational safeguards consistent with applicable local laws and international best practices, without representing compliance beyond what is required by those frameworks.
7.Data Security
We implement appropriate administrative, technical, and physical safeguards to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. These measures include:
- Controlled access to personal data based on operational need
- Encrypted data transmission protocols (TLS/HTTPS) for website communications
- Periodic review of access controls and data handling procedures
- Staff awareness and training on data protection obligations
No method of electronic transmission or storage is completely secure. While we endeavor to use reasonable means to protect your personal data, we cannot guarantee absolute security. In the event of a data breach affecting your rights, we will notify relevant authorities and affected individuals in accordance with applicable legal requirements.
8. Data Retention
We retain personal data only for as long as is necessary to fulfill the purposes for which it was collected, or as required by applicable law. The specific retention period depends on:
- Business Purpose: Inquiry-related data is retained for the duration of the evaluation process and a reasonable period thereafter to support follow-up or record-keeping needs.
- Contractual Engagement: Where an inquiry leads to a formal client relationship, data may be retained for the duration of that engagement and for such additional periods as required by applicable regulatory obligations (e.g., GLP record retention requirements).
- Legal Obligations: We retain data for such periods as may be required under applicable Indian law, GDPR, or other relevant legal frameworks.
Once data is no longer required, it is securely deleted or anonymized in accordance with applicable standards.
9. Your Data Rights
Depending on your country or region of residence, you may have specific rights with respect to your personal data. We are committed to honoring these rights in accordance with applicable law.
9.1 European Union (GDPR Rights)
Individuals located in the EU or EEA have the following rights:
- Right of Access: Obtain confirmation of whether and what personal data we hold about you
- Right to Rectification: Request correction of inaccurate or incomplete data
- Right to Erasure (‘Right to be Forgotten’): Request deletion of your data in certain circumstances
- Right to Restriction of Processing: Request limitation on how your data is processed
- Right to Object: Object to processing based on legitimate interests
- Right to Data Portability: Receive your data in a structured, machine-readable format
- Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing
To exercise these rights, contact us at the details provided in Section 12. You also have the right to lodge a complaint with your local data protection authority (supervisory authority).
9.2 United States — California (CCPA/CPRA)
California residents may have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), where applicable:
- Right to Know: Request disclosure of the categories and specific pieces of personal information collected
- Right to Delete: Request deletion of personal information we have collected about you
- Right to Opt-Out of Sale or Sharing: We do not sell personal data. If this practice changes, you will be notified and provided with opt-out mechanisms
- Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights
9.3 India (Digital Personal Data Protection Act, 2023)
Individuals in India have the following rights under the DPDP Act:
- Right to Access: Obtain a summary of personal data being processed and the processing activities
- Right to Correction and Erasure: Request correction of inaccurate data or erasure of data no longer necessary for its stated purpose
- Right to Grievance Redressal:Lodge a grievance with our designated contact, and where applicable, with the Data Protection Board of India
- Right to Nominate: Nominate another individual to exercise your rights in the event of death or incapacity
9.4 Other Jurisdictions (Global Users)
Users in other jurisdictions — including but not limited to Australia, Singapore, the United Kingdom, Canada, and other regions — may have additional or equivalent privacy rights under the laws applicable to them. Vanta Bioscience will honor such rights to the extent required under applicable mandatory law. Please contact us to make a rights request and we will assess your request in accordance with applicable legal requirements.
10. Cookies
10.1 Types of Cookies We Use
- Essential Cookies: Necessary for the technical operation and security of our website. These cannot be disabled without affecting website functionality.
- Analytics Cookies: Used to collect aggregated, non-identifiable data about website traffic and user behavior to improve our website’s performance and content. These may include tools such as Google Analytics or equivalent platforms.
10.2 Managing Cookies
You may control or disable non-essential cookies through your browser settings at any time. Note that disabling analytics cookies will not affect your ability to use our website. Most browsers allow you to refuse cookies, delete existing cookies, or receive notifications before cookies are stored.
For EU users, we present cookie preferences in accordance with GDPR consent requirements. For Indian users, cookie use is disclosed in accordance with applicable data protection obligations.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational circumstances. When material changes are made, we will update the effective date at the top of this document. Where required by applicable law, we will provide notice of material changes through our website or by direct communication.
Continued use of our website following any update constitutes acknowledgment of the revised Policy.
12. Contact and Grievance Information
For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact us at:
Vanta Bioscience — Privacy and Data Protection
Email: privacy@vantabioscience.com
Website: www.vantabioscience.com
Address: [Registered Office Address], Hyderabad, Telangana, India
Grievance Officer (India — DPDP Act)
In accordance with applicable Indian data protection obligations, you may also address grievances relating to your personal data to:
Grievance Officer: [Name of Designated Officer]
Email: grievance@vantabioscience.com
Response Time: We endeavor to acknowledge grievances within 72 hours and resolve them within 30 days.
Have Questions? Get in Touch
Can’t find the specific resource, code template, or compliance documentation you need?
Our team of professional architects is ready to assist you.