1. Who is responsible
This Privacy Policy applies to the omics4.com website (the "Site") and to the OMICS4 client portal (the "Portal").
GENXMAP SAS ("GENXMAP", OMICS4 brand), 9 rue Jacques Réattu, 13009 Marseille, France, is the controller of the personal data described below. Its laboratories are hosted at the Méditerranée Infection Building (IHU Méditerranée Infection), 19-21 Boulevard Jean Moulin, 13005 Marseille, France. GENXMAP has not appointed a data protection officer (DPO), as such an appointment is not mandatory for its activity. For any question about your personal data: privacy@omics4.com.
For personal data that may be contained in the samples or datasets you entrust to us (pseudonymised research data only), you remain the controller and GENXMAP acts as processor within the meaning of article 28 of the GDPR; see section 9.
2. Data processed
On the Site
- Enquiries and quote requests (contact form, email): name, email address, company, VAT or SIRET number if you give it, sector, type of request, platform concerned, expected volume, desired date, your message and any file you attach. Source: you.
- Technical and anti-abuse data: IP address, browser and device information and interaction signals collected by Google reCAPTCHA when you start filling in the contact form (see section 5).
- Audience measurement: only with your consent, Google Analytics 4 through Google Tag Manager (pages viewed, approximate location at country or region level, device type); see the Cookie Policy.
- Chat and visit tracking: the Site loads Zoho SalesIQ, a chat and visit-tracking tool (pages visited, technical identifiers, and the messages you send if you use the chat), whether or not you accept analytics cookies; see the Cookie Policy.
- Shop (store page): if you use the shop on the store page, its provider, Ecwid (Lightspeed Commerce), processes your basket and, if you open one, your customer account.
In the Portal
- Account and access: name, email address, role in the space (manager, orderer, reader, billing, external), language, password (stored in irreversibly hashed form), two-factor secret. Source: you, or your space manager who invites you.
- Laboratory, payer, contacts: laboratory or institution name, billing address, SIRET, Chorus Pro service code, manager's address, commitment number. Source: you.
- Orders and purchase orders: order lines, amounts, accepted terms (text and date), purchase-order PDF, collection mode. Source: you.
- Samples: sample code (never a person's name), type, quality characteristics (concentration, RIN, etc.). Source: you or the laboratory.
- Documents and results: reports, quotes, invoices, delivered data. Source: GENXMAP.
- Exchanges: messages with the team, meeting requests, notifications. Source: you or GENXMAP.
- Logs: connection log (date, IP address) and audit log of actions (who, what, when). Source: automatic.
No sensitive data expected. Samples are identified by codes of your choice; do not upload patient names or identifiable health data to the Portal. The Portal is not a health-data hosting service and GENXMAP is not an HDS-certified host: projects requiring HDS hosting are handled outside the Portal. Pseudonymised data from human samples remain personal data (possibly genetic data under article 9 of the GDPR): you keep the correspondence table, which we do not have.
3. Why and on what legal basis
On the Site
- Answer your enquiries and prepare quotes (forms, email): steps taken at your request before a contract; legitimate interest.
- Protect the contact form against automated submissions (Google reCAPTCHA): legitimate interest.
- Chat and follow up visits to the Site (Zoho SalesIQ): legitimate interest; you can object at any time at privacy@omics4.com.
- Measure the audience of the Site (Google Analytics 4): your consent, which you can withdraw at any time through the "Cookie preferences" link in the footer.
In the Portal
- Create and manage your account, secure access (invitation, two-factor authentication, logs): performance of contract; legitimate interest (security).
- Take, follow and perform your orders, collections and delivery of results: performance of contract.
- Invoice, account, file on Chorus Pro, collect payment: performance of contract; legal obligation.
- Answer your messages and meeting requests, notify you: performance of contract; legitimate interest.
- Support and service improvement (internal statistics, no profiling): legitimate interest.
- Prove traceability of operations (audit log, accepted terms): legitimate interest; legal or evidentiary obligation.
- Optional information about our services (for example the free demo): legitimate interest, with a right to object at any time.
No solely automated decision-making produces legal effects on you.
4. How long we keep it
- Site enquiries and quote requests: only as long as needed to respond and follow up; if an order follows, the retention periods for orders below apply.
- Account and exchanges: for the duration of the relationship. An account inactive for 3 years is deactivated, then deleted.
- Orders, accepted terms, purchase orders: duration of the commercial relationship, then 5 years (commercial limitation period).
- Invoices and accounting records: 10 years (legal obligation).
- Connection log (IP addresses): 12 months, then automatic deletion.
- Audit log of actions: 6 years, as evidence.
- Reports and results in the Portal: 3 months after being posted; beyond that, retention on quote (paid). Large raw datasets: 90 days.
- Physical samples: 3 months after the final report, then destruction, unless you request their return at your expense.
- Encrypted backups: kept on a rotation basis for a limited period; deleted data disappears from backups at the end of the rotation.
At the end of these periods data are deleted or anonymised, unless a legal retention obligation applies.
5. Who has access
- GENXMAP's authorised team (named access, mandatory two-factor authentication for internal accounts, logging).
- Other users of your space, according to their role (the "billing" role does not see scientific results; the "external" role sees only the projects chosen).
- Our providers (processors), only to deliver the service:
- Scaleway SAS: hosting of the Portal server, in a data centre in Amsterdam (European Union).
- OVH SAS: storage of the off-site copy of backups, encrypted before transfer, in a data centre in Paris (France).
- Zoho (Zoho Corporation B.V.): commercial management (quotes, invoices, accounting), handling of the enquiries sent through the Site forms (CRM), sending Portal emails (invitations, links, notifications), and the Site's chat and visit-tracking tool (SalesIQ), which is loaded on the pages of the Site whether or not you accept analytics cookies (see the Cookie Policy); data stored in the European Economic Area.
- Netlify, Inc. (United States): hosting of the Site; see section 6.
- Google Ireland Limited: reCAPTCHA (contact form), Google Tag Manager and Google Analytics 4 (audience measurement, with your consent), and Google Fonts (the typefaces are loaded from Google's servers when a page is displayed).
- Ecwid (Lightspeed Commerce): the shop, on the store page only.
- Partner platforms: only if your order provides for it, after prior notice.
- The carrier is chosen by the laboratory or by the customer; GENXMAP gives it only the information needed for collection.
- Artificial intelligence: AI processing is carried out in-house, on our own servers; no data is sent to a third-party AI provider. No patient identity is ever sent to it.
- Authorities, on legal request.
We do not sell your data and do not use it for advertising. Aggregated, anonymised data is used only for our internal statistics and is never resold or published in a way that identifies a customer.
Our contact form is protected by Google reCAPTCHA to prevent automated submissions. It is loaded only when you start filling in the form, not when the page opens. From that point Google collects technical data (IP address, browser and device information, and interaction signals such as mouse movement) and may set a cookie, in order to tell human visitors from automated scripts. This data is transmitted to Google Ireland Limited and may be processed on servers outside the European Economic Area, under the safeguards described in section 6. We rely on our legitimate interest in protecting the form from abuse. reCAPTCHA is governed by Google's privacy policy and terms of service.
6. Transfers outside the European Union
Our laboratories are in France. The Portal server is in the European Union (Amsterdam), with encrypted backups in France. Zoho states that data are stored in the European Economic Area, but that its group entities may access them case by case and that transfers outside that area to its sub-processors are possible, under a valid transfer basis (standard contractual clauses or equivalent).
Some providers of the Site (Google, Netlify, Ecwid) are established outside the European Economic Area or may process data there. In that case we rely on appropriate safeguards, such as Standard Contractual Clauses, to protect the data transferred.
7. Security
Encryption of exchanges (HTTPS) and backups, irreversibly stored passwords, two-factor authentication (mandatory for the team, optional or required for customers), time-limited sessions and sign-out after inactivity, strict separation of data between organisations, time-limited personal links, append-only audit log. In the event of a personal data breach we notify the CNIL within 72 hours and, if the risk to you is high, inform you.
The Site is served over HTTPS only.
8. Your rights
You may access, rectify and erase your data, restrict or object to its processing, request portability and set post-mortem directives, by writing to privacy@omics4.com. We reply within one month. You may lodge a complaint with the CNIL (cnil.fr, 3 place de Fontenoy, 75007 Paris). Accounting records and security logs cannot be erased before the end of their legal or evidentiary period.
9. Your project data (GENXMAP as processor)
The samples and datasets you entrust to us contain only pseudonymised data. You remain the controller: you are responsible for consent or the legal basis, for informing the data subjects and for the necessary authorisations (ethics approval in particular). GENXMAP, as processor within the meaning of article 28 of the GDPR, processes such data only on your documented instructions, with confidentiality and security measures, assists you with data subjects' rights, notifies you of data breaches, and deletes or returns the data at the end of the service. A data processing agreement is available on request.
10. Cookies and trackers
On the Site, we use essential cookies; and, only with your consent, analytics cookies (Google Tag Manager and Google Analytics 4). The Zoho SalesIQ chat and visit-tracking tool is loaded whether or not you accept analytics cookies. On the contact page, Google reCAPTCHA sets a security cookie; on the store page, the shop provider sets the cookies needed for your basket. We use no advertising or retargeting cookie. The details, and how to change your choice at any time ("Cookie preferences" link in the footer), are in our Cookie Policy.
In the Portal, only strictly necessary cookies and storage or preferences chosen by you are used, exempt from consent:
cic_portail (session cookie, HttpOnly, Secure, SameSite=Strict): keeps you signed in; session length, with sign-out after inactivity.cic-langue-visiteur, cic-theme and display preferences (browser local storage): remember your language, theme and layout, until you clear them.- Guide position, tour state (browser session storage): usability, until the tab is closed.
No audience-measurement, advertising, social-network, font or third-party-hosted script is loaded by the Portal. If this changes, this policy will be updated and your consent requested first.
11. Changes
We may change this policy; the update date is shown at the top. Material changes are shown on this page and, for Portal users, in the Portal.
12. Contact
Questions about this policy or about your personal data: privacy@omics4.com. General enquiries: contact@omics4.com, +33 4 13 73 24 81 (switchboard) or +33 7 69 44 16 18 (commercial).