Data Handling & Privacy Policy

Effective Date: September 2026
LIPID MAPS® is committed to protecting and respecting your privacy.

1. Data Controller

For the purpose of the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018, the data controller is Cardiff University, with The Babraham Institute, Cambridge acting as a collaborator housing the LIPID MAPS servers.

2. Information We Collect

  • Account and Registration Details: When you register or update your scientific profile, we collect your name, email address, primary affiliation type, institution/organisation, country, role, ORCID identifier, research areas, and marketing communication preferences.
  • Usage and Telemetry Data: When you browse the website, we collect aggregated traffic data, active engaged dwell time, tool actions, and dataset download history. IP addresses are cryptographically hashed with a salted key and are never stored in plain text.
  • Correspondence and Feedback: If you contact us via contact forms, engagement prompts, or email, we retain a record of that correspondence to resolve your enquiry.

3. Lawful Bases for Processing

Under UK GDPR, we process your information under the following lawful bases:

  • Your Consent: For marketing updates (newsletter, industry announcements) and performance/analytical telemetry via our cookie preference manager. You may withdraw consent at any time.
  • Public Task / Legitimate Interests: To operate LIPID MAPS as a global open-access biomedical resource, evaluate scientific impact, and satisfy reporting obligations to grant funding bodies (e.g. Wellcome Trust, UKRI, NIH).
  • Contract: To deliver user account services, personal API tokens, and requested dataset downloads.

4. Dataset Downloads and Programmatic Access

When datasets (such as LMSD SDF, RDF, or TSV exports) are downloaded, download metadata (dataset identifier, file format, byte volume, and pseudonymous visitor identifier) is logged to quantify dataset utilization. Unregistered visitors can access open downloads subject to fair use and rate limiting.

5. Data Retention

Granular visitor telemetry events are retained for a maximum rolling period of 13 months, after which they are aggregated into anonymized monthly statistics and purged. User profile data is retained for the active lifecycle of your account.

6. Your Data Protection Rights

Under UK data protection law, you have statutory rights including:

  • Right of Access: You can ask for copies of your personal data.
  • Right to Rectification: You can update inaccurate or incomplete information via your profile or by contacting us.
  • Right to Erasure: You can request that we delete your account and personal data.
  • Right to Object / Restrict Processing: You can object to certain processing or withdraw consent.

7. Contact & Enquiries

To exercise your rights or ask questions regarding this policy, contact us at info@lipidmaps.org or via our Contact Form. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.