Effective date: 16 November 2026

This notice explains how SciBridgeX Technologies Limited (“SciBridgeX”, “we”, “us”) uses personal data. Part A covers visitors to this website and people who contact us. Part B covers people whose data we handle through our platform and assessment services. Part C covers both.

Part A – Website and enquiries

A1. Who we are

SciBridgeX Technologies Limited is registered in England and Wales (company number 16942880). Our registered office is at 20–22 Wenlock Road, London, N1 7GU, United Kingdom. For personal data collected through this website, we are the controller. Data protection enquiries can be sent to info@scibridgex.com, for the attention of our privacy lead.

A2. What we collect and why

When you submit an enquiry or contact us, we collect the personal data you give us. This is usually your name, organisation, role, email address, phone number (if provided) and the content of your message. We use it to:

  • respond to your enquiry, arrange a call or send information you have asked for; and

  • keep a record of our communications and, where relevant, follow up on a potential or existing business relationship.

We do not use website enquiry data for automated decision-making or profiling. We do not send marketing emails to individuals unless you have agreed, or the law otherwise allows it. Every marketing email includes a way to opt out.

A3. Our lawful basis

We rely on our legitimate interests (Article 6(1)(f) UK GDPR) in responding to business enquiries, in maintaining professional relationships with governments, corporates, development finance institutions, philanthropists, universities and institutional data users, and in running and developing our business. We have balanced these interests against your rights and consider the processing proportionate. You can object at any time (see C3).

A4. How long we keep it

We keep enquiry data for 24 months from our last interaction, which reflects our typical partnership cycle. We then delete or anonymise it, unless you become a client or partner (when the retention periods in Part B or our contract apply) or the law requires us to keep it longer.

A5. Security

We use appropriate technical and organisational measures to protect personal data. These include encryption in transit and at rest, role-based access controls and logging.

A6. Cookies and similar technologies

This website does not use cookies or any similar technologies. It does not store information on, or access information from, your device for analytics, advertising or any other purpose, so no cookie banner is shown.

If this changes, we will update this notice and, where the law requires, ask for your consent before using any such technology.

Part B – Platform and assessment services

B1. Who this part applies to

This part applies to: users of the SciBridgeX platform; founders, directors, employees and representatives of SMEs that we assess; and contacts at our clients and partners (governments, corporates, development finance institutions, philanthropists, universities, startup associations and similar organisations).

B2. Our role

  • When we act for a client. If a client (for example a programme partner) asks us to assess SMEs, the client is usually the controller and we process data on its behalf under a data processing agreement. The client’s own privacy notice explains its use of your data. We will tell you who the client is.

  • When we are the controller. We are the controller for platform account data, our client and partner contacts, the assessments we run for SMEs that engage us directly, and the anonymised, aggregated benchmarks we create.

B3. What we collect

  • Identity and contact details: name, role, organisation, email, phone.

  • Business information about the SME that may include personal data: ownership and management, financial statements and management accounts, operational, compliance, ESG and product information, and documents you upload.

  • Platform usage data: log-ins, actions and audit logs.

We collect this from you, from the SME you represent, from our client or programme partner, and from public sources such as company registers. We do not ask for special category data (for example health or ethnicity data). Please do not provide it unless we have agreed a specific purpose and safeguards with you.

B4. AI-assisted assessments

We use automated tools, including AI models, to analyse business information and produce diagnostics, benchmarks and readiness indicators about SMEs. Our team reviews these outputs before they are released. We do not make decisions about individuals based solely on automated processing that have legal or similarly significant effects. Our outputs are not credit ratings, and they are not investment, credit or financial advice. Our AI providers are not permitted to use your data to train their models.

B5. Lawful bases

  • Contract (Article 6(1)(b)): to provide the platform and services to you or the SME you represent.

  • Legitimate interests (Article 6(1)(f)): to deliver programmes for our clients, secure and improve our services, and create anonymised benchmarks.

  • Legal obligation (Article 6(1)(c)): to keep records the law requires.

B6. How long we keep it

Where we act for a client, retention follows the client’s instructions and our agreement with it. Where we are the controller, we keep assessment data for the life of the engagement plus 6 years, to meet legal and contractual requirements and to deal with any claims. We keep account data until your account closes plus 12 months. Anonymised benchmarks are no longer personal data and may be kept.

B7. Programmes outside the UK

When we run programmes outside the UK, we also comply with the data protection laws of the countries concerned, including any registration requirements and any approvals needed before personal data is transferred. You may also contact the data protection authority in your country about how your data is handled.

Part C – Applies to all personal data

C1. Who we share it with

We do not sell personal data. We share it only with:

  • our service providers (hosting, email, platform, AI and communications tools), under written data processing terms (a current list is available on request from info@scibridgex.com);

  • the client or programme partner for whom we run an assessment;

  • third parties that you or the SME ask us to share outputs with, such as a prospective customer, partner or funder;

  • professional advisers (legal, accounting, compliance);

  • a buyer of, or successor to, our business, under equivalent protections; and

  • public authorities or regulators where the law requires it.

C2. International transfers

We are based in the UK. When personal data is transferred from the UK to a country without UK adequacy regulations, we use the ICO’s International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. We first complete a transfer risk assessment to confirm that the data protection test is met. When personal data is transferred into the UK from another country, we follow that country’s transfer rules, including any permit required. Details of the safeguard used for a particular transfer are available from info@scibridgex.com.

C3. Your rights

Under the UK GDPR and the Data Protection Act 2018 you have the right to: access your personal data; have inaccurate data corrected; have data erased; restrict processing; object to processing based on legitimate interests (including profiling); data portability where it applies; and object to direct marketing at any time. These rights have limits; for example, we may keep data that we are legally required to keep. To exercise a right, email info@scibridgex.com. We will respond within one month, or tell you if we need longer for a complex request. If we process your data for a client, we will pass your request to that client.

C4. Complaints

You can complain to us at info@scibridgex.com. We will acknowledge your complaint within 30 days, investigate it without undue delay, and keep you informed of progress and the outcome. You may also complain to the Information Commissioner’s Office (ico.org.uk) or to the data protection authority in the country where you live or work. We would welcome the chance to resolve your concern first.

C5. Changes to this notice

We may update this notice. The current version, with its effective date, is always on this page. If we make material changes, we will take reasonable steps to tell you, for example by email or by a notice on the website.