Data processing terms
Draft for legal review, dated 31 October 2026. These terms have not yet been reviewed by a solicitor.
These terms form part of our terms of service. They apply where Box 4 Digital Group Ltd ("Box 4"), company number 17253991, Suite 114b Business First, Davyfield Road, Blackburn, Lancashire BB1 2QY, processes personal data for your organisation through the Chemical Register. ICO registration number [TO CONFIRM].
1. Roles
Your organisation is the controller of the personal data in its Chemical Register. Box 4 is its processor.
Box 4 is a controller in its own right for some data, such as account administration, billing, security logs, data needed to arrange a collection through our disposal terms and our own legal records. Our privacy notice covers those.
"UK GDPR" and "Data Protection Act 2018" mean those laws as in force in the UK, and terms such as controller, processor and personal data have the meanings given there.
2. What we process
| Item | Detail |
|---|---|
| Subject matter | Hosting and operating the Chemical Register for your organisation |
| Duration | The life of your account, then as set out in clause 10 |
| Nature and purpose | Storing, retrieving, displaying, reporting on, backing up and otherwise processing data, so that your organisation can record and manage its chemical stock and collections |
| Categories of people | Your users, and anyone named in entries your users make, such as stock owners, principal investigators and people named on consignment notes |
| Types of personal data | Names, work email addresses, roles, sign-in and security data, audit entries showing who changed what and when, signatures on stock check reports, and anything your users type into free-text fields or include in photographs |
The register is designed for chemical data and not for special category data. Please do not enter patient or pupil information into it, and do not photograph anything but the container.
3. Your instructions
We process personal data only on your documented instructions, which include these terms and your use of the software, unless the law requires otherwise. If the law does require otherwise, we will tell you first unless the law prevents that. We will tell you if we believe an instruction breaks data protection law.
You are responsible for having a lawful basis for the data your organisation enters, and for telling your users about it.
4. Confidentiality and staff
Anyone we authorise to process the data must be under a duty of confidentiality. Tenant impersonation by Box 4 staff, for support, is audited.
5. Security
We apply the measures described on our security page. That page sets out what is in place. It also sets out what is not in place, including the fact that we make no claim of encryption at rest and hold no security certification. You should read it, and satisfy yourself that those measures are appropriate before you enter personal data.
The main measures we rely on are these:
- UK hosting of the live service on OVH
- TLS for traffic to the website, application and API
- database and search services reachable only from the server itself
- uploaded files held in a private store that is not served directly from the web
- a database role for the application with no superuser rights and no ability to bypass row level security
- row level security on tenant tables, and a test that attempts a cross-tenant read and must fail
- role-based access and audit entries for register changes
- nightly backups, with 30 dated folders kept and a checksum check
We may change these measures, provided that the overall level of protection is not reduced.
6. Sub-processors
You give general authorisation for us to use sub-processors. We will tell account owners before adding or replacing one, so that you have a chance to object. If you object on reasonable grounds and we cannot resolve it, you may end the affected part of the service. Each sub-processor is bound by written terms that give equivalent protection, and we remain responsible for its work.
Current sub-processors:
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| OVH | Hosting of the application, database and stored files | All register data | UK (Barking) |
| Hetzner | Backup storage on a Storage Box | All register data, in backup archives | Germany |
| Hugging Face, routing to the inference provider DeepInfra | AI assistant, using the model DeepSeek V4 Flash | Chemical data and label photographs, with personal data stripped | May be outside the UK. [TO CONFIRM] |
| Email delivery provider [TO CONFIRM] | Invitations, digests and service email | Recipient names and email addresses, and message content | [TO CONFIRM] |
7. AI assistant
AI calls send chemical data and label photographs, with personal data stripped. We name the Hugging Face route as a sub-processor because it may process data outside the UK. Stripping cannot catch everything. A photograph could capture a name or a face, and a free-text note could contain a person's name if it were sent. Users should photograph the container alone.
Prompts and responses are logged. Outputs are labelled as suggestions, and nothing is written to the register unless a user confirms it. We do not use any other paid model API, and the assistant fails with an error if the route is unavailable.
Whether your data may be used to train a model by any provider is [TO CONFIRM]. We will not knowingly agree to that use.
8. International transfers
Backups are held in Germany. The UK treats the European Economic Area as providing adequate protection. AI calls may be processed outside the UK, potentially in the United States. The transfer mechanism for that route is [TO CONFIRM]. We will not transfer personal data outside the UK otherwise, except as these terms allow or on your instructions.
Please note that the live service runs in the UK, but this service as a whole is not UK-only. If your organisation requires UK-only processing, these terms do not meet that requirement today.
9. Help with your obligations
Taking into account the nature of the processing, we will:
- help you respond to people exercising their rights, and pass on any request we receive directly
- tell you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own duties
- help with data protection impact assessments and any consultation with the ICO
- make available the information needed to show we comply with these terms, and allow for and contribute to audits on reasonable notice, with the cost and scope to be agreed [TO CONFIRM]
10. When your account ends
When your account ends, you can ask for an export of your organisation's data. We will then delete or return personal data, at your choice, unless the law requires us to keep it.
Consignment notes and disposal records are retained for a minimum of three years, and they cannot be deleted by your users. Whether we hold those records beyond your account as your processor or as a controller, and exactly how long, is [TO CONFIRM].
Deletion from live systems happens within [TO CONFIRM] days. Backups expire on a rolling basis: 30 dated folders are kept, so deleted data can stay in a backup until that backup is removed.
11. Liability and precedence
Liability under these terms is subject to the limits in the terms of service. If these terms conflict with the terms of service about personal data, these terms take priority.
Questions about these terms can go to info@labchemicaldisposal.co.uk.