Privacy Policy of
Corona Test Centre

Privacy Policy of Corona Test Centre

Corona Test Centre respects your privacy and is committed to protecting your personal data. This privacy policy will inform you as to how we look after your personal data when you visit our website, register or authenticate a Covid-19 test, or otherwise provide your personal data to us. 

This document can be printed for reference by using the print command in the settings of any browser.

Who we are

We are X Medical Ltd, 224 Shoreditch High St, London, E1 6PJ

We are a "data controller" in respect of the information we hold about you. This means that we are responsible for deciding how we use your personal information. 

You can contact us at: hello@coronatestcentre.com

Types of data we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Contact and identification data: such as your first name, last name, email address, phone number, date of birth, ZIP/Postal code, sex, ethnic origin, billing address, shipping address, and other similar data you may provide us with while using the service;
• Usage Data: information collected automatically through Corona Test Centre (or third-party services employed in Corona Test Centre), which can include: your IP addresses or domain names, your Unique Resource Identifier addresses, time of your request, method utilised to submit your request to the server, size of the file received in response, numerical code indicating the status of the server's answer (successful outcome, error, etc.), country of origin, features of the browser and the operating system utilised, various time details per visit (e.g., the time spent on each page within the Application) and the details about the path followed within the Application with special reference to the sequence of pages visited, and other parameters about the device operating system and/or your IT environment.
• Marketing and communications data: such as your preferences in receiving marketing from us and your communication preferences.

If you fail to provide your personal information

Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time. Unless specified otherwise, all data requested by Corona Test Centre is mandatory and failure to provide this data may make it impossible for Corona Test Centre to provide its services. 

You are responsible for any third-party Personal Data obtained, published or shared through Corona Test Centre and confirm that you have the third party's consent to provide their data to us.

How your data is collected

We use different methods to collect data from and about you including through:

• Direct interactions: you may give us your contact and identification data by filling in forms or by corresponding with us by post, phone, email or otherwise. 
• Automated technologies or interactions: as you interact with our website, we may automatically collect technical data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive technical data about you if you visit other websites employing our cookies. Please see our Cookies Policy for further details.
• Third parties such as analytics providers and advertising networks. 

Mode and place of processing the Data

Methods of processing

We takes appropriate security measures to prevent unauthorised access, disclosure, modification, or unauthorised destruction of your data.
Our data processing is carried out using computers and/or IT enabled tools, following organisational procedures and modes strictly related to the purposes indicated. In some cases, your data may be accessible to certain types of persons in charge, involved with the operation of Corona Test Centre (administration, sales, marketing, legal, system administration) or external parties (such as third-party technical service providers, mail carriers, hosting providers, IT companies, communications agencies) appointed, if necessary, as Data Processors by us. The updated list of these parties may be requested from us at any time.

Legal basis of processing

We use the types of personal data listed above for a number of purposes, each of which has a "lawful basis". In accordance with the data protection laws, we need a "lawful basis" for collecting and using information about you. There are a variety of different lawful bases for using personal data which are set out in the data protection laws.

We may process your Personal Data if one of the following lawful bases applies:

• you have given their consent for one or more specific purposes;
• processing is necessary for the performance of an agreement with you and/or for any pre-contractual obligations thereof;
• processing is necessary for compliance with a legal obligation to which we are subject;
• processing is necessary for the purposes of the legitimate interests pursued by us or by a third party.

We may also process Special Categories of Personal Data. This is personal data that includes details on your race or ethnicity and information about your health. Where we do so, we will process this data where processing is necessary for the provision of health care or treatment or management of health care systems and services. 

In any case, we will gladly help to clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract.

Place

Your data is processed at our operating offices and in any other places where the parties involved in the processing are located.

Depending on your location, data transfers may involve transferring your data to a country other than your own. To find out more about the place of processing of such transferred data, you can check the section containing details about the processing of Personal Data. 

Retention time

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying legal, accounting or reporting requirements.  

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements. Therefore:

• Personal Data collected for purposes related to the performance of a contract with you shall be retained until such contract has been fully performed.
• Personal Data collected for the purposes of our legitimate interests shall be retained as long as needed to fulfil such purposes. You may find specific information regarding the legitimate interests pursued by us within the relevant sections of this document or by contacting us.

We may be allowed to retain Personal Data for a longer period when you have given consent to such processing, as long as such consent is not withdrawn. Furthermore, we may be obliged to retain Personal Data for a longer period whenever required to do so for the performance of a legal obligation or upon order of an authority.

Once the retention period expires, Personal Data shall be deleted. Therefore, the right of access, the right to erasure, the right to rectification and the right to data portability cannot be enforced after expiration of the retention period.

The purposes of processing

Your data is collected to allow us to:

• provide our service to you, including to manage our relationship with you, handle payments, contact you, provide live chat platforms, conduct online surveys, 
• comply with our legal obligations; 
• administer and protect our business, including protecting our rights and interests (or those of our customers or third parties), detecting any malicious or fraudulent activity; conducting troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data;
• use data analytics to improve our website, services, marketing, customer relationships and experiences.

For specific information about the Personal Data used for each purpose, you may refer to the section “Detailed information on the processing of Personal Data”.

Marketing

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. We have established a subscription centre located within the emails your receive where you can view and make certain decisions about your personal data use.

Promotional material from us

You will receive marketing communications from us if you have subscribed to receive news from us, and you have not opted out of receiving that marketing.

Third party marketing

We will get your express opt-in consent before we share your personal data with any other company for marketing purposes.

Opting out

You can ask us to stop sending you news at any time by following the unsubscribe links on any message sent to you or by contacting us at any time.

Where you opt out of receiving these marketing messages, this will not apply to personal data provided to us as a result of any other interaction you have had with us.

Disclosure of your personal data

We may have to share your personal data with the parties set out below:

• Service providers who provide IT and system administration services including hosting and backend infrastructure, payment providers, and other platform services.
• Professional advisers including lawyers, auditors and insurers who provide consultancy, legal, insurance and accounting services.
• HM Revenue & Customs, regulators and other authorities who require reporting of processing activities in certain circumstances.
• Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.
• The Police or other law enforcement agencies in relation to security related or law enforcement investigations or in the course of cooperating with authorities, protecting and defending our rights or property or complying with legal requirements.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. 

International Data Transfers

Some of our external third parties are based outside the UK, so their processing of your personal data will involve a transfer of data outside the UK. Whenever we transfer your personal data outside of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data. 
• Where we use certain service providers, we may use specific contracts approved for use in the UK which give personal data the same protection it has in the UK.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK. 

Detailed information on the processing of Personal Data

Personal Data is collected for the following purposes and using the following services:

Access to third-party accounts

This type of service allows Corona Test Centre to access data from your account on a third-party service and perform actions with it. These services are not activated automatically, but require explicit authorisation by you.

Stripe account access (Stripe Inc)

This service allows Corona Test Centre to connect with your account on Stripe, provided by Stripe, Inc.

Personal Data processed: various types of data as specified in the privacy policy of the service.

Place of processing: United States – Privacy Policy.

Direct marketing via SMS (Corona Test Centre)

Corona Test Centre uses your data to propose services and products provided by third parties or unrelated to the product or service provided by Corona Test Centre.

Personal Data processed: first name; last name; phone number.

Contacting you

Contact form (Corona Test Centre)

By filling in the contact form with your data, you authorise Corona Test Centre to use these details to reply to requests for information, quotes or any other kind of request as indicated by the form’s header.

Personal Data processed: email address; first name; last name.

Mailing list or newsletter (Corona Test Centre)

By registering on the mailing list or for the newsletter, your email address will be added to the contact list of those who may receive email messages containing information of commercial or promotional nature concerning Corona Test Centre. Your email address might also be added to this list as a result of signing up to Corona Test Centre or after making a purchase.

Personal Data processed: email address.

Phone contact (Corona Test Centre)

If you provided your phone number you might be contacted for commercial or promotional purposes related to Corona Test Centre, as well as for fulfilling support requests.

Personal Data processed: phone number.

The SaaSy People Ltd

The SaaSy People Ltd provide us with Customer Service functions to its customers including contacting the customer about their appointment(s), their questions and their test results, where applicable.

Displaying content from external platforms

This type of service allows you to view content hosted on external platforms directly from the pages of Corona Test Centre and interact with them.
This type of service might still collect web traffic data for the pages where the service is installed, even when you do not use it.

Google Fonts (Google Ireland Limited)

Google Fonts is a typeface visualization service provided by Google Ireland Limited that allows Corona Test Centre to incorporate content of this kind on its pages.

Personal Data processed: Usage Data; various types of data as specified in the privacy policy of the service.

Place of processing: Ireland – Privacy Policy.

Handling payments

Unless otherwise specified, Corona Test Centre processes any payments by credit card, bank transfer or other means via external payment service providers. In general and unless where otherwise stated, you are requested to provide your payment details and personal information directly to such payment service providers. Corona Test Centre isn't involved in the collection and processing of such information: instead, it will only receive a notification by the relevant payment service provider as to whether payment has been successfully completed.

Stripe (Stripe Inc)

Stripe is a payment service provided by Stripe Inc.

Personal Data processed: various types of data as specified in the privacy policy of the service.

Place of processing: United States – Privacy Policy.

PayPal (PayPal Inc.)

PayPal is a payment service provided by PayPal Inc., which allows you to make online payments.

Personal Data processed: various types of data as specified in the privacy policy of the service.

Place of processing: See the PayPal privacy policy – Privacy Policy.

Hosting and backend infrastructure

This type of service has the purpose of hosting data and files that enable Corona Test Centre to run and be distributed as well as to provide a ready-made infrastructure to run specific features or parts of Corona Test Centre.

Some services among those listed below, if any, may work through geographically distributed servers, making it difficult to determine the actual location where the Personal Data are stored.

Amazon Web Services (AWS) (Amazon Web Services, Inc.)

Amazon Web Services (AWS) is a hosting and backend service provided by Amazon Web Services, Inc.

Personal Data processed: various types of data as specified in the privacy policy of the service.

Place of processing: United Kingdom – Privacy Policy.

Interaction with live chat platforms

This type of service allows you to interact with third-party live chat platforms directly from the pages of Corona Test Centre, in order to contact and be contacted by Corona Test Centre‘s support service.
If one of these services is installed, it may collect browsing and Usage Data in the pages where it is installed, even if you do not actively use the service. Moreover, live chat conversations may be logged.

Facebook Messenger Customer Chat (Facebook Ireland Ltd)

The Facebook Messenger Customer Chat is a service for interacting with the Facebook Messenger live chat platform provided by Facebook Ireland Ltd

Personal Data processed: Cookies; data communicated while using the service; Usage Data.

Place of processing: Ireland – Privacy Policy.

Interaction with online survey platforms

This type of service allows you to interact with third-party online survey platforms directly from the pages of Corona Test Centre.
If one of these services is installed, it may collect browsing and Usage Data in the pages where it is installed, even if you do not actively use the service.

Hotjar Poll & Survey widgets (Hotjar Ltd.)

The Hotjar Poll & Survey widgets are services that enable interaction with the Hotjar platform provided by Hotjar Ltd.
Hotjar honors generic „Do Not Track” headers. This means the browser can tell its script not to collect any of the your data. This is a setting that is available in all major browsers. Find Hotjar’s opt-out information here.

Personal Data processed: Cookies; Usage Data; various types of data.

Place of processing: Malta – Privacy Policy – Opt Out.

Managing contacts and sending messages

This type of service makes it possible to manage a database of email contacts, phone contacts or any other contact information to communicate with you.
These services may also collect data concerning the date and time when the message was viewed by you, as well as when you interacted with it, such as by clicking on links included in the message.

Customer.io (Peaberry Software Inc.)

Customer.io is an email address management and message sending service provided by Peaberry Software Inc.

Personal Data processed: email address; Usage Data.

Place of processing: United States – Privacy Policy.

Managing data collection and online surveys

This type of service allows Corona Test Centre to manage the creation, deployment, administration, distribution and analysis of online forms and surveys in order to collect, save and reuse Data from any responding users.
The Personal Data collected depend on the information asked and provided by you in the corresponding online form.

These services may be integrated with a wide range of third-party services to enable us to take subsequent steps with the data processed - e.g. managing contacts, sending messages, analytics, advertising and payment processing.

Facebook lead ads (Facebook Ireland Ltd)

Facebook lead ads is an advertising and data collection service provided by Facebook Ireland Ltd that allows form-based ads to be shown to you pre-populated with Personal Data from their Facebook profiles, such as names and email addresses. Depending on the type of advertisement, you may be requested to provide further information.

Form submission results in the collection and processing of these Data by the Owner under this privacy policy, and only for the specific purpose outlined on the form and/or inside this privacy policy, where provided.

You may exercise their rights, at any time, including the right to withdraw their consent to the processing of their Data, as specified in the section containing information about user rights in this privacy policy.

Personal Data processed: email address.

Place of processing: Ireland – Privacy Policy – Opt out.

Hotjar surveys (Hotjar Ltd.)

Hotjar surveys is a survey builder and data collection platform provided by Hotjar Ltd.
Hotjar surveys may use cookies to track your behaviour. You can Opt-Out of Hotjar surveys cookie tracking by visiting this opt-out page.

Hotjar surveys respects the Do Not Track option available in most modern browsers that, if activated, sends a special signal to stop tracking user activity. You can find more information on how to enable Do Not Track for each supported browser here.

Personal Data processed: email address.

Place of processing: Malta – Privacy Policy – Opt Out.

Platform services and hosting

These services have the purpose of hosting and running key components of Corona Test Centre, therefore allowing the provision of Corona Test Centre from within a unified platform. Such platforms provide a wide range of tools to the Owner – e.g. analytics, user registration, commenting, database management, e-commerce, payment processing – that imply the collection and handling of Personal Data.
Some of these services work through geographically distributed servers, making it difficult to determine the actual location where the Personal Data are stored.

Webflow (Webflow, Inc.)

Webflow is a platform provided by Webflow, Inc. that allows the Owner to build, run and host Corona Test Centre. Webflow is highly customizable and can host websites from simple blogs to complex e-commerce platforms.

Personal Data processed: various types of data as specified in the privacy policy of the service.

Place of processing: United States – Privacy Policy – Opt out.

Shopify (Shopify International Limited)

Shopify is a platform provided by Shopify Inc. that allows the Owner to build, run and host an e-commerce website.

Personal Data processed: billing address; email address; first name; last name; phone number; shipping address.

Place of processing: Ireland – Privacy Policy.

Registration and authentication

By registering or authenticating, you allow Corona Test Centre to identify them and give them access to dedicated services.

Depending on what is described below, third parties may provide registration and authentication services. In this case, Corona Test Centre will be able to access some data, stored by these third-party services, for registration or identification purposes.

Some of the services listed below may also collect Personal Data for targeting and profiling purposes; to find out more, please refer to the description of each service.

Registration and authentication provided directly by Corona Test Centre

By registering or authenticating, you allow Corona Test Centre to identify you and give you access to dedicated services. The Personal Data is collected and stored for registration or identification purposes only. The data collected are only those necessary for the provision of the service requested by you.

Direct registration (Corona Test Centre)

You register by filling out the registration form and providing the Personal Data directly to Corona Test Centre.

Personal Data processed: date of birth; email address; first name; last name; phone number; various types of Data; ZIP/Postal code.

Social features

Inviting and suggesting friends (Corona Test Centre)

Corona Test Centre may use the Personal Data provided to allow you to invite your friends - for example through the address book, if access has been provided - and to suggest friends or connections inside it.

Personal Data processed: various types of data.

User database management

This type of service allows us to build user profiles by starting from an email address, a personal name, or other information that you provides to Corona Test Centre, as well as to track your activities through analytics features. This Personal Data may also be matched with publicly available information about you (such as social networks' profiles) and used to build private profiles that the Owner can display and use for improving Corona Test Centre.
Some of these services may also enable the sending of timed messages to you, such as emails based on specific actions performed on Corona Test Centre.

Intercom (Intercom Inc.)

Intercom is a user database management service provided by Intercom Inc. Intercom can also be used as a medium for communications, either through email, or through messages within Corona Test Centre.

Personal Data processed: Cookies; email address; Usage Data; various types of data as specified in the privacy policy of the service.

Place of processing: United States – Privacy Policy.

HubSpot CRM (HubSpot, Inc.)

HubSpot CRM is a user database management service provided by HubSpot, Inc.

Personal Data processed: email address; phone number; various types of data as specified in the privacy policy of the service.

Place of processing: United States – Privacy Policy.

Further information about Personal Data

Mercury Digital Assets Ltd

Mercury Digital Assets Ltd provide us with IT development services to operate and maintain the services that we own and operate for the benefit of its users.

Selling goods and services online

The Personal Data collected are used to provide you with services or to sell goods, including payment and possible delivery.

The Personal Data collected to complete the payment may include the credit card, the bank account used for the transfer, or any other means of payment envisaged. The kind of data collected by Corona Test Centre depends on the payment system used.

Your legal rights

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact us.

Right to complain to the ICO

You have the right to complain to the Information Commissioner's Office (the "ICO") if you are not satisfied with the way we use your information. You can contact the ICO by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

Cookie Policy

Corona Test Centre uses trackers (such as cookies, unique identifiers, web beacons, embedded scripts and other technologies which enable the tracking of users). To learn more, you may consult the Cookie Policy.

Additional information about Data collection and processing

Legal action

Your Personal Data may be used for legal purposes by us in Court or in the stages leading to possible legal action arising from improper use of Corona Test Centre or the related Services.

Additional information about your Personal Data

In addition to the information contained in this privacy policy, Corona Test Centre may provide you with additional and contextual information concerning particular Services or the collection and processing of Personal Data upon request.

System logs and maintenance

For operation and maintenance purposes, Corona Test Centre and any third-party services may collect files that record interaction with Corona Test Centre (System logs) use other Personal Data (such as the IP Address) for this purpose.

Information not contained in this policy

More details concerning the collection or processing of Personal Data may be requested from us at any time. Please see the contact information at the beginning of this document.

Changes to this privacy policy

We reserve the right to make changes to this privacy policy at any time by notifying you on this page and possibly within Corona Test Centre and/or - as far as technically and legally feasible - sending a notice to you via any contact information available to us. It is strongly recommended to check this page often, referring to the date of the last modification listed at the bottom.

Should the changes affect processing activities performed on the basis of your consent, we shall collect new consent from you, where required.

Latest update: April 7, 2022.

‍