Privacy Policy
1. Who we are
GxP Clinic provides pharmaceutical regulatory consulting services, including Qualified Person (QP), Responsible Person (RP) and Responsible Person for Import (RPi) services, GxP auditing, and quality management system support.
For the purposes of UK data protection law, gxpclinic is the data controller for personal data collected through this website.
Contact for any privacy matter: Email: info@gxpclinic.com Post: 16 Queens Gardens, Hendon, NW42TR
GxP Clinic operates as an unincorporated business at the date of this notice. This page will be updated to reflect the registered company details once incorporation is complete.
2. What personal data we collect
We collect only what you choose to give us. Through the enquiry form on this site, that is:
- Your full name
- Your company or organisation
- Your email address
- Your telephone number
- The service you are interested in
- The content of your message
We do not use analytics, advertising or tracking tools on this website. We do not collect behavioural data, build profiles, or use automated decision-making.
Our web host records standard server log data, including IP addresses, as a normal part of operating and securing the site.
3. Why we use it and our lawful basis
| Purpose | Lawful basis |
| Responding to your enquiry | Legitimate interests — replying to someone who has contacted us about our services |
| Preparing a proposal or scope of work | Legitimate interests, moving to contract performance if you engage us |
| Keeping a record of business correspondence | Legitimate interests, and legal obligation where retention is required |
| Site security and abuse prevention | Legitimate interests |
If we later send you anything that counts as marketing, we will ask for your consent first and you will be able to withdraw it at any time.
4. Confidentiality of regulatory information
Enquiries to a regulatory consultancy often reference inspection findings, licence status, product details or compliance problems. We treat all such information as confidential.
Please do not send confidential technical, commercial or inspection-related material through the website form. Send an initial enquiry, and we will agree a secure route and a confidentiality agreement before you share anything sensitive.
5. Who we share it with
We do not sell or rent personal data. We share it only with:
- Our web hosting provider, which stores the site and its database
- Our form plugin provider — [FILL — plugin name], which processes form submissions
- Our email provider, which delivers and stores your enquiry
- Professional advisers or regulators, where we are legally required to disclose
Each of these acts as a processor on our instructions under a written agreement, or is a controller in its own right where the law requires disclosure.
6. International transfers
Some of our providers may process data outside the UK. Where that happens, we rely on UK adequacy regulations or on the International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, together with any additional safeguards needed.
7. How long we keep it
- Enquiries that do not lead to an engagement: 12 months from your last contact with us, then deleted
- Enquiries that lead to an engagement: for the duration of the engagement and 6 years afterwards, reflecting the limitation period for contractual claims
- Records connected to QP certification or regulatory activity: for the period required by the applicable GMP or GDP retention requirements, which may be longer
- Server logs: as retained by our hosting provider under its own policy
8. Your rights
Under the UK GDPR you have the right to:
- Be informed about how we use your data
- Request a copy of the data we hold about you
- Have inaccurate data corrected
- Ask us to delete data, where no overriding obligation applies
- Ask us to restrict processing
- Object to processing based on legitimate interests
- Request portability of data you gave us
- Withdraw consent, where we relied on it
To exercise any of these, email info@gxpclinic.com. We respond within one month.
If you are not satisfied with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
9. Security
We use HTTPS across the site, keep WordPress and its plugins updated, restrict administrative access, and use strong authentication. No transmission over the internet is completely secure, which is why we ask you not to send confidential regulatory material through the form.
10. Changes to this notice
We review this notice when our processing changes. The date at the top shows the current version.