Privacy Policy

Last updated: 12/10/2026

MB3 BIOSTATISTICS (the “Company”, “we”, “our”) has developed an algorithm for modeling cell culture processes in a controlled environment, based on cell datasets of non-human origin. As an authorized user of one of Company’s customers, you have access to this algorithm via the present website mb3-biostatistics.com (the “Site”).

This Privacy Policy explains how we collect, use, and protect your personal data as data controller when you use our Site.

1. Personal data we collect

Your personal data is either provided directly by you while you use the Site or by your employer as part of its agreement with us. We only collect the personal data strictly necessary to provide our services to our customers and operate our Site:

• Account Data: Name, surname, email address and authentication-related information received from Microsoft Entra ID when you sign in to the Site. Authentication is exclusively handled by Microsoft Entra ID. We do not collect or store your Microsoft password or other login credentials.
• Connection and Technical Data: IP addresses, terminal equipment and port, operating system, system configuration data, device type, language preference.
• Usage Data: Time and day of each login, all actions performed on the Site.
• Communications with us: When you report a concern with our Site or request assistance, we collect the content of your communications with us, the time and day of communication, and any other information you may decide to share with us.

We do not use any tracking cookies, advertising cookies, or third-party analytics. Only essential functional cookies are used to maintain user sessions.

2. Purpose of data processing

We process your personal data for the following purposes:

• Creating and managing your user account
• Providing you access to the Site
• Offering customer support and technical assistance
• Maintaining and securing the platform
• Defend and assert our rights before the authorities (civil, criminal or administrative)

3. Legal basis for processing

Data processing is carried out based on:

• Our legitimate interest in (i) fulfilling our contractual undertakings towards our customers, (ii) maintaining platform security and asserting and defending our rights (Article 6.1.f)
• Compliance with legal obligations (where applicable)

4. Data retention

• User account data: retained as long as the account is active, then deleted after 12 months of inactivity
• Technical logs: stored for 6 months for security purposes
• Support inquiries: stored for 24 months

5. Subprocessors and data recipients

We use the following service provider to host and process your data:

• Microsoft Azure (Microsoft Ireland Operations Ltd.)

Used for hosting, database, and backup services.

Microsoft acts as a GDPR-compliant data processor. Data is hosted in the European Union (Azure region: France).

We use the following service provider to authenticate users and manage access to the Site:

• Microsoft Entra ID (Microsoft)

Microsoft Entra ID is used to authenticate users and manage access to the Site. When you sign in, Microsoft processes authentication-related information and may provide us with certain profile information, such as your name, surname, email address and user identifier, depending on your organization's configuration. Authentication is handled by Microsoft Entra ID. We do not collect or store your Microsoft password. Microsoft processes personal data in accordance with its applicable privacy terms and data protection commitments. Depending on your organization's configuration and the services used, data may be processed or stored in different locations. Appropriate safeguards apply where required by applicable data protection law.

For more information, please refer to Microsoft's privacy statement: https://privacy.microsoft.com/privacystatement

We use the following third-party service provider for payment and subscription management:

• Stripe, Inc.

Stripe is our payment processor and subscription billing provider. When you make a purchase or subscribe to a plan, your payment information (such as name, email address, and payment details) is processed directly by Stripe in accordance with its own privacy policy: https://stripe.com/privacy

Stripe may process your data outside of the European Union. In such cases, it uses appropriate safeguards, such as Standard Contractual Clauses.

We may also share your personal data only when strictly necessary:

• With your employer, as part of our agreement with our customers;
• With our counsels, for compliance with our statutory obligations, in particular in terms of accounting, auditing and internal control (legal, financial, audit);
• With authorities (governmental authorities, courts, and similar third parties) when required by law or an applicable order of any kind;
• With an affiliate of our Company or a third party wishing to invest in, merge with, buy, or take over our Company.

6. Data transfers outside the EU

We do not transfer your data outside of the European Union, unless exceptionally required by Microsoft. In such cases, appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) issued by the European Commission.

7. Your rights

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access your personal data
• Request correction or deletion of your data
• Request the erasure of your personal data
• Restrict or object to data processing
• Request data portability
• Withdraw your consent at any time (if applicable)
• Post-mortem processing of personal data: You may also provide your instructions regarding the retention, deletion or disclosure of your personal data after your death. These instructions may be general or specific.

9. Data controller

MB3 BIOSTATISTICS SAS
465 Route de Saint-Hilaire, 74570 GROISY, France
Email: contact@mb3-biostatistics.com
Company Registration No. (SIREN): 938621596

10. Complaints

If you believe your data protection rights have been violated, you can lodge a complaint with your local data protection authority.

In France, this is the CNIL (Commission Nationale de l’Informatique et des Libertés): www.cnil.fr