Privacy Notice

Version 2026-07-16.3-beta

1. Controller and contact

The controller for personal-data processing is info@genoquill.com, address: Graz.

2. Data processed

Depending on use, the service processes: the uploaded genome, variant, or genotype file including genetic data contained in it; technical file and processing metadata; selected language; recorded consents; the private job credential; and, optionally, an email address for status and result notifications. Genetic data can also constitute health data under the GDPR.

3. Purposes and legal bases

Data is processed to validate the file technically, create the research annotation, provide results through the private link, protect the service from misuse, and send optional notifications. Genetic and potentially health-related data is processed solely on your explicit consent under GDPR Articles 6(1)(a) and 9(2)(a). Consent is voluntary; without it the service cannot process the file. Necessary technical security and error logs are processed for the legitimate interests of operating and securing the service under Article 6(1)(f).

4. Recipients, EU processing, and third-country transfers

File validation, annotation, and report generation take place on infrastructure operated for this service within the European Union. Carefully selected hosting, infrastructure, and email providers may process data as processors to provide the service. Genome files and variants are not sent to Ensembl, ClinVar, the GWAS Catalog, or other external research databases. Emails contain no genome file or genetic findings; they contain only status information and, where applicable, the private result link. No transfer of genetic data to third countries is intended. External links in the downloaded report open only when you choose to click them; your browser then sends the displayed variant identifier to the destination provider.

5. Retention and deletion

Invalid input is deleted after failed validation. After successful or failed annotation, source and work data are deleted. Results, the private job credential, and related job metadata are automatically deleted 7 days after upload. An optional notification email address is removed from the job after successful result notification; temporary delivery failures receive limited retries. Technical security and server logs are processed only to the extent necessary and according to the applicable operational and security retention periods.

6. Your rights

Subject to the GDPR, you have rights of access, rectification, erasure, restriction, portability, and objection. You may withdraw consent at any time for the future; this does not affect the lawfulness of processing before withdrawal. Write to info@genoquill.com. If consent is withdrawn while processing is running, the job cannot continue and will be deleted.

7. Right to complain

You have the right to lodge a complaint with a data-protection supervisory authority. In Austria, this is the Austrian Data Protection Authority.

8. Automation and security

No solely automated decision produces legal or similarly significant effects. Transfer is encrypted. Results are protected by a random private link; treat it like a password. The service does not sell genetic data, use it for advertising, or create personal disease, PRS, or lifestyle-risk scores.

9. Cookie-free audience measurement

To evaluate use of the service, only aggregate page views per calendar day, public page, and language are counted. Known automated requests are counted separately. No cookies or similar storage technologies are used, and no IP addresses, device identifiers, full referrers, or user-agent strings are stored. The counters cannot be linked to individual people or genome jobs. The legal basis is the legitimate interest in securely operating and improving the free beta service under GDPR Article 6(1)(f).