1. Who is responsible
The controller responsible for processing personal data on this website within the meaning of the GDPR is:
Dr. Mohamad Toutounji
Molgenium, freelance pharmaceutical consultancy
Düsseldorf, Germany
Email: info@molgenium.com
Phone: +49 162 608 8710
A postal address for correspondence and the service of documents is available on request by email.
Data protection officer: as a small freelance consultancy, Molgenium is not required to appoint a data protection officer. Please send any data protection question directly to info@molgenium.com.
2. Overview of processing
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Delivering and securing the website | IP address, date and time, page requested, browser and operating system, referrer | Art. 6(1)(f): legitimate interest in a secure, working website |
| Answering enquiries | Name, email, phone number, country, message | Art. 6(1)(b) where the enquiry relates to a contract; otherwise Art. 6(1)(f) |
| Customer accounts | Name, company, email, password (stored only as a secure hash) | Art. 6(1)(b): contract |
| Orders, quotes and invoices | Contact details, shipping address, order details, invoices | Art. 6(1)(b): contract; Art. 6(1)(c): tax and commercial record-keeping |
| Courses and online learning | Registrations, learning progress, personal notes | Art. 6(1)(b): contract |
| Appointments and support requests | Selected expert, topic, date and time, messages | Art. 6(1)(b): contract or pre-contractual steps |
We do not use your data for automated decision-making or profiling, and we do not sell personal data.
3. Visiting our website
When you visit our website, our hosting provider's servers automatically record technical information that your browser sends (server log files): IP address, date and time of the request, the page requested, the amount of data transferred, the referring page, and browser and operating system. We need this information to deliver the website, keep it stable and secure, and investigate misuse.
Log files are deleted automatically after a short retention period unless a security incident requires us to keep them longer. Our website is hosted by a professional hosting provider that processes this data on our behalf under a data processing agreement (Art. 28 GDPR).
We do not use analytics, advertising or tracking tools on this website.
4. Contacting us
If you contact us using a form on our website, by email or by phone, we process the details you give us (such as your name, email address, phone number, country and message) to answer your enquiry and handle any follow-up. Messages sent through our contact forms are stored in our database.
Where your enquiry relates to a contract or to steps before entering into one, the legal basis is Art. 6(1)(b) GDPR. In all other cases it is our legitimate interest in responding to enquiries addressed to us (Art. 6(1)(f) GDPR).
The same applies to the service order form on our Biotech Services page, which collects your company, contact person, email, phone number, requested service and project description.
5. Customer accounts
You can create a customer account to register for courses, place orders, book appointments and submit support requests. For this we process your name, company or organization, email address and password. Passwords are never stored in readable form, only as a secure cryptographic hash.
The legal basis is Art. 6(1)(b) GDPR. You can ask us to close your account at any time. We then delete your account data unless we are legally required to keep certain records (see section 13).
6. Orders and quote requests
When you place an order or request a quote for products such as RNA synthesis raw materials, we process your contact details, shipping address, the products and quantities ordered, any notes you add, and the resulting order and invoice records. We use this data to process and deliver your order, invoice you and handle any warranty claims (Art. 6(1)(b) GDPR), and to meet our tax and commercial record-keeping obligations (Art. 6(1)(c) GDPR).
To deliver your order we pass your name and shipping address to the carrier we use for that shipment.
7. Courses and online learning
When you register for a professional course we process your registration, its status and payment details. When you use our online learning area we also store your learning progress and any notes you write, so you can pick up where you left off. The legal basis is Art. 6(1)(b) GDPR.
Some lessons include videos embedded from YouTube; see section 11.
8. Appointments and support requests
If you book a consultation or submit a support request through your account, we process the expert, topic, date and time you select, and the messages exchanged, to provide the service you have asked for (Art. 6(1)(b) GDPR).
9. Emails we send you
We send transactional emails, such as confirmations of enquiries, orders and course registrations, and invoices. These are part of providing our services (Art. 6(1)(b) GDPR). We do not send marketing emails or newsletters without your separate consent. Our emails are sent from our web server operated by our hosting provider.
10. Cookies and browser storage
We use only what is technically necessary to provide the services you request:
- Session cookie: when you sign in, a session cookie keeps you logged in while you move between pages. It is deleted when you close your browser or log out.
- Cookie preference: when you accept or decline cookies in the banner, a single cookie (
mg_consent) remembers your choice for one year so we don't ask again. If you decline, you are not tracked. You can change your choice at any time via "Cookie settings" at the bottom of every page. - View preference: on the product and course catalog pages, your browser's local storage remembers whether you prefer a grid or a list view. This stays on your device and is not sent to us.
Because these are strictly necessary for the service you have requested, no consent is required (§ 25(2) German Telecommunications Digital Services Data Protection Act, TDDDG). We do not use advertising or analytics cookies.
11. Third-party content
To display our website correctly and efficiently, some pages load content from external providers. When this happens, your browser connects to the provider's servers and your IP address is transmitted to them. The legal basis is our legitimate interest in a reliable, well-presented website (Art. 6(1)(f) GDPR).
- Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): web fonts used for consistent typography.
- Content delivery networks for software libraries used by our pages: cdnjs (Cloudflare, Inc.), jsDelivr, unpkg and the Tailwind CSS CDN.
- Google Maps (Google Ireland Limited): the map on our contact page.
- YouTube (Google Ireland Limited): videos embedded in some course lessons. YouTube may set cookies when you play a video.
Some of these providers may process data in the United States. See section 12 for the safeguards that apply.
12. Recipients and transfers
At Molgenium, only Dr. Mohamad Toutounji and, where a project requires it, experts working with us under a confidentiality obligation have access to your data, and only to the extent needed for the purposes above. We also use service providers who process data on our behalf under data processing agreements (Art. 28 GDPR), in particular our hosting provider and email provider. Where required, we share data with carriers, tax advisors, auditors or public authorities.
Where data is transferred outside the European Economic Area, we rely on an adequacy decision of the European Commission (for the United States, the EU–U.S. Data Privacy Framework for certified companies) or on the European Commission's Standard Contractual Clauses.
13. How long we keep data
We keep personal data only as long as we need it for the purpose it was collected for. Enquiries are deleted once they have been fully dealt with, unless they lead to a contract. Account data is deleted when you close your account. Where statutory retention periods apply, we keep the relevant records for that period: generally 6 years for business correspondence and 10 years for invoices and accounting records (§ 257 German Commercial Code, § 147 German Fiscal Code).
14. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data deleted (Art. 17) or its processing restricted (Art. 18);
- receive your data in a portable format (Art. 20);
- withdraw any consent you have given, with effect for the future (Art. 7(3)).
Right to object (Art. 21 GDPR): where we process your data on the basis of our legitimate interests, you may object at any time for reasons arising from your particular situation. We will then stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise or defend legal claims.
To exercise your rights, email info@molgenium.com. You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf.
15. Security
Our website uses TLS encryption, which you can recognize by "https://" in your browser's address bar. We protect the data we hold with technical and organizational measures appropriate to the risk, including access controls and secure password storage.
16. Changes to this policy
We may update this policy when our services or the law change. The current version is always available on this page, with the date of the last update shown at the top.