01 / Controller and contact
GENRA SA, Hochbergerstrasse 60, 4057 Basel, Switzerland, is responsible for the personal information it processes through this website and in connection with its enquiries and customer relationships.
For privacy questions or to exercise a right, email contact@genra.ch with “Privacy” in the subject line, or write to the address above. We may ask for proportionate information to verify your identity before disclosing or changing a record.
This policy describes this GENRA website. Services used to host the site or authenticate access may also process information under their own privacy notices.
02 / Information we process
- Enquiries and correspondence: organisation, work email address, any name or contact details you provide, sequence and modification information, requested mass and purity, and the contents of follow-up communications.
- Customer and project records: relevant business contacts, agreed specifications, correspondence, transaction information and documentation needed to perform and record a project.
- Certificates and uploaded images: sample and lot details, test results, named signatories, report identifiers, chromatograms and vial photographs. Much of this is technical rather than personal information, but it may identify a person or contain information embedded in a file.
- Access and security information: technical request information, including IP addresses handled by the hosting service, device/browser information, security events and short-lived verification sessions. The application uses IP-derived security counters rather than storing a raw IP address in those counters.
- Authenticated access: the hosting platform may provide a signed-in user identifier, email address and, when available, display name. These are used where access requires sign-in, including administrator authorisation.
Please do not include patient records, personal health information or other unnecessary sensitive information in an enquiry or image. Remove unnecessary personal information and image metadata before uploading. Images are retained in their original format rather than automatically stripped of embedded metadata.
03 / Purposes and legal grounds
We use information to assess and answer enquiries, agree and perform projects, provide documentation and certificate access, protect the service, maintain necessary records, and handle rights requests or disputes.
Where the EU General Data Protection Regulation applies, the relevant grounds are steps requested before a contract and performance of a contract (Article 6(1)(b)); compliance with applicable legal obligations (Article 6(1)(c)); and legitimate interests (Article 6(1)(f)) in communicating with professional contacts, administering projects, preventing misuse and protecting legal rights. For an employee or representative of a customer organisation, business-contact processing will ordinarily rely on legitimate interests rather than a contract with that individual.
If we request consent for a separate optional purpose, we will describe that purpose when collecting it. You may withdraw that consent for the future. Submitting an enquiry is not consent to unrelated marketing.
04 / Enquiry delivery and required fields
The enquiry form identifies the information needed to assess your request. You are not obliged to submit it, but without the relevant contact and technical information we may be unable to respond or assess feasibility.
When online delivery is enabled, the form sends the entered details to GENRA’s contact mailbox through the configured email-delivery service, Resend. If online delivery is unavailable, the form displays an error and does not confirm submission. You may instead email us directly. Email correspondence is also processed by the services used to operate the sender’s and recipient’s mailboxes.
The website does not make automated decisions with legal or similarly significant effects about you. Technical abuse checks may restrict repeated requests; you can contact us if you believe a request was blocked incorrectly.
05 / Certificates, sessions and local PDF generation
Report numbers and access codes are checked on the server. Access codes are checked using salted hashes. An encrypted copy is also retained so authorised certificate downloads can include the code in the PDF. Anyone you share that PDF with can use its report number and access code to verify the certificate. An authorised administrator can access drafts; issued certificates require the applicable access credentials or authorised administrator access.
The application uses a necessary certificate-session cookie, genra_report, with a 30-minute validity period. It allows the matching certificate and its images to be viewed during that session. It is not an advertising cookie. Expired session records and security counters are removed during application housekeeping; expiry does not imply instantaneous removal from every backup or service log.
PDF exports and their QR codes are generated in your browser from the authorised record. The QR code contains the specific certificate URL, not an access code. Downloaded files are then under the control of the person who saves or receives them. We cannot delete copies from their devices by withdrawing website access.
06 / Cookies, analytics and platform services
The GENRA application does not currently add advertising pixels, behavioural analytics, marketing cookies or cross-site profiling. It uses necessary functionality for certificate access. The hosting and sign-in platform may set its own necessary security or authentication cookies and maintain operational logs.
Browser settings can restrict cookies, but doing so may prevent authenticated or certificate features from working. If optional tracking is introduced, the applicable notice and consent controls will be provided before it is enabled where required.
07 / Recipients and service providers
Access is limited to persons and providers who need the information for the relevant purpose. Categories of recipients may include authorised GENRA personnel; hosting, storage, authentication and email providers; professional advisers; and authorities or other parties where disclosure is legally required or necessary to establish or defend rights.
This version of the website is delivered through OpenAI’s Sites platform and Cloudflare hosting and storage infrastructure. Certificate records use the hosting platform’s database and object storage. Email delivery uses Resend when configured. Project-specific testing or supply partners, if involved, must be addressed in the relevant engagement and receive only the information required for their role.
Provider notices: OpenAI, Cloudflare and Resend. We do not sell personal information or use enquiry information for targeted advertising.
08 / International processing
Hosting, authentication and email services operate internationally, including in the United States. Processing is not represented as being confined to Switzerland. The countries and arrangements relevant to a particular service depend on the provider, its subprocessors and the applicable account configuration.
Where a disclosure abroad requires safeguards, the applicable arrangement must rely on a recognised adequacy decision, appropriate contractual safeguards or another lawful basis. You may contact us for information about the recipients, countries and safeguards relevant to your data, including how to obtain a copy of applicable safeguards subject to necessary redactions. This policy does not itself create a data-transfer agreement or certify a provider’s compliance.
09 / Retention and security
We retain enquiry information for as long as needed to handle the enquiry and relevant follow-up. Project and correspondence records may need to be retained for performance, traceability, applicable accounting or other legal obligations, and the establishment or defence of legal claims. The appropriate period depends on the record, the engagement and the applicable requirement; there is no single retention period for every type of data.
Certificate records and uploaded images remain stored while needed for the relevant documentation and verification purpose, subject to applicable retention requirements. Requests to correct, restrict or delete personal information can be made through the contact above. A request is assessed against any continuing obligations or rights before records are removed. Backup and provider-log retention may differ from active application records.
Measures used by the application include server-side access controls, restricted administrator access, hashed certificate access codes, session expiry, transport encryption and protections against repeated verification attempts. No internet service or downloaded document can be guaranteed completely secure.
10 / Your rights and complaints
Depending on the applicable law and circumstances, you may request access to your personal information, correction of inaccurate data, deletion, restriction of processing, or a copy in a portable format. Where processing is based on legitimate interests, you may object on grounds relating to your situation. You may withdraw consent where consent is the basis for the processing, without affecting the lawfulness of earlier processing.
These rights may be limited by applicable law, the rights of others or a lawful need to retain information. We will explain any relevant limitation and respond within the applicable legal timeframe.
You may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC). Where the GDPR applies, you may also lodge a complaint with the competent supervisory authority, including in the EU/EEA country of your habitual residence, workplace or the alleged infringement. Contacting GENRA first is helpful but is not a condition for contacting an authority.
11 / Changes to this policy
We will update this policy when the service or relevant processing changes. The date above identifies the current version. Material changes will be communicated in an appropriate manner where required. A later version does not, by itself, authorise an incompatible new use of information already collected.