Privacy Policy.

1.  Introduction

VolitionRx Limited and its subsidiaries throughout the world (collectively referred to as “Volition”) take data privacy seriously.  This Privacy Policy (the “Policy”) is for users of our public websites (“Websites”) and other individuals we interact with for our commercial or business purposes.

During our activities, we may process personal data about you. We process this data as data Controller.

Personal data means any information relating to an identified or identifiable natural person. Your personal data includes your unique identifiers (name, phone number, email address, postal address etc.), and information about your characteristics, conditions or behavior that is associated with one of your identifiers or could otherwise reasonably be linked to you.

This data is collected directly from you when:

• you complete forms, set up accounts or make purchases on our Websites
• you correspond with us by email, post, telephone, or other means
• you interact with our Websites through automated technologies such as cookies, server logs, and similar technologies (more detail on this is available in our Cookie Policy – https://volition.com/cookies-policy).

We also process data obtained from third parties or publicly available sources. Where we obtain personal data from third parties, those sources may include: business partners and distributors, event organizers and sponsors, publicly available directories and databases, social media platforms, and data analytics or marketing service providers. We will inform you of the specific source – where required by applicable law.

This Policy describes the types of personal data we may collect about you and how it is being processed, including why we collect this data, how we use and share it, and how we keep it safe.  It also explains related rights and choices you may have with respect to your data being processed by us.

Volition is committed to protecting and respecting your privacy and personal data.  If you have any questions, please get in touch with us here.

2.  Who we are

VolitionRx Limited is a Delaware corporation headquartered in Austin, Texas, U.S. Our registered address is 1489 West Warm Springs Road, Suite 110, Henderson, Nevada, 89014 – United States.

Volition also has offices in Belgium, United Kingdom, Singapore and in the U.S.

• For any request or questions pertaining to personal data processing, please contact Volition directly at privacyteam@volition.com.
• Data Protection Officer: Belgian Volition SRL has appointed a Data Protection Officer (the “DPO”).

Belgian Volition SRL
c/o Lexing Law Firm
Attn:  Ms. Fanny Coton
Boulevard d’Avroy, 280 – 4000 Liège
+32 4 229 20 10

privacy@volition.com

 

• If you would like more information, or if you wish to lodge a complaint, you may directly contact the competent Data Protection Authority (DPA) in your country.

3.  When and how we collect personal data

We collect personal data in the following circumstances:

A. When you visit any of our Websites

When you visit our Websites, information is automatically collected. This may include information like your IP address and other technical information. We may also collect information about how your device has interacted with our Websites.

We use this information for our internal analytics purposes and to improve the quality and relevance of our Websites to our visitors. Indeed, we use that information to ensure that content from our websites is presented in the most effective manner for you and for your computer. Some of this information may be collected using cookies and similar tracking technology, as explained further in our Cookie Policy – https://volition.com/cookies-policy.

This data may be processed by third party service providers and processors we use in connection with the services they provide to us, including supporting us in areas such as IT platform management or support services, infrastructure and application services, marketing and data analytics.

If you are in a jurisdiction that requires opt-in consent before placing non-essential cookies and tracking technologies in your browser, we will request your consent before such cookies are placed in your browser through our sites.  In addition, if you have configured your browser to send a “Do Not Track” or Global Privacy Control signal, we will honor that signal as your automated request to opt-out of non-essential cookies and tracking technologies.

B. When you subscribe to receive news and information from Volition

Categories of data – this may include your name, surname, email address, title, phone and business role.

Purpose of the processing – may provide news and marketing updates that aims to inform people about:

• our services and goods;
• our events ;
• our activities in general.

Legal basis (UK and EEA)

• For Volition’s customers: We rely on our legitimate interest in maintaining and developing our commercial relationships with existing customers by keeping them informed of relevant products, services, events and developments. We have assessed that this interest is not overridden by customers’ rights and freedoms, given that customers can reasonably expect such communications and have a simple means to opt out at any time.
• For non-customers: The processing of your personal data is based on your consent, including for people who may have previously registered to one of our sponsored or organized events.

Recipients of the data – This data can be processed by our emailing service providers including: Equisolve, Salesforce, Brevo and WordPress.

Retention period – We will retain your data relating to news and information purposes as applicable (i) for the period of time legally permitted, or (ii) until you unsubscribe actively taking the initiative to inform us you wish to stop receiving communications from Volition, or (iii) until VOLITION decides to terminate its news and marketing updates service .

As specified above, in any event, you may opt-out at any time by using the unsubscribe link in the email or by sending an email to privacyteam@volition.com.

 C. When you set up an account with us or purchase our products or services through our Website or otherwise

Categories of data – We process your contact details (name, title, postal address, email address and telephone number, title, business role), delivery address username, activity on site and purchasing data. Additionally, as part of our human or veterinary research activities and services, we might collect and process (i) sensitive health related data from human patients/participants to clinical research or clinical trials supervised by Volition in compliance with GDPR or other requirements; and (ii) personal data of any legal owner of a non-human animal undergoing tests developed by Volition or taking part in a clinical research/study supervised by Volition .

Purpose of the processing – We process your data in order to provide you with the product(s) or service that you ordered from us and communicate with you about it.

We also process your data to notify you about changes to our products and services.

Legal basis (UK and EEA) – The processing of such data is necessary in order to perform the contract between you and Volition.

Recipients of the data – These data may be accessible and shared with Volition’s affiliates and/or with external entities/organizations involved in the research projects conducted by Volition.

Retention period – This data is stored for the period permitted by applicable law after the end of the contractual relationship and in accordance with our Data Records Retention policy following GDPR requirements.

D. When you attend a Volition organized or sponsored event

Categories of data – This may include your name, physical address, business title, role, phone number and email address.

Purpose of the processing – This data is necessary to allow you to sign you up for the event, provide you with the information on such event and give you access to the event.  We may also use it to follow up with you after an event and will add you to our news and other marketing databases, if you have consented that we can do so on the event registration form.

This data is collected directly from you when you fill in the registration form.

Legal basis (UK and EEA) – The personal data processed is essential for the execution of the contract under which we organize events or we process it with your prior consent.

Recipients of the data – Your data may be processed by our IT services,  commercial , research and other Volition team members for the purposes identified above. This data will be stored and managed using our Customer Relationship Management (CRM) solution/software including without being limited to it, Salesforce.

Retention period – Data may be retained for the period permitted by applicable law after the end of the contractual relationship and in accordance with our Data Records Retention policy following GDPR requirements.

E. Recording and sharing of the Volition organized or sponsored event

Categories of data – This may include videos and images (photographs or screenshots) taken during the event organized by Volition as well as the names of the speakers who contribute to the event.

Purpose of the processing – Volition may keep a recording and/or photographs (or screenshots) of the events organized and share these images on its different communication channels and social media accounts for multiple purposes:

• Archival purposes;
• Accountability purposes;
• Monitoring and Improvement of our activities;
• Promotion and marketing of our activities
• sharing of the recordings/images to participants who want to rewatch the event or people who were not able to attend the event.

Legal basis (UK and EEA) – We rely on our legitimate interest in documenting, archiving and promoting our events and activities for accountability, quality improvement and marketing purposes. We have assessed that this interest is proportionate and not overridden by participants’ rights and freedoms, given that participants are notified of recording at the time of the event and retain the right to object at any time in accordance with GDPR requirements. Where participants are identifiable in recordings or images that are shared publicly, and where required by applicable law, we will seek consent prior to such publication.

Recipients of the data – Your data may be shared among Volition staff, people participating in the event or with the public via our Website(s), social media accounts or other media (e.g. news reports, marketing brochures etc.).

Retention period – Recordings and images will be retained for the period permitted by applicable law and in accordance with our Data Records Retention policy following GDPR requirements, unless a longer retention period is required for legal or regulatory reasons. Nevertheless, you may object to the continued retention or use of your data (image or recording) at any time by contacting us at privacyteam@volition.com.

F. When you engage with us on social media

Categories of data – We process data relating to your interaction with Volition’ accounts on social media. This may include data related to your account, data related to the content shared or communications you have with others on our accounts.

Purpose of the processing – The data that you communicate to Volition when  interacting with our social networks profiles or accounts are or could be processed jointly (i) by Volition and (ii) separately by the social media platforms you may have used through their respective administrator of the  account for the collection of certain data by means of cookies. This data may be collected with a view to help for the improvement of the social media platforms of their respective advertising system, or for the obtaining of statistics of audience of the account.

Legal basis (UK and EEA) – These data will be processed by Volition on the basis of our legitimate interest in understanding reach and engagement of our social media presence in order to improve and promote our communications and activities. We have assessed that this interest is not overridden by users’ rights and freedoms, as the data is processed using pseudonymized identifiers and aggregate reporting   format and is inherent to the use of social media platforms.

Recipients of the data – The data collected by Volition when you engage on our social media accounts  are not transmitted by Volition to any third party as they are processed by Volition only.

Retention period – Audience statistics and aggregated social media data are retained (i) for the period of time permitted by applicable law in accordance with our Data Records Retention policy following GDPR requirements, and (ii) in line with the standard data retention periods applied by the relevant social media platforms. Individual interaction data visible on our social media profiles (such as comments) is retained for as long as our account exists or until delete your interaction, whichever is earlier. Please refer to the privacy policy of the relevant social media platform for further details of their own data retention practices.

On our Websites, we use Google services and tools (such as Google Analytics or Google Tags) which purpose is strictly limited to measuring advert engagement (click-throughs and conversions) to our Websites (e.g. our on-line shop).   Under this process, there is no use for profiling, personalized advertising, or cross-site tracking beyond this stated purpose, and as such, we do not collect any personal data about the visitors who click through, and don’t use it to follow-up with visitors from a marketing standpoint or to otherwise sell, transfer or commercially use personal data.

• For users in the European Union (EU), we have implemented Google Consent Mode v2, which is a Google-provided framework that allows our Website(s) to communicate your consent preferences directly to Google’s tags and services, so that Google adjusts its data collection behaviour in accordance with the choices you make. If you decline consent, the relevant parameters are set to “denied” and Google will not place measurement cookies or collect identifiable data about your visit. We operate Google Consent Mode in Basic Mode, meaning no data pings are sent to Google prior to or in the absence of your consent.
• For users in the US, we have enabled Google’s Restricted Data Processing (RDP) setting, which means that Google is contractually prohibited from using any data collected through this service for any purpose other than delivering the advertising measurement service to us. Google may not use this data for its own advertising products, to build user profiles, or for any other purpose.

 

Moreover, for users in the US, Volition is also subject to Google Data Processing Amendment terms which formalize Volition’s compliance with GDPR while using Google ads services (as described above). The respective Privacy Policy of each social media platform used by Volition can be found by clicking on the following links:

• Facebook
• X (formerly Twitter)
• Linkedin
• Instagram
• Google Analytics (https://policies.google.com/privacy?hl=en-US)

G.Security and Maintenance of Volition’s Physical Facilities

Categories of data – video surveillance footage.

Purpose – Your data might be processed for and to the extent necessary for the security of our infrastructures.

Legal basis – We process your personal data on the basis of our legitimate interest in maintaining the physical security of our premises, protecting our staff, visitors and assets, and preventing and detecting crime. We have assessed that this interest is not overridden by individuals’ rights and freedoms, given the limited and proportionate nature of CCTV monitoring and the short retention period applied.

Recipients of the data – These images are not normally transmitted to any third party. They could, however, be transferred to the competent police department/authorities, upon legally valid request and/or in the context of a formal investigation.

Retention period– Video surveillance images are not kept for more than thirty (30) days unless it can contribute to the proof of an offence, damage or nuisance, in which case they are retained for as long as reasonably necessary.

H. When you contact us

Categories of data – When submitting a contact request via our Websites or when you contact us by any other means, we ask for your name, organization, email address, title and business role.

Purpose of processing – Data is collected when you contact us by e-mail, phone or mail to support our legitimate business activities in responding to and supporting your enquiry (for example, contracting with you to provide a product or a service).

Legal basis (UK and EEA) – We process this data on the basis of our legitimate interest in managing and responding to enquiries, supporting our commercial activities, and maintaining effective communication with individuals who contact us.  Where an enquiry leads to the formation of a contract between you and Volition, processing will additionally be based on the performance of that contract.

Recipients of the data – This data is not shared with any third party except our subsidiaries if necessary or otherwise with your consent.

Retention period – We retain contact data request for a period permitted by applicable laws from the date of receiving your original enquiry in accordance with our Data Records Retention policy following GDPR requirements.  After this period, the data will be deleted unless it has given rise to a contractual or ongoing relationship, in which case the relevant retention period for that relationship will apply.

4. Statistics

The data you create when you visit our Website(s), register to an event, or subscribe to our news and marketing updates may be used by Volition for statistical purposes.

We collect, use and share such aggregated statistical data on the proportion of Website visitors using the various parts and features of the Website.

5. Sensitive data

We do not routinely collect sensitive personal data such as race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, genetic or biometric data, information relating to your health, government-issued ID numbers, complete account login credentials, or precise geolocation) in connection with our standard Website(s) and commercial activities. However, as described in section 3C above, in connection with our human clinical research activities, we may collect and process sensitive health-related data from patients and research participants. Such processing is carried out in compliance with Article 9(2) GDPR, specifically on the basis of explicit consent (Article 9(2)(a)) and/or for scientific research purposes (Article 9(2)(j)), together with appropriate technical and organizational safeguards including data pseudonymization – where applicable. Where we process health data of this nature, we will provide or will ensure that participants are provided with specific information about that processing at the point of data collection, with participants being requested to give informed consent to such processing.

6.  How we protect your personal data

The security of your personal data is important to us, and we take steps reasonably necessary to safeguard your personal data in our custody and control from unauthorized access, use or disclosure.

We maintain organizational and technical measures to ensure data security to protect your personal data against unauthorized access, unlawful use, accidental loss, corruption or destruction. We update and adjust these organizational and technical measures to reflect updated legal requirements and IT security improvements.

We will always take steps to ensure your data is treated and transferred securely with appropriate safeguards and controls in place.

7.   Who we share personal data with

In addition to the specific recipients of data listed above for each particular processing, we may share your personal data with other companies within Volition

In the event of a sale of all or part of the Volition business, your personal data will, where relevant, be transferred to the new owner or controlling party, under the terms of this Privacy Notice and in compliance with data personal related laws and regulations (including GDPR).

We will only share your personal data with law enforcement, regulatory or other Government bodies when required to do so, or to comply with a valid legal request such as a court order.

We may share your personal data with service providers working on our behalf to collect, store, process, and safeguard your personal data, including:

• IT companies who support our website and other business systems;
• Operational companies such as distributors, resellers and delivery couriers;
• Marketing companies who help us manage our electronic communications with you.

When we use service providers:

• If applicable, we conclude a data processing agreement according to article 28 of the GDPR or other applicable law;
• We only share with them the information they need to perform their specific services;
• They may only use your data for the exact purposes we specify in our contract with them;
• We work closely with them to ensure that your privacy is respected and protected at all times;

If we stop using their services, we will request that any of your data held by them will either be deleted or rendered anonymous.

8.  Where we store and process personal data

Your personal data can sometimes be transferred outside of the country in which it was originally collected. In such cases, we ensure that this international transfer is carried out in accordance with the applicable regulations, ensuring a sufficient level of protection of individuals’ privacy and fundamental rights (mainly through the European Commission’s standard contractual clauses and supplementary measures when GDPR is applicable). For transfers of personal data subject to UK GDPR, we rely on the International Data Transfer Agreement (IDTA) issued by the UK Information Commissioner’s Office, or the UK Addendum to the European Commission’s standard contractual clauses, together with any required supplementary measures, as applicable.

Usually, the personal data we hold is stored and used within the countries within which a Volition entity is legally registered, including the U.S., Singapore, Belgium, United Kingdom and the member countries of the EU or the EEA (the EU plus Iceland, Liechtenstein and Norway).

We may sometimes share personal data that we collect from you with service providers (i.e., data processors) in countries that are outside these jurisdictions, for example, if required in order to fulfill your order, or provide support services. In addition, personnel working for Volition subsidiaries may access certain personal data from other countries to the extent necessary for their duties.

If we do this, we require all our service providers and data processors, including our own subsidiaries, by written contract, to implement appropriate security measures to protect your data. Service providers may process personal data as necessary in connection with their performance of services and in accordance with our instructions.

9. Children’s Privacy

Our Services are not directed to children. For the purposes of this Policy, “children” means individuals under the applicable age of digital consent in a jurisdiction.  We do not knowingly collect, maintain, or process the personal data of children without the express consent of a parent or legal guardian except where permitted by applicable law.  If we determine that we have received a child’s personal data from a source other than the child’s consenting parent/guardian, we will immediately delete the information from our records/systems.

10. Your Rights

10.1. California Residents

Under California’s “Shine The Light” law, California residents have a right to know whether companies share their personal data for direct marketing purposes.  We do not share personal data with third parties for direct marketing purposes.

The California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act (together, the “CCPA”), (together the “CCPA”) gives California residents additional rights regarding their personal data held by a “Business” as defined in the CCPA. A “Business” under the CCPA is a for-profit entity that does business in California and meets at least one of the following thresholds: (i) annual gross revenues exceeding $26,625,000 (as adjusted for inflation from 1 January 2025); (ii) annually buys, sells or shares the personal information of 100,000 or more California consumers or households; or (iii) derives 50% or more of its annual revenue from selling or sharing consumers’ personal information.  As of the date of this Policy was last updated, Volition (i) does not meet any of these thresholds, (ii) is not a “Business” as defined in the CCPA and consequently, (iii) is not subject to the CCPA.  We are committed to complying with all applicable privacy regulations and will update this Policy accordingly as our operations, and applicable regulations, change.

10.2. Data Subjects in the EEA, United Kingdom and Switzerland

If you are in the EEA, Switzerland or the United Kingdom (UK), you may have additional rights under EU and domestic privacy laws, including the EU’s General Data Protection Regulation (“GDPR”), the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 or their domestic equivalents.  Here are your rights under GDPR, which can be exercised by contacting Volition using the contact details provided in section 10.3 below:

• Right to Be informed – This right is exercised through this document, which sets out how we use your data. If the data processed includes the data of your staff, you are responsible for making them aware of this document.
• Right of Access – You can request a copy of your personal data and how it is processed.
• Right to Rectification: You can request that any of your personal data that is inaccurate or incomplete data be corrected.
• Right to Erasure: You can request the deletion of your data when it is no longer necessary or, for instance, if consent is withdrawn.
• Right to Restriction of Processing: You can request that we limit how we use your data in specific cases.
• Right to Data Portability: You can receive your data in a structured, machine-readable format to transfer to another service.
• Right to Object: You can object to processing based on legitimate interests or for direct marketing. You will be able to exercise your right to object through the “unsubscribe” links in direct marketing e-mails sent to you or you can directly object by sending an email to Volition. We must then stop the processing unless we believe we have a legitimate overriding reason to continue processing your personal data, which we would notify you of.
• Automated Decision-Making/Profiling: You have the right not to be subject to decisions made solely by computers that significantly affect you. Volition does not engage in this type of activity.

11. Links to Third Party Sites

Our Website(s) may contain links to third-party websites, products or services.  If you use these links, you will leave our site. Such links do not constitute or imply endorsement, sponsorship or recommendation by us of the third party, the third-party website or the information contained therein, and Volition shall not be responsible or liable for your use thereof. Such use shall be subject to the terms of use and privacy policies applicable to those particular websites which are falling outside the control or knowledge of Volition.

12. Changes To This Policy

We reserve the right to update or change our Privacy Policy at any time, and you should check this Privacy Policy periodically.  If we make any material changes to this Privacy Policy, we will notify you either through the email address you have provided us with, or by placing a prominent notice on our Website.  Your continued use of our services after we post any modifications to the Privacy Policy on this page will constitute your consent to the modified Privacy Policy.

Last updated: June 2026