Privacy notice and terms

What IBRTC holds about you, and why

IBRTC takes a fee, issues an agreement and keeps a record that the agreement was performed. This notice says what that involves, in the order a member tends to ask it. It is IBRTC's own notice and not the Centre's: the two organisations hold different things, for different reasons, and for different lengths of time.

In effect from 29 October 2026. Where this notice changes, the date above changes with it.

Who holds it

The controller of everything described on this page is the Integrated Biosciences Research Training Centre, IBRTC, the training and payment companion of the Centre for Immunology, Genetics, and Systems Biology. IBRTC carries supervision, workshops, bootcamps and the fees for them. The Centre carries membership, progression and the scientific record.

Write to [email protected]about anything on this page, including a request to see, correct or erase what is held. The address sits on the Centre's domain because the same registration office administers both sides; a message about an IBRTC fee or agreement reaches the people who can act on it.

Put the reference of the engagement, agreement or payment in your message where you have one. It is the fastest way to be certain we are discussing the same record, and you can read every reference held about you further down this page.

There is no IBRTC account

You have no password here, because there is no account here to have one for. Signing in happens at cisbm.org. The Centre issues a token that says who you are, and IBRTC checks that token against the Centre's published keys before it will show you anything. The identifier IBRTC files your records under is the identifier your CISBM profile already has, which is how one sign-in works across both sites.

So IBRTC holds no password, no password reset link and no login credential of any kind. It cannot sign in as you, and it cannot change your Centre account. When you sign out here, the session is ended at the Centre as well, so the two cannot drift apart and leave you signed in somewhere you thought you had left.

A session is held in this browser, in this site's own storage, and a short cookie remembers whether you asked for the light or the dark theme. Nothing on this site profiles you, follows you to another site, or reports your reading to anybody.

What is held

Everything IBRTC holds about a member is in this list. Each entry says where it came from and what it is for, because a category without a reason attached is not an answer.

Your name and your email address: Where it comes from. Read from your CISBM account when you act here. They are not collected again, and you cannot change them here: they are changed at the Centre.; Why it is held. To address an agreement to you, to tell a supervisor who has written to them, and to send a confirmation.
Your supervision or enrolment record, and its reference: Where it comes from. Created when you ask a supervisor for supervision or take a place on a workshop or bootcamp. It holds the topic, the message you wrote, the supervisor you chose, the dates and the status.; Why it is held. It is the thing being arranged. Without it there is nothing to supervise and nothing to enrol on.
The agreement, exactly as it was signed: Where it comes from. Written when the agreement is issued and frozen when you sign it. The wording is stored as a snapshot rather than as a link to the current template.; Why it is held. So that neither side can argue later about what was agreed. The snapshot is the agreement.
The fee and the currency: Where it comes from. Set on the agreement before you sign, and never changed afterwards.; Why it is held. To state what is owed, and to keep the financial record the law requires.
A payment receipt you upload: Where it comes from. Uploaded by you, with any note you add to it. Nothing is read from your bank and no card number ever reaches this site.; Why it is held. So an administrator can confirm your payment against the reference. A receipt is evidence of payment, not a payment instrument.
A WhatsApp group link, where a group is used: Where it comes from. Added by an administrator to a workshop, bootcamp or supervision that is run through a group.; Why it is held. To let you into the group for the thing you are enrolled on. Your telephone number is not held here: if you join a group, WhatsApp shows it to the group, and that is between you and the group.
An audit trail of actions: Where it comes from. Written by the database as actions happen: a request sent, a request answered, an agreement issued, an agreement signed, a payment confirmed, with who did it and when.; Why it is held. So that a disputed step can be checked, and so that nobody can quietly change a signed record. It is also what protects you if an administrator makes a mistake.

IBRTC does not hold your card details, your bank details or your telephone number, and it does not ask for a date of birth, an address or a photograph.

Why it is held

Three grounds, each covering a different part of the record.

Performing the agreement

The engagement, the agreement as signed, the fee and the currency, and the group link where one is used. You asked for supervision or for a place, and these are what it takes to give you one. Without them there is no agreement to perform.

A lawful financial record

The fee, the payment and its reference, and enough of the agreement to show what the money was for. A training provider that takes a fee has to be able to account for it, and that obligation does not depend on your consent.

Running the Centre's training

The audit trail, and the plain administration of a workshop or a supervision: knowing who is on it, answering a request, correcting a mistake. This is a legitimate interest, and you can object to it. Where you do, we will say what we can stop doing and what we cannot.

IBRTC does not rely on consent for any of this, with one exception: where you are asked to join a WhatsApp group, joining is your choice and you can leave it without leaving the supervision.

Who sees it

The supervisor you named sees their own engagements and nothing else: your name, the topic, the message you wrote to them, the agreement, and whether it has been paid. A supervisor cannot read another supervisor's engagements, and cannot read a request that was never sent to them. This is enforced by the database rather than by the page you are looking at.

IBRTC administrators see engagements, agreements, payments and uploaded receipts, because somebody has to issue an agreement and confirm that a payment arrived. Those actions are written into the audit trail with the name of the person who took them.

Nothing here is sold, rented or shared for anybody else's purposes. There is no advertising on this site, no advertising network in its pages, and no profiling of you for marketing. Your records sit in a hosted database and the site is served through a content delivery network; both act on IBRTC's instructions and for no purpose of their own.

How long it is kept

The financial record: six years: The fee, the currency, the payment and its reference, and the part of the agreement that says what the money was for, kept for six years after the end of the financial year the payment falls in, because UK law requires a business record to be kept that long.
The agreement: as long as it may be needed: The signed snapshot is kept while a question about the supervision could still be raised by either side, and in practice alongside the financial record it belongs to. It is never edited; if something in it was wrong, a correction is recorded next to it.
A receipt you upload: no longer than necessary: Once your payment is confirmed, what the accounts need is the amount, the date and the reference, not the image. The uploaded file is removed when it has done its job; the confirmation of payment stays.
A group link: until the engagement ends: A WhatsApp group link is held against the engagement it belongs to and is cleared when that engagement is completed or withdrawn.
The audit trail: with the record it describes: An audit trail that outlived its record would prove nothing, and one that died before its record would protect nobody. It is kept for as long as the record it is about.

Your rights

You can ask to see what is held about you, and much of it is already on this page, further down, when you are signed in. You can ask for anything inaccurate to be corrected. Your name and email are corrected at the Centre, because that is where they come from, and the correction follows you here.

You can ask for erasure, and here is the plain version: a financial record generally cannot be erased while the law requires it to be kept. If you ask, what can go will go, and what must stay will be named, with the reason it has to stay and the date it stops having to. The same is true of a signed agreement while a claim about it is still possible.

You can object to the processing done in the Centre's legitimate interests, and you can ask for processing to be restricted while a dispute about accuracy is sorted out. You can ask for a copy of what you gave us in a portable form.

Ask by writing to [email protected]. You will have an answer within one month, and if the request is complicated enough to need longer, you will be told that inside the month rather than at the end of it. Exercising any of these rights costs nothing and will never affect your supervision or your place.

If you are not satisfied with how we handle it, you can complain to the Information Commissioner's Office, the UK's data protection regulator, atico.org.uk/make-a-complaintor by telephone on 0303 123 1113. You are welcome to come to us first, but you do not have to, and you do not need our permission.

The Centre's own record

Your membership, your progression level, your council roles, your participation record and anything of yours in the journal are held by CISBM, not by IBRTC. This notice does not govern them. The Centre's own policies atcisbm.org/policiesdo.

The two meet at one point. When a supervision or a workshop is completed here, IBRTC asks the Centre to record your participation, and keeps the reference the Centre gives back. What crosses is that you took part and in what; the fee, the receipt and the agreement stay here and are not written into your scientific record.

What is held about you right now

Read from your own records when you are signed in, and visible only to you. If something here is wrong, that is what the registration office is for.

Signing in happens at the Centre, and brings you straight back to this page. Nothing of yours is shown here until it does.

Also served at /terms

Terms of service

There is no separate contract between you and IBRTC for browsing this site. What governs a supervision is the supervision agreement: the one issued to you, with the scope, the fee and the currency written into it, and signed by you before anything is owed. The text you signed is kept as a snapshot, and that snapshot is the agreement. It is not whatever this website happens to say today.

So nothing is owed until an agreement has been issued and you have signed it. Read it before you sign, and ask for the scope to be changed if it does not describe what you want supervised; that is easier before signature than after. Where a fee is refunded, the refund is recorded against the same reference as the payment, so the record stays one story rather than two.

A place on a workshop or a bootcamp works the same way: the price is stated before you enrol, and enrolling is the agreement. The Centre's research integrity agreement is separate, is free, and sits at the Centre with your scientific record.

Read the terms before you request supervision Read an agreement you have signed

This notice and these terms take effect on 29 October 2026.