We will tell you:
Medicines Discovery Catapult (MDC) is the controller for the personal information we process unless otherwise stated.
You can contact MDC’s Data Protection Representative via phone, email, and post:
Phone number: 01625 704 050.
Compliance email address: compliance@md.catapult.org.uk
Postal address:
Medicines Discovery Catapult
Block 35, Mereside,
Alderley Park,
Alderley Edge,
SK10 4ZF
Please use our ‘Speak to Us’ page for general and partnership enquiries.
The personal information we process is provided to us directly by you for one of the following reasons:
Our purpose for collecting this information is to track your enquiry and send it to the right person for follow-up.
The legal basis we rely on for processing your personal data is your consent under Article 6(1)(a) of the GDPR.
We use HubSpot forms for people who want to register a business enquiry on our website. Our website and the plugins are administered by the digital agency C21, with no access to the data we collect.
We collect this data to help us understand more about the people contacting us or requesting access to our resources. We use this data to manage, provide an audit trail, and monitor the success of our relationships with individuals, organisations, and the wider industry.
All enquiries are logged on our CRM system. This is to allow us to manage enquiries effectively and report on our performance for ourselves and for our parent organisations. The data will be removed if we have had no contact with a company or person for more than 2 years. You can also send us a request to remove your company or personal data. Read HubSpot’s Privacy Policy.
We partner with third-party organisations to fulfil requests for tissue samples. In the first instance, we will share the details you submit with Tissue Solutions. You can read their Privacy Statement on their website. To source the correct samples, Tissue Solutions will forward your request to other organisations; this is done anonymously. If they are unable to help, we will then send your request to our partner biobanks for fulfilment – these enquiries will be anonymised by us.
We collect this information to facilitate our events and provide access to them. The legal basis for processing your personal data is your consent under Article 6(1)(a) of the GDPR. Event registrations are managed via HubSpot.
We collect this information to facilitate and provide access to our events. The legal basis we rely on for processing your personal data is your consent under Article 6(1)(a) of the GDPR.
Webinar signup forms use HubSpot to collect the data and share it with our webinar platform, Zoom, through official, secure integrations. Read more about Zoom’s compliance with GDPR.
We collect this information to send you our monthly newsletter and track your subscription status. The legal basis for processing your personal data is your consent under Article 6(1)(a) of the GDPR.
We use a third-party service, HubSpot, to collect the data of people wanting to join our email list. We collect this data to keep interested people up to date with our work and partnership opportunities. We send subscribers our monthly newsletter and occasional alerts when we have significant announcements and collaboration opportunities. Every email we send will include a link to unsubscribe.
We use industry-standard technologies to gather statistics about email openings and clicks to help us monitor and improve our communications. Read HubSpot’s Privacy Policy.
We collect this information to share relevant news stories with journalists and publications looking for stories. The legal basis for processing your personal data is your consent under Article 6(1)(a) of the GDPR.
We hold lists of journalists we believe will be interested in hearing from us to distribute press releases, briefings, features, statements, invitations, reports and information about our work. The personal information we collect might include name, email address, postal address, telephone numbers, social media handle, job title, publication name and records of engagement, collaborations and media coverage.
Media lists are built and managed using the Meltwater database, and journalists can opt to be removed. The Meltwater Privacy Policy is available on their website.
We may occasionally use a third party, such as a PR agency, who will approach media contacts on behalf of Medicines Discovery Catapult.
All the information you provide to Medicines Discovery Catapult during the process will only be used to progress your application.
The information you provide will be held securely by us, whether the information is in electronic or physical format. We will use the contact details you provide to us to contact you to progress your application. We will use the other information you provide to assess your suitability for the role you have applied for.
We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than necessary.
The information we ask for is used to assess your suitability for employment.
On submission of your CV via the ‘apply for this job’ tab, this will include your personal details, including name and contact details. We will also look at previous experience and education to assess suitability for shortlisting for interview. The hiring managers and HR shortlist applications for interview. Electronic job applications will be retained within the Applicant Tracking System (ATS) of the HR system. HR will have access to all information held within the ATS.
We might ask you to complete a personality profile questionnaire through a third party. Information will be generated by you and by us. For example, you might complete an online behavioural questionnaire, or we might take interview notes. This will be held by the third party and us, and the latter will be held by Medicines Discovery Catapult only.
If you are unsuccessful following assessment for the position you have applied for, your details will be retained on file for 12 months following the end of the recruitment campaign.
If we make a conditional offer of employment, we will ask you for information so we can carry out pre-employment checks. You must successfully complete pre-employment checks to progress to a final offer. We are required to confirm the identity of our staff, their right to work in the UK and seek references.
You will therefore be required to provide:
If we make a final offer, we will also ask you for the following:
For some vacancies, we may advertise through recruitment agencies. Information collected by a recruitment agency will be retained for an agreed period following the end of our agreement.
Before you engage with any recruitment agency, you should read its privacy policies.
If you are successful after applying for a specific vacancy, the information you provide during the application process will be retained by us as part of your employee file for the duration of your employment, plus the recommended time following the end of your employment. This includes your fitness to work, records of any security checks and references.
If you are unsuccessful at any stage of the process, the information you have provided until that point will be retained for 12 months in the ATS from the closure of the recruitment campaign.
We retain information generated throughout the assessment process, such as interview notes, for 12 months in the ATS following the closure of the recruitment campaign.
Hiring managers and HR make final recruitment decisions. They consider all the information gathered during the application process.
You can ask about decisions made about your application by speaking to your contact within our recruitment team or by emailing recruitment@md.catapult.org.uk.
Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.
You have the right to ask us for copies of your personal information. This right always applies, but there are some exemptions, which means you may not always receive all the information we process.
You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.
You have the right to ask us to erase your personal information in certain circumstances.
You have the right to ask us to restrict the processing of your information in certain circumstances.
You have the right to object to processing if we are able to process your information because it forms part of our public tasks or is in our legitimate interests.
This only applies to the information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. The right only applies if we are processing information based on your consent or in talks about entering into a contract, and the processing is automated.
We work to high standards when it comes to processing your personal information. If you have queries or concerns, please email us at compliance@md.catapult.org.uk.
If you remain dissatisfied, you can make a complaint about the way we process your personal information to the ICO as the UK supervisory authority.
You can read more about your rights on the ICO website.
You are not required to pay any charge for exercising your rights. We have one month to respond.
We will not share your information with any third parties for direct marketing purposes. We use data processors and third parties that provide elements of our services. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct.
Our parent organisation, Innovate UK, has appointed independent organisations Kantar and Frontier Economics to gather feedback on our impact on the sector. They do this through phone interviews with key contacts from organisations that have engaged with us. For this purpose, we share the details of companies and individuals with Kantar and Frontier Economics. Read Kantar’s Privacy Policy – Read Frontier Economics’ Privacy Policy.
Where we provide links to websites of other organisations, this privacy notice does not cover how that organisation processes personal information. We encourage you to read the privacy notices on the other websites you visit.
At your request, Medicines Discovery Catapult can confirm what information we hold about you and how it is processed. We take our responsibilities for data privacy very seriously. We will ensure we take all reasonable steps to correctly identify anyone submitting a subject access request to our business, per our Data Subject Access Request Procedure. Should you wish a copy of this procedure, please contact MDC’s Data Protection Representative using the contact details at the top of this page.
We adhere to high standards when processing your personal information. If you have any questions or concerns, please email compliance@md.catapult.org.uk.
If you remain dissatisfied, you can make a complaint about the way we process your personal information to the ICO.
We keep our privacy notice under regular review to ensure it is up-to-date and accurate. The last update was September 2025.
We collect Calling Line Identification (CLI) information when you call our office phone number. We use this information to improve the efficiency and effectiveness of our call handling.
We use Transport Layer Security (TLS) to encrypt and protect email traffic in line with the government. If your email service does not support TLS, you should be aware that any emails we send or receive may not be protected in transit.
We will also monitor any emails sent to us, including file attachments, for viruses or malicious software. Please be aware that you have a responsibility to ensure that any email you send is within the bounds of the law.
When a user visits md.catapult.org.uk, we use a third-party service, Google Analytics, to collect standard log information and details of visitor behaviour patterns. We do this to determine the number of visitors to the various parts of the site. This information is processed in a way which does not identify the user. We do not make and do not allow Google to make any attempt to discover the identities of those visiting our website.
Our website uses cookies, as almost all websites do, to help provide you with the best experience we can. Cookies are small text files placed on your device when browsing websites. Specifically concerning Google Analytics Advertising Features; Remarketing with Google Analytics, Google Display Network Impression Reporting, Google Analytics Demographics and Interest Reporting (Google Signal), Integrated services that require Google Analytics to collect data for advertising purposes, including the collection of data via advertising cookies and identifiers.
You can also read more about Google Analytics’ currently available opt-outs for the web by clicking here. We do not place non-essential cookies on your device without your explicit consent. Cookie consent is managed through a consent management platform provided by CookieBot.
When someone visits md.catapult.org.uk, a third-party service, HubSpot, places a first-party cookie on their device. Details of cookies can be found in the cookie policy. If a user completes a contact form, HubSpot can use the information to avoid duplicating contacts. We may use this information to personalise the visitor’s experience on the website and via email (if they consent to receive them). Only MDC has access to this data; we do not share or make it available to any third party. An up-to-date list of HubSpot Cookies can be found on this here.
You can read more about how we use cookies in our Cookie policy.
The purpose of implementing all the above is to maintain and monitor our website’s performance and constantly look to improve the site and the services it offers to our users. The legal basis we rely on to process your personal data is Article 6(1)(f) of the GDPR, which allows us to process personal data when necessary for our legitimate interests.
As stated above, we are processing your personal data for our legitimate interests. You have the right to object to our processing of your personal data. There are legitimate reasons why we may refuse your objection, which depend on why we are processing it.
Our purpose for collecting this information is to:
The legal basis we rely on for processing your personal data is a legal obligation under Article 6(1)(c) of the GDPR.
See how we can help support you with your next drug discovery project.
Speak to us