You might like
Legal | SPICA
Last updated: 1 October 2026
SPICA is the brand and trading name of COVALIX SCIENTIFIC LTD, a private company limited by shares incorporated in England and Wales on 23 September 2026, with company number 17475745.
Registered office: 20 Wenlock Road, London N1 7GU, United Kingdom. This is our registered office address; it should not be treated as a product-return or delivery address without our prior agreement.
COVALIX SCIENTIFIC LTD operates the SPICA business and website at spica.global. References to SPICA, we, us or our in this policy mean COVALIX SCIENTIFIC LTD trading as SPICA.
COVALIX SCIENTIFIC LTD is the controller responsible for the personal data described in this policy, except where a service provider acts as an independent controller as explained below. The relevant UK framework includes the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as amended, including by the Data (Use and Access) Act 2025.
For privacy enquiries, rights requests or complaints, contact info@spica.global or write to COVALIX SCIENTIFIC LTD, Attn: Privacy, at our registered office.
Depending on how you interact with us, we may collect:
Our website and ordinary support channels are not intended for patient records, donor information, clinical trial subject data or other identifiable health or special-category data. Please do not send us identifiable patient, donor or research-participant data. If technical support requires sensitive information, contact us first so that an appropriate legal basis, any additional condition required for special-category data, and a secure process can be agreed. Do not include this information in ordinary account fields or order notes.
Where providing particular information is mandatory, we will make this clear. If you do not provide information needed to process an order, comply with law or perform a contract, we may be unable to supply the relevant products or services.
| Purpose | Typical data | Lawful basis |
|---|---|---|
| Manage accounts, quotations, orders, payment, delivery, returns, warranty and support | Identity, contact, order, transaction and communications data | Contract (Article 6(1)(b)) where you are personally a party to the contract or request steps before entering into it. For employees and other representatives of business customers, legitimate interests (Article 6(1)(f)) in supplying products and managing the business relationship. |
| Verify business customers, prevent fraud, secure the website and enforce our terms | Identity, business, technical, compliance and transaction data | Legitimate interests in preventing misuse and protecting customers and our business. Legal obligation (Article 6(1)(c)) where a specific applicable law requires the processing. |
| Meet tax, accounting, product-safety, sanctions, recall, regulatory and legal requirements | Identity, contact, order, transaction and compliance data | Legal obligation where required by applicable law. Otherwise legitimate interests in product traceability, safety and managing legal risk. |
| Respond to scientific, product and customer-service enquiries and improve our products and services | Contact, communications, support and usage data | Contract where necessary to fulfil our contract with you personally; otherwise legitimate interests in responding to enquiries, providing support and improving quality. |
| Analyse website performance and improve user experience | Technical and usage data | Consent (Article 6(1)(a)) where required. Legitimate interests in understanding and improving our website where the processing is lawful without consent. The separate PECR rules for device storage and access also apply, as explained in section 10. |
| Send relevant product, event and company communications | Identity, business contact, marketing and relationship data | Consent where required; otherwise legitimate interests in promoting relevant products and maintaining professional relationships, only where PECR and other applicable marketing rules permit the communication. |
| Establish, exercise or defend legal claims and manage corporate transactions | Relevant data from the categories above | Legitimate interests in protecting legal rights and managing our business; legal obligation where disclosure or retention is required by law. |
We select the lawful basis that applies to the particular purpose and circumstances. Where we rely on legitimate interests, we assess whether the processing is necessary and whether your interests, rights or freedoms override those interests. You can object as explained in section 11.
Where we rely on consent, you can withdraw it at any time. We will explain any materially different use of your data before starting that use and obtain consent where required.
We collect data directly from you, your employer or colleagues, website and account activity, our payment and delivery partners, distributors and authorised representatives, fraud-prevention providers, professional events and referrals. We may also obtain professional contact and role information from publicly accessible sources such as your organisation's website or professional directories, where lawful.
Where we obtain your personal data from another source, we provide the required privacy information, including the relevant source and data categories, within a reasonable period and no later than one month, or earlier when first communicating with you or first disclosing the data, unless a lawful exemption applies.
We disclose only the data reasonably required for the relevant purpose. Recipients may include:
Service providers acting for us may process personal data only for agreed purposes and under appropriate contractual and security obligations. Some providers, including Shopify for certain services and payment or delivery providers for their own purposes, may act as independent controllers under their own privacy notices. Shopify explains its processing at shopify.com/legal/privacy. Where a provider is an independent controller, we remain responsible for the lawfulness of our disclosure to it.
Our ecommerce platform, suppliers and service providers may process personal data outside the United Kingdom. Shopify's published privacy information describes processing in locations including the EEA, Canada and the United States. Other international disclosures may be necessary for global fulfilment, payment or technical support.
Where a transfer is restricted under the UK GDPR, we ensure that an appropriate lawful mechanism applies. This may be UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the European Commission's standard contractual clauses. Where required, we carry out the applicable data protection test (also known as a transfer risk assessment) and use additional safeguards. A statutory exception is used only where its conditions are met.
You can request information about the countries, recipients and safeguards relevant to your data, including a copy of applicable contractual safeguards, by contacting info@spica.global. Copies may be redacted to protect confidential information.
We retain personal data only for as long as reasonably necessary for the purposes described above, including legal, tax, accounting, product-traceability, warranty and dispute requirements. Our usual criteria are:
We may retain information for longer where a dispute, investigation, recall, legal hold or regulatory requirement applies. We securely delete or anonymise data when it is no longer required.
We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, loss, disclosure or destruction. These measures include access controls, supplier due diligence, secure transmission where appropriate, backups and incident procedures. No internet transmission or storage system is completely secure, so we cannot guarantee absolute security.
Please keep your account credentials confidential and notify us promptly if you suspect unauthorised access. Where a personal data breach occurs, we assess it and notify the ICO and affected individuals where the law requires. This does not limit our responsibility to protect personal data.
We may send professional contacts relevant information about SPICA products, applications, events and services where lawful. Marketing identifies COVALIX SCIENTIFIC LTD trading as SPICA and provides a way to unsubscribe.
For individual subscribers, including sole traders and certain partnerships, we obtain consent for email or text marketing unless the customer soft opt-in applies. That exception is limited to contact details we obtained directly during a sale or negotiations for a sale, marketing our own similar products or services, and offering an opt-out when the details are collected and in every subsequent message.
We may contact corporate subscribers about relevant business products or services without prior PECR consent where permitted, but processing a named contact's personal data still requires a UK GDPR lawful basis. We honour objections and opt-outs.
You can object to direct marketing at any time. Use the unsubscribe link or contact info@spica.global. We retain only the suppression information needed to respect your preference. Opting out does not stop necessary messages about orders, safety, recalls, accounts or contracts.
Subject to the applicable legal conditions and exemptions, you may:
Your right to object to direct marketing is unconditional: you can object at any time to use of your personal data for direct marketing, including related profiling, and we will stop that use.
Contact info@spica.global or write to our registered office. You do not need to use a particular form or legal wording. Requests may also be made verbally or through another appropriate contact channel. We ask for identity or authority information only where reasonably needed.
We respond without undue delay and normally within one month. Where the law permits an extension for a complex request or multiple requests, we may take up to two additional months and will explain the extension within the initial month. Statutory timing rules may apply while necessary identity information or, for access requests, reasonably required clarification is outstanding. Requests are normally free; a reasonable fee or refusal is possible only in the limited cases permitted by law.
We do not ordinarily make decisions about you solely by automated means that produce legal or similarly significant effects. If this changes, we will provide the required information about the processing, its significance, the consequences and the applicable safeguards. You can contact us about automated fraud or payment checks affecting an order; where a provider is the independent controller, its own notice and request process also apply.
If you are concerned about how we handle your data, email info@spica.global or write to COVALIX SCIENTIFIC LTD, Attn: Privacy Complaints, at our registered office. You may use other available contact channels and do not have to use a particular form or mention a specific law. Please describe your concern and how we can contact you; we will help if you need assistance.
We acknowledge a data protection complaint within 30 days of receiving it. We investigate and take appropriate steps without undue delay, keep you informed as appropriate, and communicate the outcome and any action taken without undue delay.
You also have the right to complain to the UK's independent data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom. The ICO generally asks you to raise the concern with the organisation first. This does not limit your statutory rights.
Our website and products are intended for professional and laboratory audiences and are not directed to children. Account holders and persons placing orders must be at least 18 and appropriately authorised. If you believe a child has provided personal data to us, please contact us so that we can assess and handle it appropriately. Children retain the data protection rights available under applicable law.
Links to third-party websites are provided for convenience. Their privacy practices are described in their own notices. This policy explains COVALIX SCIENTIFIC LTD's processing in connection with SPICA and does not replace a separate notice for processing for which another organisation is the controller.
We may update this policy when our processing, providers or legal obligations change. The current version and last updated date will be published on this page. We will highlight material changes where appropriate and obtain fresh consent where required. Continued use of the website does not by itself constitute consent to processing that requires consent.
