COSMIC Knowledgebase
Privacy Notice
Thank you for your interest in the COSMIC Knowledgebase. Your account is managed by the COSMIC team of Genome Research Limited (GRL) operating as the Wellcome Sanger Institute (“we” “us” or “Sanger”). We are committed to protecting and respecting your privacy. This Privacy Notice explains how we, as the Data Controller, handle your personal data when you engage with us. It also provides details of the rights that you have under data protection law. Such laws, for the avoidance of doubt, include the General Data Protection Regulation (“GDPR”) and its implementing legislation in the UK.
Our contact details for data protection queries
The Data Protection Team, Wellcome Sanger Institute
Wellcome Genome Campus, Hinxton, Cambridge, CB10 1RQ, UK
+44 (0)1223 834244
dataprotection@sanger.ac.uk
What types of personal data we collect about you
We seek to gather a variety of personal data about you to facilitate access to the COSMIC database. Such personal data will be collected directly from you or from our commercial licence distributor QIAGEN GmbH (QIAGEN) and may include but is not limited to the following:
- Your name;
- Your contact details including email address and phone number;
- Information about your employer, whether a company, organisation or institution;
- Your intended use of COSMIC data;
- Your areas of interest;
- Communication preferences, including reasons for contact.
Purposes and lawful grounds for processing
We will use this personal data for the purposes set out below:
1. Verify your identity and organisational affiliation to ensure legitimate access to our data sets as part of registration for a COSMIC account
2. Setting up your COSMIC account and licence
3. To provide access to COSMIC datasets and associated services
4. To monitor your compliance with the licence terms
5. Manage the ongoing administration of your account and licence
For the above five purposes, our lawful basis for processing your personal data is performance of a contract.
6. To contact you with updates and new products that could benefit your research and organisation
7. To gather your feedback to help us improve our data products and services
8. To analyse how you interact with our services to improve the user experience and optimise the performance of our data products
For these three purposes, our lawful basis for processing your personal data is legitimate interest. We have a legitimate interest in maintaining and growing our business relationships with your organisation. Accordingly, we may use your contact information to provide you with information about our data products, services, and any relevant updates that we believe may be of interest to you or your organisation. This helps us maintain and grow our business relationships and keep you informed about the products and services that may benefit your research.
Who we will we share your personal data with
Where you require a commercial licence, we may share your personal data with QIAGEN, our commercial distribution partner, who manages our commercial licences to COSMIC data. QIAGEN may contact you for similar purposes outlined above. For information on how QIAGEN manage your personal data, please follow the link: QIAGEN Privacy Notice.
We also sometimes share your data with third parties that provide services on GRL’s behalf and need to process your data in the provision of those services. These can include software as a service providers who support our systems. Whenever we share your personal data with third parties that process personal data on our behalf, we carry out risk assessments and enter into contracts with those third parties to make sure your data remains safe and secure and is processed in accordance with data protection law.
Other than as mentioned above, we will not share your personal data with any other third parties or share or process your data outside the United Kingdom without appropriate safeguards in place.
How we store your data and when we delete it
Your personal data will be stored on our secure servers with password protection. Any physical papers with your information will be stored in secure locked filing cabinets in our offices.
We will retain your personal data for the duration of your agreement with us to access COSMIC data under the relevant licence plus 3 years after the end of this agreement.
Where no email validation has been received but an account is created by you we will contact you to re-validate your account after 1 year. If you confirm that you do not wish to access COSMIC data we will keep your personal information for up to 3 years after such confirmation is communicated. We may still send communications regarding COSMIC updates and new products that could benefit your research organisation unless you tell us otherwise. If you wish for your data to be deleted earlier then you may exercise your rights as set out below.
Where you have contacted us or we have received your personal data from QIAGEN and you have not registered with us, we will keep your personal information for up to 3 years. We may still send communications regarding COSMIC updates and new products that could benefit your research organisation unless you tell us otherwise. If you wish for your data to be deleted earlier then you may exercise your rights as set out below.
Your data protection rights
You have the right to request access, rectification or erasure, amongst other rights, in relation to your personal data.
Any request to exercise one of these rights will be assessed by us on a case-by-case basis. There may be circumstances in which we are not legally required to comply with a request because of relevant exemptions provided for in applicable data protection legislation. If we are required to comply, we have one month to respond in most cases.
Please contact us at dataprotection@sanger.ac.uk if you wish to make a request.
How to complain
If you have concerns about how we have handled your personal data, you should get in contact with us at dataprotection@sanger.ac.uk in the first instance. If you are dissatisfied with our response, you have the right to complain to your Data Protection Authority. In the UK, that is the Information Commissioner’s Office (ICO).
ICO’s contact details:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
UK
Helpline number: 0303 123 1113
https://ico.org.uk/make-a-complaint/
Last Reviewed: 1-April-2025