Privacy Policy

1. Who We Are

Enigma Biosciences, LLC ("Enigma," "we," "our," or "us") is a contract pharmaceutical and nutraceutical manufacturer located at 5249 LB McLeod Rd., Orlando, FL 32811. We operate the website at enigmabiosciences.com (the "Site") and any associated digital tools and client portals.

Enigma acts as the data controller for personal information collected through this Site. For questions about this policy, contact us at [email protected].

2. Information We Collect

We collect information in two ways: information you provide directly to us and information collected automatically when you use our Site.

Information you provide directly:

• Name, business name, and job title
• Business email address and phone number
• Mailing or shipping address
• Project details, product specifications, and messages submitted via our contact or inquiry forms
• Account credentials if you access our client portal

Information collected automatically:

• IP address and approximate geographic location
• Browser type, device type, and operating system
• Pages visited, time spent on pages, and referring URLs
• Cookie identifiers and similar tracking technologies (see Section 6)

We do not collect sensitive personal information such as government ID numbers, financial account details, health records, or biometric data through this Site.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Responding to inquiries — to evaluate your project requirements and provide manufacturing briefs or quotes
• Client relationship management — to manage contracts, coordinate production, and communicate project status
• Site operation and improvement — to understand how visitors use our Site, diagnose technical issues, and improve content and navigation
• Marketing communications — to send relevant updates, industry news, or service announcements where you have provided consent or where permitted by law
• Legal compliance — to meet our obligations under applicable federal, state, and international law, including FDA regulatory requirements
• Security — to detect, investigate, and prevent fraudulent or unauthorized activity

We do not sell your personal information to third parties. We do not use your information for automated decision-making that produces legal or similarly significant effects.

4. Legal Basis for Processing

Where applicable law requires a legal basis for processing personal data (including under the GDPR and applicable US state privacy laws), we rely on the following:

• Contract performance — processing necessary to fulfill a contract with you or to take steps at your request prior to entering into a contract
• Legitimate interests — processing necessary for our legitimate business interests (e.g., site analytics, fraud prevention), provided those interests are not overridden by your rights
• Legal obligation — processing required to comply with applicable law or regulatory requirements
• Consent — where you have provided explicit consent, such as opting in to marketing communications

5. Sharing & Disclosure

We do not sell, rent, or trade your personal information. We may share your information with the following categories of recipients:

• Service providers — third-party vendors who assist us in operating our Site and business (e.g., CRM platforms, email delivery services, cloud hosting providers). These parties are contractually bound to process data only on our behalf.
• Business partners — where required to fulfill a manufacturing project, we may share relevant contact and project information with logistics or testing partners under confidentiality agreements.
• Legal and regulatory authorities — where required by law, regulation, court order, or to protect the rights and safety of Enigma, our employees, or others.
• Business transfers — in the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change via the email address on file.

6. Cookies & Tracking Technologies

Our Site uses cookies and similar technologies to enhance your experience and gather usage analytics. We use the following categories of cookies:

• Strictly necessary cookies — essential to Site functionality (e.g., session management). These cannot be disabled.
• Analytics cookies — used to understand how visitors interact with the Site (e.g., page views, traffic sources). We use anonymized analytics and do not share individual-level data with advertising networks.
• Preference cookies — used to remember settings you have selected on the Site.

You may manage or disable non-essential cookies through your browser settings. We do not use cookies for targeted advertising or cross-site behavioral tracking.

7. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes described in this policy, or as required by applicable law.

• Inquiry and contact data — retained for up to 3 years from your last interaction with us
• Client project data — retained for the duration of the client relationship and for a minimum of 7 years thereafter, in accordance with FDA record-keeping requirements for cGMP manufacturers
• Analytics data — retained in anonymized or aggregated form for up to 24 months
• Marketing consent records — retained until you withdraw consent or for 3 years from your last engagement, whichever is earlier

When data is no longer needed, it is securely deleted or anonymized in accordance with our data disposal procedures.

8. Security

We implement administrative, technical, and physical safeguards designed to protect your personal information against unauthorized access, disclosure, alteration, or destruction. These measures include:

• TLS encryption for all data transmitted between your browser and our Site
• Access controls and role-based permissions for internal systems
• Regular security assessments and vulnerability testing
• Employee training on data handling and privacy obligations

No method of transmission over the internet or electronic storage is 100% secure. If you believe your information has been compromised, please contact us immediately at [email protected].

9. Your Rights

Depending on your jurisdiction, you may have the following rights with respect to your personal information:

• Access — the right to request a copy of the personal information we hold about you
• Correction — the right to request that inaccurate or incomplete information be corrected
• Deletion — the right to request deletion of your personal information, subject to applicable legal obligations
• Portability — the right to receive your data in a structured, machine-readable format
• Objection / Restriction — the right to object to or restrict certain types of processing, including direct marketing
• Withdraw consent — where processing is based on consent, the right to withdraw that consent at any time without affecting the lawfulness of prior processing

California residents may exercise rights under the California Consumer Privacy Act (CCPA), including the right to know, delete, and opt out of sale. We do not sell personal information as defined under the CCPA.

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days. We may need to verify your identity before processing your request.

10. Children's Privacy

Our Site and services are directed exclusively to businesses and professionals. We do not knowingly collect personal information from individuals under the age of 18. If you believe a minor has submitted information to us, please contact us at [email protected] and we will promptly delete it.

11. Third-Party Links

Our Site may contain links to third-party websites, publications, or resources. These links are provided for informational purposes only. Enigma Biosciences has no control over and assumes no responsibility for the content, privacy practices, or terms of any third-party site. We encourage you to review the privacy policies of any site you visit.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, provide additional notice.

Your continued use of the Site after any changes constitutes your acknowledgment of the updated policy. We encourage you to review this page periodically.