Last updated: 22 July 2026
1. Scope of this notice
This notice covers the Cibus marketing website and information sent through its demo and contact forms. It does not replace the privacy information supplied to restaurants, restaurant staff or diners who use Cibus product applications. Those services have separate contractual and privacy terms for their particular data flows.
2. Who is responsible for your information
For enquiries relating to the United Kingdom or a market without a separate local notice, the data controller is Cibus AI Ltd, company number 15873165, 7 Alford Road, Stockport SK4 5AW, United Kingdom.
For enquiries relating to Malaysia, the data controller is NSD Multi Resources Sdn Bhd, company number 201601021643 (1192582-T), 37-2, Jalan Kuchai Maju 11, Kuchai Entrepreneurs Park, 58200 Kuala Lumpur, Malaysia. It works with Cibus AI Ltd to respond to Cibus enquiries and operate the sales process. Information is shared between the two companies only where needed for that purpose.
Contact the relevant controller through privacy@cibus.ai.
3. Information we collect
Depending on how you use the website, we may collect:
- contact details such as your name, work email address and optional telephone number;
- business context such as restaurant or company name, the selected operating country or territory, number of locations and restaurant type;
- the enquiry reason, message and other information you choose to provide;
- request records such as the source page, country-derived enquiry market, page market and language, notice version, timestamps and an idempotency reference used to prevent duplicate entries;
- limited security and diagnostic data needed to protect the form and investigate a failed or abusive request. We do not intentionally put form contents into analytics or operational logs.
- only after you accept analytics on
cibus.ai: the public page path without arbitrary query strings or fragments, page title, market, locale, page and form type, an anonymous session identifier, external referrer origin, validated UTM campaign labels, and browser, device and network information processed when the Google Analytics tag is requested. Email-like campaign values, URLs and long digit sequences are rejected.
4. Why we use it
| Purpose | Basis |
|---|---|
| Respond to an enquiry, arrange a requested demo and follow up that sales conversation. | Steps requested before a contract where applicable, or our legitimate interest in responding to a business contact. |
| Route the request to the relevant market or team. | Our legitimate interest in handling enquiries accurately and efficiently. |
| Protect the website, prevent duplicate or abusive submissions and maintain a reliable record of the request. | Our legitimate interests in service security, accountability and fraud prevention, and legal obligations where they apply. |
| Understand which public website pages, campaign sources and accepted enquiry types are used so we can evaluate and improve the marketing website. | Your consent. Analytics stays off until you accept and you can withdraw at any time. |
The forms do not subscribe you to unrelated marketing. If Cibus introduces an optional marketing choice later, it will be separate, unticked and withdrawable.
5. Whether you must provide the information
Supplying information is voluntary. Name, work email, restaurant or company details and the fields marked required are needed for us to understand, route and answer the request. If they are not supplied, we may be unable to respond or arrange a demo. Telephone and fields explicitly labelled optional are not required.
6. Service providers, recipients and transfers
Lead records are stored in a dedicated database project hosted in Ireland by Supabase, our database hosting provider. Authorised Cibus sales, product and support personnel may access a record only when needed to respond or manage the requested conversation.
Our other principal website service providers are: Cloudflare, which hosts, delivers and helps secure the website and processes IP addresses and request metadata for that purpose; Sentry, which provides error monitoring for website code and is configured to exclude form contents and personal identifiers from error reports; and Google, whose consent-gated analytics is described below and whose Google Cloud/Firebase infrastructure supports Cibus internal systems. We may also use contracted communications and professional advisers. Each provider acts under confidentiality and data protection obligations.
A Malaysian enquiry is transferred to and stored in Ireland, and may be accessed by the two Cibus operating companies described above. Before Malaysian intake is activated, Cibus completes the applicable cross-border transfer documentation and processor safeguards. We do not sell website-lead information.
If you accept analytics, Google processes the limited measurement information described in this notice as our analytics provider. Google may process it in other countries under its applicable contractual transfer safeguards. Cibus disables advertising storage, Google signals and advertising personalisation in the website configuration.
7. How long we keep it
- An unqualified or unanswered enquiry is deleted or irreversibly anonymised 12 months after the last meaningful interaction.
- An active qualified opportunity may be retained while active, then deleted or anonymised 24 months after the last meaningful interaction.
- Non-personal diagnostic records for invalid or suspected automated requests are kept for no more than 30 days; confirmed abuse evidence may be retained for up to 90 days when necessary to protect the service.
- Deleted primary records are scheduled to expire from backups within 35 days. A restored backup must have the deletion reapplied.
- The analytics-consent record and Google Analytics browser cookies are configured for no more than 180 days. Analytics reporting is retained under the controlled Google Analytics property setting and reviewed against Cibus retention requirements.
A reply, meeting, new request or genuine commercial conversation is a meaningful interaction. An email open is not.
8. Your choices and rights
Depending on your location, you may have rights to ask for access, correction, deletion, restriction or objection, and to receive certain information in a portable form. You may also withdraw a consent where processing relies on consent. These rights can have legal limits, and we may need to confirm your identity before acting.
Email privacy@cibus.ai with the subject “Privacy request”. UK users may complain to the Information Commissioner’s Office. Malaysian users may contact the Personal Data Protection Commissioner. We would appreciate the opportunity to address the concern first.
9. Cookies and analytics
Necessary first-party preferences remember an explicitly selected region, language and versioned analytics choice. After you accept, a session-only record can retain the restricted campaign context described above and the Google Analytics script can be requested on cibus.ai; both remain off on localhost and preview hosts. Cibus sends path-only page views and an accepted-lead event without form fields, restaurant names, free text or internal lead identifiers. Use the persistent “Cookie settings” control to change or withdraw your choice. Exact storage names, durations and controls are described in the Cookie Policy.
10. Changes to this notice
We update this notice when the website, providers, purposes or legal requirements materially change. The date above reflects a substantive review, not an automatic build date.