Date of last assessment: 30.10.2026
1. Introduction
Welcome to Menken OÜ (“Menken”, “we”, “our”, or “us”). We are committed to protecting your personal data and your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you interact with our website (www.menkentrials.com) or use our services.
We process your personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Estonian Data Protection Act.
2. Who we are
Data Controller:
Menken OÜ
Riia tn 2, 51004 Tartu, Estonia
Registration number: 16239714
Email: compliance@menkentrials.com
At this time, Menken OÜ has not appointed a Data Protection Officer, however we periodically assess the need for one. Please contact compliance@menkentrials.com with any privacy-related questions.
3. What personal data we collect
We may collect and process the following categories of personal data:
– Identity Data: name, job title, company name.
– Contact Data: email address, phone number, mailing address.
– Account Data: username, password, audit trail information.
– Usage Data: IP address, browser type, device information, pages visited, and actions performed on our website or platform.
– Communications Data: inquiries, support requests, and correspondence.
– Clinical Study Data: where relevant, we may process special categories of personal data (e.g., health data) strictly for clinical trial operations and under appropriate safeguards.
4. How we collect your personal data
We collect personal data in the following ways:
– Directly from you: When you contact us, sign up for services, submit forms, or communicate with us.
– Automatically: When you use our website, through cookies and similar technologies.
– From third parties: Such as CRO partners, research sites, or service providers, if relevant to our services.
5. How we use your personal data & legal bases
We only process your personal data where we have a valid legal basis under GDPR.
| Purpose | Legal Basis |
|---|---|
| To provide and operate our services | Performance of a contract (Art. 6(1)(b)) |
| To manage your account and client relationship | Performance of a contract |
| To provide customer support and respond to inquiries | Legitimate interests (Art. 6(1)(f)) |
| To send service-related communications | Legitimate interests |
| To send marketing communications (if opted-in) | Consent (Art. 6(1)(a)) |
| To comply with legal obligations | Legal obligation (Art. 6(1)(c)) |
| To process special categories of data for clinical trials | Explicit consent (Art. 9(2)(a)) or other conditions under Art. 9(2) |
Information obtained through Google APIs is subject to the additional restrictions in section 5A below. Our general provisions concerning marketing, advertising, analytics, and data sharing do not authorize use of Google user data for those purposes.
You can withdraw your consent at any time by contacting compliance@menkentrials.com. Withdrawal does not affect the lawfulness of processing before your withdrawal.
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
5A. Google Drive integration and Google user data
Access and collection. Connecting Google Drive is optional. When you authorize the integration, Menken requests read-only access to Google Drive. This permission can technically allow access to all files available to your Google account. Menken uses it to browse folders you specify and import documents you select into your study workspace. We access file and folder identifiers, names, types, sizes, parent-folder information, and the contents of documents you choose to import. The integration does not modify or delete files in Google Drive.
Use and storage. We use this information only to provide or improve the integration and the document-management features visible in Menken. Imported documents and associated metadata are stored in Menken to support your study workflows. Where enabled for your study, imported documents may also undergo automated document processing and quality checks. We store an encrypted authorization token to maintain your connection.
Restrictions. We do not sell Google user data or use it for marketing, advertising, credit assessments, or unrelated purposes. We do not use it to train or improve general-purpose AI or machine-learning models. These restrictions also apply to information derived from Google user data.
Sharing and access. Imported documents are available to authorized users in your study workspace according to its access controls. We disclose Google user data to service providers only with your consent and as necessary to deliver or improve the features described above. Other disclosures are limited to security needs, legal requirements, or a business transfer with your explicit prior consent. Menken personnel and service providers may read identifiable Google user data only with your affirmative agreement to access specific data, where necessary for security, or where required by law.
Disconnecting and deletion. You can revoke Menken’s access through your Google Account’s third-party connections settings. Disconnecting within Menken removes the stored connection token. Disconnecting or revoking access does not automatically delete documents already imported into Menken. To request deletion of imported documents or associated data, contact compliance@menkentrials.com. Applicable clinical-trial recordkeeping requirements may require retention of certain records, as described in section 9.
Google policy compliance. Menken’s handling of information received through Google APIs complies with the Google API Services User Data Policy and the Google Workspace API User Data and Developer Policy, including their Limited Use requirements.
6. Cookies and similar technologies
We use cookies and similar technologies to operate our website, improve functionality, and analyze usage.
Google user data is not used for advertising cookies, ad targeting, or marketing profiles.
What are cookies?
Cookies are small text files placed on your device when you visit our website. They help us remember your preferences, understand how you use our site, and improve your experience. Cookies can be first-party (set by us) or third-party (set by other providers).
Types of cookies we use
– Strictly Necessary Cookies: Essential for our website to function properly (security, session management).
– Performance/Analytics Cookies: Collect information on how visitors use our site to help us improve it.
– Functionality Cookies: Remember choices you make to personalise your experience.
– Marketing Cookies (if used): Track your activity to help us deliver relevant ads. We will always request your consent for these.
7. International data transfers
Your personal data may be transferred and stored outside the European Economic Area (EEA). Whenever we transfer your data, we ensure adequate protection through:
– Adequacy decisions by the European Commission;
– Standard Contractual Clauses (SCCs) approved by the European Commission; or
– Other appropriate safeguards as required by law.
8. How we share your personal data
We may share your personal data with:
– Service providers who help us deliver our services (e.g., IT, cloud hosting, email providers).
– Clinical research partners, if relevant.
– Regulatory authorities or other parties if required by law.
We do not sell your personal data.
Sharing of Google user data is governed by section 5A.
9. Data retention
We only retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including for legal, accounting, or regulatory requirements.Client account data is retained during the business relationship plus five (5) years. Certain data, such as clinical trial documentation, may be retained longer if required by applicable regulations. We regularly review and securely delete or anonymise data that is no longer needed.
10. How we keep your data secure
We use appropriate technical and organisational measures to protect your data, including:
– Encryption of data in transit and at rest.
– Access controls and authentication measures.
– Staff training on data protection.
– Regular security audits and vulnerability testing.
– Incident detection and response procedures.
11. Your rights under GDPR
You have the following rights:
– Right to access your personal data
– Right to rectify inaccurate or incomplete data
– Right to erasure (“right to be forgotten”)
– Right to restrict processing
– Right to object to certain processing activities
– Right to data portability
– Right to withdraw consent at any time
– Right to lodge a complaint with your supervisory authority
12. How to exercise your rights
To exercise any of your rights or ask questions about your personal data, please email us at compliance@menkentrials.com.
We will respond without undue delay and in any event within one month
13. Supervisory authority
You have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): https://www.aki.ee/
14. Data breach notification
In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, we will notify the Estonian Data Protection Inspectorate within 72 hours and affected individuals where required.
15. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Significant changes will be communicated on our website or by direct notice where appropriate.
Last updated: 30.10.2026
16. Contact us
If you have any questions about this Privacy Policy or our data protection practices, please contact: compliance@menkentrials.com
