This Privacy Policy describes how Aube Research ("Aube Research", "we", "us", or "our") collects, uses, stores, discloses, and protects personal data obtained through this website (auberesearch.com) and through any engagement with our services. It applies to all visitors and to all individuals who communicate with us in the context of an enquiry or professional engagement.
By using this website or submitting personal data to us, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, you should not use this website or submit personal data to us. This policy should be read alongside our Terms & Conditions.
1. Identity and contact details
Aube Research is a specialist patent analytics practice operated as an independent professional services provider. For all privacy-related matters contact us at:
Aube Research
Email: hello@auberesearch.com
Subject line: Privacy Request
We acknowledge all privacy communications within five business days and aim to resolve substantive requests within 30 calendar days. We do not designate a formal Data Protection Officer as we do not meet the thresholds requiring mandatory appointment; however, all privacy matters are handled directly and promptly.
2. Scope of this policy
This policy covers personal data collected through: (a) use of this website; (b) submission of our contact form; (c) direct email correspondence; (d) the course of a professional engagement. It does not cover data practices of third-party websites linked from this site, or the practices of clients who share third-party personal data with us as part of an engagement — in such cases the client is the data controller and Aube Research acts as processor under agreed terms.
3. What personal data we collect
3.1 Data you provide directly
Contact form submissions: name, organisation, email address, service required, and matter description. Direct email correspondence: the contents of that correspondence including any attachments. Engagement data: billing details, jurisdiction, technical documents, patent numbers, and any other information shared for the purpose of performing the agreed services. We do not collect payment card information — invoicing is handled outside this website.
3.2 Automatically collected data
Server logs may capture: IP address, date and time of visit, pages accessed, HTTP referrer, browser type and version, and operating system. This data is used solely for security monitoring and technical maintenance. It is not linked to personal profiles and is not used for behavioural analysis.
3.3 Data we do not collect
We do not collect special categories of personal data (health, biometric, racial or ethnic origin, political opinions, religious beliefs, criminal records). We do not collect financial account credentials. We do not use tracking pixels, fingerprinting scripts, or behavioural advertising tools. We do not operate social login or single sign-on integrations that would allow third-party platforms to track visits to this site.
3.4 Cookies and storage
This website does not use persistent tracking or advertising cookies. No third-party analytics scripts (including Google Analytics, Meta Pixel, or equivalents) are loaded. Any session-level browser storage used for basic functionality contains no personally identifiable information and is cleared on session end. You may block all cookies in your browser without any loss of functionality on this website.
4. Legal basis for processing
We process personal data only where a lawful basis exists. The bases we rely on are:
Legitimate interests (Article 6(1)(f) GDPR / equivalent): responding to unsolicited enquiries, maintaining website security, fraud prevention, and internal record-keeping. We have conducted a legitimate interests assessment and concluded our interests do not override the rights of individuals given the limited scope of processing.
Contract performance (Article 6(1)(b) GDPR / equivalent): processing necessary to deliver agreed services, issue quotes, and manage the engagement.
Legal obligation (Article 6(1)(c) GDPR / equivalent): where retention or disclosure is required by applicable law, tax regulation, or binding court or regulatory order.
Consent (Article 6(1)(a) GDPR / equivalent): for any optional communications or purposes not covered above. Consent may be withdrawn at any time; withdrawal does not affect the lawfulness of prior processing.
We do not rely on vital interests or public task as a legal basis for any processing we undertake.
5. Purposes of processing
We use personal data for the following purposes only: evaluating and responding to enquiries; performing contracted patent analytics services; issuing project scopes, quotes, and invoices; communicating about engagement status and deliverables; maintaining professional records; complying with applicable legal obligations; and maintaining the security and integrity of this website. We do not use personal data for direct marketing, profiling, or sale to third parties under any circumstances.
6. Confidentiality of engagement data
All matter-specific information — the subject technology, the legal or commercial question, identities of third parties, patent numbers, and documents provided — is treated as strictly confidential independently of this Privacy Policy. We do not disclose engagement information to any third party without prior written consent, except where compelled by law. We will notify you of any legally compelled disclosure to the extent permitted by the relevant legal process. We are willing to execute a mutual NDA before any substantive discussion; please indicate this in your initial enquiry.
7. Disclosure and third-party sharing
We do not sell, rent, license, or transfer personal data to third parties for commercial purposes. Disclosure occurs only in the following limited and defined circumstances:
Service delivery: where we engage a sub-contractor or specialist researcher to assist with an engagement, that person is bound by confidentiality obligations at least as protective as those in this policy and processes data only for the specified purpose.
Professional advisors: our legal or accounting advisors may access data strictly as necessary for the provision of professional advice, subject to professional confidentiality obligations.
Legal compulsion: where required by applicable law, regulation, court order, or binding regulatory directive. We will disclose only the minimum data required and will seek to notify you where legally permissible.
Business transfer: in the event of a merger, acquisition, or transfer of substantially all assets, personal data may be transferred to the successor entity, which will be required to honour this policy or provide equivalent protections. We will notify affected individuals of any such transfer.
We do not share data with advertising networks, data brokers, social media platforms, or analytics vendors under any circumstances.
8. International data transfers
This website is operated from India. If you are located in the EEA, UK, Switzerland, or another jurisdiction that restricts cross-border data transfers, your personal data will be processed outside your country of residence when you contact us or engage our services. We ensure adequate protection through: contractual safeguards functionally equivalent to EU Standard Contractual Clauses where applicable; maintaining data minimisation principles that limit the volume of personal data involved; and restricting processing to the specific purpose for which data was provided. Where a transfer adequacy mechanism is required under applicable law, we will implement one before processing proceeds.
9. Data retention
Enquiries that do not proceed to engagement: deleted after 12 months. Active engagements: retained for the duration of the engagement plus five years from completion, to meet professional obligations and potential dispute resolution needs. Invoicing records: retained for seven years in accordance with tax and accounting obligations under Indian law. Server logs: deleted or anonymised within 90 days. Marketing consents (if any): retained until withdrawn, then deleted promptly. We do not retain data beyond these periods except where required by a specific legal obligation, in which case the data is segregated and not used for any other purpose.
10. Security
We implement technical and organisational measures appropriate to the risk, including: access controls limiting data access to authorised personnel on a need-to-know basis; use of encrypted transmission protocols (TLS) for all data in transit; secure storage practices for data at rest; regular review of our security practices; and prompt response procedures for suspected security incidents. No electronic transmission or storage method is completely secure. We cannot guarantee absolute security but commit to notifying you without undue delay of any breach that is likely to result in a high risk to your rights and freedoms, and to notifying relevant supervisory authorities where required by law.
11. Your rights
Subject to the laws of your jurisdiction, you may have the following rights:
Access: obtain confirmation of whether we process your data and a copy of that data along with processing information.
Rectification: require correction of inaccurate or completion of incomplete data.
Erasure: request deletion where processing is no longer necessary, consent has been withdrawn, or processing is unlawful — subject to our legal retention obligations.
Restriction: require that we limit processing while accuracy is contested, a legitimate interests objection is pending, or processing is unlawful but you oppose erasure.
Portability: receive data you provided under contract or consent in a structured, machine-readable format, and transmit it to another controller where technically feasible.
Objection: object to processing based on legitimate interests or direct marketing. For direct marketing objections we will comply without requiring justification. For other objections we will comply unless we can demonstrate compelling legitimate grounds.
Withdrawal of consent: withdraw consent at any time where processing is consent-based, without affecting prior lawful processing.
No automated decisions: not to be subject to solely automated decisions producing significant legal or similarly significant effects. We do not conduct such processing.
Indian DPDPA rights: if you are a Data Principal under India's Digital Personal Data Protection Act, 2023, you have the right to access a summary of processed data, correction and erasure, grievance redressal, and nomination of another individual to exercise rights on your behalf.
To exercise any right, contact us at hello@auberesearch.com with subject line Privacy Request, including sufficient detail to identify your request. We will verify your identity before acting on any request. Response within 30 calendar days; complex requests may take up to 90 days with notice given. No fee for reasonable requests; we reserve the right to charge a reasonable fee or decline manifestly unfounded or excessive requests, with written reasons.
12. Grievance and complaints
If you have a concern about how we have handled your personal data, contact us at hello@auberesearch.com in the first instance. We commit to acknowledging complaints within five business days and providing a substantive response within 30 days. If you are in the EEA or UK and remain dissatisfied, you may lodge a complaint with your local supervisory authority (e.g. your national data protection authority or the UK ICO). If you are in India, you may raise a grievance through the mechanism established under the DPDPA once the relevant provisions are in force.
13. Children
This website is directed exclusively at professionals. We do not knowingly collect personal data from individuals under the age of 18. If we become aware that a minor has submitted data to us, we will delete it promptly. If you believe a minor has provided data to us, notify us immediately at hello@auberesearch.com.
14. Third-party links
This website may contain links to external resources. We exercise no control over those sites and are not responsible for their content or privacy practices. This policy does not apply to any external site. We encourage you to review the privacy policy of any site you navigate to from this website. The presence of a link does not constitute endorsement.
15. Formspree (contact form processor)
Our contact form submits data to Formspree, Inc., a third-party form processing service. When you submit the contact form, your name, email, organisation, service selection, and message are transmitted to Formspree's servers before being forwarded to us. Formspree acts as a data processor on our behalf. Their privacy practices are governed by the Formspree Privacy Policy. We do not use Formspree for any purpose other than routing contact form submissions to us.
16. Changes to this policy
We may update this policy to reflect changes in law, technology, or our practices. Material changes will be reflected in an updated effective date at the top of this page. For significant changes we will take reasonable steps to bring the update to your attention. Continued use of the website following any update constitutes acceptance of the revised policy. We recommend reviewing this page periodically.
17. Governing law
This policy is primarily governed by the laws of India, including the Information Technology Act, 2000, the IT (Reasonable Security Practices) Rules, 2011, and the Digital Personal Data Protection Act, 2023. For individuals in the EEA and UK, the GDPR and UK GDPR respectively apply to our processing of their personal data, and we commit to compliance with both frameworks. For individuals in other jurisdictions with applicable data protection laws, we will comply with those laws to the extent they apply to our activities.
Questions about this policy? Contact us at hello@auberesearch.com with the subject line Privacy Request. We aim to respond within five business days.