Privacy Policy

DataJoint Inc.

Last Updated: November 12, 2026

1. About This Policy

DataJoint Inc. (“DataJoint” “we,” “us,” or “our”) respects your privacy. This Privacy Policy (“Policy”) explains what personal information we collect through our public website at datajoint.com and through our related marketing and outreach activities, how we use that information, who we share it with, and the choices and rights available to you.

1.1 What this Policy covers

This Policy applies to personal information we collect when you:

visit or interact with datajoint.com and its public subdomains;
contact us or request information, pricing, a demonstration, or support through a web form, email address, chat, or messaging channel published on our website;
subscribe to a DataJoint newsletter or register for a DataJoint webinar, workshop, conference appearance, or other event;
respond to a DataJoint survey, questionnaire, or assessment;
apply for a position with DataJoint, including through a job posting on our LinkedIn company page; or
interact with DataJoint on a third-party platform such as LinkedIn, GitHub, or X (formerly Twitter).

1.2 What this Policy does not cover

Customer data in the DataJoint Platform.

This Policy does not apply to personal information contained in data, workflows, pipelines, or results that a DataJoint customer stores or processes in a DataJoint subscriber environment. We handle that information solely on the customer’s documented instructions under the Master Services Agreement and, as applicable, the Data Processing Agreement and Business Associate Agreement in place with that customer. In relation to that information we act as a processor, service provider, and/or business associate, not as a controller.

If you are a research participant, patient, study subject, employee, or other individual whose personal information a DataJoint customer has placed in the DataJoint Platform, please direct your privacy questions and requests to that customer, which is the party responsible for deciding how that information is used. If you contact us directly, we will refer your request to the relevant customer where we are able to identify them.

Third-party websites and services.

Our website contains links to websites, repositories, and services operated by others. This Policy does not apply to those properties, and we are not responsible for their content or their privacy practices. Please review the privacy notice of any third-party site before providing information to it.

Information that you provide to us may be governed by a separate, more specific confidentiality agreement or notice. In the event of any conflict between such an agreement or notice and this Privacy Policy, the terms of the more specific agreement or notice will take precedence.

2. Who We Are and How to Reach Us

DataJoint Inc. is a Delaware corporation. For the purposes of the EU General Data Protection Regulation and the UK GDPR, DataJoint is the controller of the personal information described in this Policy.

You can reach our privacy team at:

Email: privacy@datajoint.com
Post: DataJoint Inc., Attn: Privacy, 4201 Main Street, Suite 212, Houston, TX 77002
EU representative: Instant EU GDPR Representative Limited, Office 2, 12A Lower Main Street, Lucan, Co. Dublin, K78 X5P8, Ireland. Tel: +353 (0) 1 554 9700. Email: contact@gdprlocal.com. Request form: https://datajointinc.gdprlocal.com/eu
UK representative: GDPR Local Ltd, 1st Floor Front Suite, 27-29 North Street, Brighton, England, BN1 1EB, United Kingdom. Tel: +44 (0) 1772 217800. Email: contact@gdprlocal.com. Request form: https://datajointinc.gdprlocal.com/uk

We have appointed GDPR Local Ltd as our representative in the United Kingdom and Instant EU GDPR Representative Limited as our representative in the European Union, in accordance with Article 27 of the UK GDPR and the EU GDPR. If you are located in the EEA or the UK, you may contact our representative instead of, or in addition to, contacting us directly, including to exercise your privacy rights. You may also submit a request through our representative’s online request forms: for the EU, https://datajointinc.gdprlocal.com/eu, and for the UK, https://datajointinc.gdprlocal.com/uk.

3. Information We Collect

3.1 Information you provide to us

We collect the information you choose to give us, which may include:

Identity and contact details — name, job title, institution or company, business email address, business phone number, and country or region;
Professional details you choose to share — research interests, field of study, publications, and similar biographical information;
The content of your communications with us — including email, web form submissions, chat and chatbot messages, and webinar questions;
Recordings of calls and meetings, where we have told you in advance and given you the opportunity to decline;
Survey and questionnaire responses;
Marketing and communication preferences; and
Information you post publicly on DataJoint’s social media, community, or repository channels.

Please do not send sensitive information through our public website.

Our public web forms, chat, and general inboxes are not an appropriate channel for protected health information, patient or research-participant data, human subject data, or other sensitive personal information. Please use the secure channels established under your DataJoint agreement instead. We do not seek to collect sensitive categories of personal information through our public website.

3.2 Information we collect automatically

When you visit our website we automatically collect:

Device and connection data — IP address, device type, operating system, browser type and version, screen dimensions, language setting, and connection information;
Usage data — pages viewed, referring URL, links and content clicked, files downloaded, search terms used on our site, and the dates and times of access;
Approximate location — derived from your IP address, at city or region level; we do not collect precise geolocation from your device; and
Information collected by cookies, pixels, tags, and similar technologies, as described in Section 6.

3.3 Information we receive from other sources

This Policy applies whether you provide information directly to us or we obtain it from a third party, such as your employer. Sources include:

Your employer, institution, or a colleague who provides your contact details;
Publicly available and professional sources, including institutional web pages, publication and grant databases, conference programs, and professional networks;
Event co-hosts, conference organizers, and channel or referral partners, where they have a lawful basis to share the information with us; and
Our analytics, marketing, and security service providers.

4. How We Use Personal Information

We use personal information to:

respond to your inquiries and requests, including demonstration, pricing, and support requests;
send you newsletters, product and release updates, event invitations, and other marketing communications you have asked for or that are permitted by law, and manage your preferences;
operate, administer, secure, and improve our website;
conduct internal analysis and research to understand how our website is used and to improve our products, services, and content;
organize and run webinars, workshops, and events, and follow up with attendees;
manage our relationships with the scientific and open-source communities we participate in;
detect, investigate, and prevent fraud, abuse, security incidents, and other unlawful activity; and
comply with our legal obligations and establish, exercise, or defend legal claims.

5. Legal Bases for Processing (EEA, UK, and Switzerland)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases:

Performance of a contract, or steps taken at your request before entering into one — for example, responding to a request for a proposal or a demonstration.
Compliance with a legal obligation — for example, responding to a data subject request or meeting tax and accounting requirements.
Our legitimate interests — in operating, securing, and improving our website, in understanding how it is used, in promoting our products to professional and institutional audiences, and in protecting our legal rights. We balance these interests against your rights and freedoms, and you may object as described in Section 12.
Your consent — where required, for example for certain marketing communications and for non-essential cookies. You may withdraw consent at any time, which does not affect processing carried out before withdrawal.

For more information regarding our legitimate interests as applied to your personal information, please contact us using the contact information in Section 2.

6. Cookies, Analytics, and Similar Technologies

Cookies are small text files placed on your device. We and our service providers use cookies and similar technologies — including pixels, tags, and web beacons — for the following purposes:

Strictly necessary — to make the site work, route traffic, and protect against abuse. These cannot be switched off.
Preferences — to remember choices such as your language or whether you have dismissed a banner.
Analytics — to understand how visitors find and use our site so we can improve it. We use Google Analytics and Google Tag Manager for this purpose.
Marketing and attribution — to measure the effectiveness of our campaigns and to understand which content leads to inquiries. We use HubSpot for this purpose.

Some of our website pages may contain electronic images known as web beacons (also known as clear gifs, tags, or pixels) that allow us to count users who have visited our pages. Web beacons collect only limited information, e.g., a cookie number, time and date of a page view, and a description of the page on which the web beacon resides. We may also include web beacons in email messages or newsletters to track whether you open the messages. We use this information to customize our services and measure the overall effectiveness of our content, communications, and other services we provide.

6.1 Your choices

You can remove or block cookies through your browser settings, though some features of the site may not work as intended. Where required by law, we ask for your consent before setting non-essential cookies and you can change your choices at any time through our cookie preferences control.

You can also opt out of Google Analytics across all websites using the browser add-on Google provides at tools.google.com/dlpage/gaoptout.

6.2 Do Not Track and Global Privacy Control

Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. We do not respond to browser-based DNT signals, as the industry has not settled on a common standard for them.

We do, however, recognize the Global Privacy Control (“GPC”), an opt-out preference signal that your browser or extension can send on your behalf. Where applicable state law requires it, we treat a GPC signal as a valid request to opt out of the sale or sharing of personal information and of targeted advertising for the browser that sends it.

7. How We Share Personal Information

We may disclose your personal information to third parties as follows:

Service providers and processors who act on our documented instructions — including website and infrastructure hosting, customer relationship management and marketing automation, analytics, email delivery, event and webinar platforms, customer support tooling, and security services. They are bound by contract to use the information only to provide services to us.
Professional advisors — our lawyers, auditors, accountants, and insurers, where they need the information to advise us.
Legal, safety, and regulatory recipients — where disclosure is necessary to comply with applicable law, to respond to a lawful request from a public authority or a valid legal process, or to establish, exercise, or defend legal claims or protect the rights, safety, and property of DataJoint or others.
Corporate transactions — in connection with a merger, acquisition, financing or due diligence process, reorganization, insolvency, or sale of all or part of our business, your information may be transferred as part of that transaction, subject to applicable law and to the recipient continuing to protect it consistently with this Policy.
When we have your consent to do so, or at your direction;

We may also share information that has been aggregated or de-identified so that it can no longer reasonably be used to identify you. We maintain such information in de-identified form and do not attempt to re-identify it.

7.1 We do not sell your personal information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act and comparable US state privacy laws. We have not done so in the preceding twelve months. We do not knowingly sell or share the personal information of anyone under 16.

8. Artificial Intelligence and Automated Decision-Making

We do not use personal information collected through our public website to train machine learning or generative artificial intelligence models.

We do not make decisions that produce legal effects concerning you, or similarly significant effects, based solely on automated processing, and we do not engage in profiling for such purposes.

We may use AI-assisted features within the business tools we license — for example to draft, summarize, or route communications — subject to human review. Our providers are contractually restricted from using our data to train their own general-purpose models.

9. International Transfers

DataJoint is a United States company and processes personal information on servers in the United States. We may transfer, maintain, or process personal information on servers or databases outside your own country. Some of these countries may not provide the same level of protection for personal information as the country in which you are located.

Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum for transfers from the United Kingdom, and we carry out transfer impact assessments where appropriate. For transfers from Switzerland, we apply the Standard Contractual Clauses with the adaptations required by the Swiss Federal Data Protection and Information Commissioner, under which references to the General Data Protection Regulation are read as references to the Swiss Federal Act on Data Protection and the Commissioner is recognized as a competent supervisory authority. You may request a copy of the relevant safeguards by contacting us at privacy@datajoint.com. All DataJoint service providers are required to comply with our data protection policies and procedures, applicable laws, and the terms of our customer contracts governing the collection and use of information.

If you are visiting from the European Union (“EU”) or other regions with laws governing data collection and use, please note that by using our website, making an inquiry, or otherwise providing us with personal information, that information will be transferred to the United States and processed there under the safeguards described above.

10. How Long We Keep Personal Information

We will retain your personal information for as long as required to perform the purposes for which the data was collected, depending on the legal basis for which that data was obtained and whether additional legal or regulatory obligations require us to retain it.

In practice this means:

Marketing contacts — retained while you remain subscribed and for a reasonable period afterwards; if you unsubscribe we keep a minimal suppression record indefinitely so that we do not contact you again.
Inquiry, demonstration, and event records — retained for the duration of the discussion and for a defined period afterwards in line with our records schedule.
Website analytics data — retained according to the retention settings configured with our analytics providers.
Records we must keep for tax, accounting, or other legal obligations, or to establish, exercise, or defend legal claims — retained for the period required by law or the applicable limitation period.

11. Security

We have implemented administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, and disclosure. Our security program is assessed under SOC 2 Type II. Despite these measures, no data transmission over the Internet can be entirely secure, and we cannot guarantee or warrant the security of any information you transmit via our website.

We make reasonable efforts to restrict access to information to only those employees, contractors, and agents who need such access in order to operate, develop, improve, or deliver our programs, products, and services.

DataJoint will never send an email, text message, or other communication asking for your password or sign-in credentials. Always sign in directly to your DataJoint account at the DataJoint website.

If we become aware of a security incident affecting your personal information, we will notify you and any applicable regulator as required by law. Where the law permits, we may provide that notice by email. If you would prefer to receive any such notice in writing, contact us at privacy@datajoint.com.

12. Your Privacy Rights

Depending on where you live, you may have some or all of the rights described below. To exercise any of them, contact us at privacy@datajoint.com. We do not discriminate against anyone for exercising a privacy right.

12.1 Rights available to everyone

Regardless of where you are located, you may ask us to provide a copy of the personal information we hold about you, correct information that is inaccurate or incomplete, delete information we no longer need, or stop sending you marketing communications.

12.2 EEA, United Kingdom, and Switzerland

If you are in the EEA, the UK, or Switzerland, you have the rights to access, rectification, erasure, restriction of processing, data portability, and to object to processing carried out on the basis of our legitimate interests or for direct marketing. You may withdraw consent at any time where we rely on it. You may also contact our EU or UK representative, listed in Section 2, about any of these rights.

If you object to our processing of your personal information, you have the right to complain to the data protection authority (“DPA”) in the country where you reside, where you work, or where the alleged infringement of data protection laws has taken place. We would appreciate the chance to address your concerns first, but you are not required to contact us before contacting a regulator.

12.3 United States — state privacy rights

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, your state’s privacy law may give you the right to:

confirm whether we process your personal information and access it;
obtain a copy in a portable, machine-readable format;
correct inaccuracies;
delete personal information we have collected from you;
opt out of the sale of personal information, of targeted advertising, and of profiling in furtherance of decisions producing legal or similarly significant effects; and
limit our use and disclosure of sensitive personal information.

As described in Sections 3.1 and 7.1, we do not sell personal information, we do not use it for targeted advertising or such profiling, and we do not seek to collect sensitive personal information through our public website. You may nonetheless submit a request and we will respond.

You may use an authorized agent to submit a request on your behalf; we may ask the agent for proof of authorization and may ask you to verify your identity directly.

Appeals.

If we decline your request, you may appeal by replying to our response or writing to privacy@datajoint.com with the word “Appeal” in the subject line. We will respond to an appeal within the period your state’s law allows and, if we deny it, we will tell you how to contact your state attorney general.

12.4 Additional information for California residents

DataJoint does not share your personal information with third parties for their direct marketing purposes, as defined by California Civil Code Section 1798.83, unless we give you the choice (opt-in or opt-out) before sharing with those third parties. If you are a California resident and you have questions about our practices with respect to sharing information with third parties for their direct marketing purposes and your ability to exercise choice, please contact us at privacy@datajoint.com or by post at the address in Section 2. You must put the statement “Your California Privacy Rights” in the body of your request, as well as your name, street address, city, state, and zip code.

California residents also have the rights described in Section 12.3. We have not sold or shared personal information for cross-context behavioral advertising in the preceding twelve months, and we do not use or disclose sensitive personal information for purposes that require an option to limit it.

12.5 How we handle requests

We respond to requests under the EU or UK GDPR without undue delay and within one month, which may be extended by two further months where a request is complex or where we receive a number of requests from you. We respond to requests under US state privacy laws within 45 days, which may be extended once by a further 45 days where reasonably necessary; we will tell you if we need the extension and why. We act on opt-out requests, including opt-out preference signals, promptly and in any event within 15 business days.

We provide the information requested free of charge, except where requests are manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable fee or decline to act, and will tell you why before proceeding. We may ask for information sufficient to verify your identity before acting on a request, and we will use that information only for verification.

13. Marketing Communications

We will respect your wishes not to receive marketing communications. You can change your marketing preferences by contacting us. If you gave us your email address to receive marketing communications, you can opt out at any time by using the unsubscribe links or instructions included at the bottom of our emails. Please note that we will continue to send you service-related communications regardless of any opt-out request. We will not sell or share your information with third parties for their own promotional or marketing purposes unless you give us consent to do so and where permitted by applicable law.

If we want to use your information for a purpose not described in this Privacy Policy, we will first provide notice and, where required, obtain your consent.

14. Children’s Privacy

Our website and online services are intended for professional, academic, and institutional audiences. They are not directed to children, and we do not knowingly collect personal information from children.

The Children’s Online Privacy Protection Act applies to the online collection of personal information from children under 13. We do not knowingly collect personal information from anyone under 13. If we learn that we have collected personal information from a child under 13 without verifiable parental consent, we will delete it promptly. If you believe a child under 13 has provided us with personal information, contact us at privacy@datajoint.com and we will take appropriate action.

15. Third-Party Links and Social Media

We may provide links to other websites or resources that are not part of DataJoint’s products, programs, or services. DataJoint does not control these websites or their privacy practices, and any information you provide to other sites is subject to the privacy policies of those sites and not this Policy.

The privacy policies of social media platforms and websites we utilize to engage with the DataJoint community are listed below.

GitHub docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement
LinkedIn linkedin.com/legal/privacy-policy
Stack Overflow policies.stackoverflow.co/stack-overflow/privacy-policy/
X (formerly Twitter) x.com/en/privacy
YouTube policies.google.com/privacy

16. Changes to This Policy

From time to time, we may change and update this Privacy Policy. If this Privacy Policy changes in any way, we will post an updated version on this page and revise the “Last Updated” date above. We recommend you regularly review this page to ensure that you are always aware of our information practices. Where a change is material, we will provide a more prominent notice, which may include emailing you. Changes take effect when posted and do not affect any dispute arising before the effective date of the change.

17. How to Contact Us

Questions, comments, and requests regarding this Policy should be addressed to DataJoint’s Privacy team via email to privacy@datajoint.com or via US mail to:

DataJoint Inc., Attn: Privacy, 4201 Main Street, Suite 212, Houston, TX 77002

If you are located in the EEA or the UK, you may also contact our EU or UK representative using the details in Section 2.

We appreciate your interest in DataJoint and your involvement in the scientific community we serve.