Mesozoic Research Center values the trust that institutions, researchers, students, and visitors place in our laboratory. This Privacy Policy explains what information we collect, why we collect it, how we handle it, and which choices are available to the people who interact with our website, our field programs, and our collection services. The policy applies to Mesozoic Research Center and to the systems we operate for partner institutions. It is written and maintained by the developer Mesozoic Research on behalf of the company.
Mesozoic Research Center is a computer systems design and integration practice serving paleontology field research, specimen preparation, and permanent collection curation. Our registered location is 142 S 1200 E, Salt Lake City - 84102-1643, United States (US). We operate as a professional, scientific, and technical services provider and we treat personal information as a professional obligation rather than a marketing asset.
By using our website, submitting a form, contacting our team, enrolling in a field school, or taking part in a research visit, you acknowledge that you have read this policy. If you do not agree with the practices described here, please do not submit personal information to us and contact our team so that we can discuss the matter directly.
This policy describes our current practices in plain language. We do not sell personal information, we do not run advertising networks on our website, and we do not build behavioural profiles of visitors.
This policy covers personal information collected through the Mesozoic Research Center website, through email and telephone correspondence with our staff, through field school enrolment forms, through research visit scheduling, and through support requests submitted by partner institutions. It also covers information collected when our team installs and configures systems at an institution and must create administrative accounts for that work.
The policy does not cover the independent data practices of partner museums, universities, or government agencies that host our work. Those institutions publish their own privacy notices, and their notices apply to records they hold about students, employees, and members of the public. The policy also does not cover third party websites that we link to for reference.
When we operate a system on behalf of an institution, that institution remains the controller of the personal information held in it. We act as a service provider under written instruction, and we handle that data only for the purposes the institution has specified. Questions about records held in an institution system should be directed to that institution in the first instance.
We collect information that you provide directly, information generated when you use our website, and limited information from professional sources when we prepare a proposal for an institution. The categories are described below.
We do not ask for government identification numbers, payment card numbers, health information, or biometric data through this website. If a project requires any of those categories, we arrange a separate written agreement with the institution and collect the data through a controlled process rather than through the public site.
Most of what we hold arrives directly from you. You may send a note through the contact form, write to research@mesozoicresearch.autos, call our lab line at +18025756837, or speak with a member of our team during a site visit. When you use the contact form, your email client prepares a message that you review and send yourself, and the information reaches us as ordinary email.
During an installation, our engineers create administrative accounts and record configuration details. Those records include the names and roles of staff members who will operate the system. We collect that information under the instruction of the institution and we keep it separate from our website records.
Our web server writes standard access logs for security and troubleshooting. We read those logs when investigating an incident, a broken page, or an unusual traffic pattern. We do not use the logs to track individual visitors across sessions and we do not combine them with other sources to build a profile.
We use personal information for the following purposes, each of which relates to our professional services. We do not use information for purposes that are incompatible with the reason it was collected.
We do not use personal information to send unsolicited advertising. If an institution asks to receive occasional updates about the summer quarry calendar or new service phases, we send those updates only to the contacts who requested them, and every message includes a straightforward way to stop receiving them.
Where data protection law requires a legal basis for processing, we rely on one or more of the following grounds. Where we rely on consent, you may withdraw that consent at any time by contacting us, and withdrawal does not affect processing that already took place.
Our legitimate interests include responding to professional enquiries, securing our systems, maintaining accurate project records, and protecting the confidentiality of unpublished research. We assess those interests carefully whenever a request touches on sensitive personal information.
Like most professional firms, we rely on a small set of vendors for email delivery, file storage, accounting, and system monitoring. Each vendor is selected for a defined task and is bound by a written agreement that limits its use of our information. Vendors may process information outside the United States, and Section 15 describes how we manage those transfers.
We review vendor security practices before onboarding and at least once a year after that. Reviews consider access controls, encryption in transit and at rest, incident notification commitments, and the vendor record of data breaches. A vendor that cannot meet our requirements is not used, even if its price is attractive.
When an institution system requires a vendor component that we do not normally use, we describe that component in the proposal so the institution can review it before approval. The institution may reject a component and ask for an alternative, and we will propose one that meets the same functional need.
Paleontology work produces records that are valuable to science and sometimes sensitive in the short term. Unpublished locality information can expose a site to damage, and specimen records may contain the names of private landowners or volunteers. We treat research records with the same care we apply to personal information.
Locality coordinates, site notes, and unregistered specimen photographs are held in restricted systems until a curator authorises release. Access is granted by role, reviewed each season, and recorded in an audit trail. When we produce an export for a researcher, the export carries a record of who requested it, what was included, and the date it was produced.
Where a record combines specimen data with the name of a person, such as a finder, a preparator, or a landowner contact, we handle the combined record as personal information and apply the retention rules in Section 12. Institutions that share such records with us should confirm that they have the authority to do so.
We maintain administrative, technical, and physical safeguards designed to protect personal information from loss, misuse, and unauthorised access. Those safeguards include role based access control, encrypted connections, routine software updates, restricted physical access to our lab, and periodic review of accounts.
Our engineers follow a written change procedure for client systems, and every administrative action is logged. Backups are encrypted and tested, and recovery procedures are documented in the owner manual delivered at hand off. Staff receive privacy and security training when hired and at least once a year after that.
No system is perfectly secure. If we become aware of an incident that affects personal information, we will investigate promptly, contain the effect, notify affected institutions and individuals as required by law, and describe the corrective steps we have taken. We will not delay a required notification while we search for a way to avoid it.
We keep personal information only as long as it is needed for the purpose it was collected, for the life of a professional engagement, or for a period required by law. The following schedule describes our usual practice.
When a retention period ends we delete or anonymise the information. If records are subject to a legal hold, we preserve them until the hold is lifted and then resume the normal schedule. Institutions may request earlier deletion of their project data where no legal obligation prevents it.
Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of the personal information we hold about you. You may also have the right to object to certain processing and to withdraw consent where consent is the basis for processing.
To exercise a right, write to research@mesozoicresearch.autos or call +18025756837. Include enough detail for us to locate your records, such as the institution involved and the approximate date of your enquiry. We will confirm receipt, verify your identity where needed, and respond within the period required by applicable law, generally forty five days.
We will not charge a fee for a reasonable request, and we will not discriminate against you for exercising a privacy right. If a request concerns records held in an institution system, we will forward it to the institution and cooperate with that institution response.
Residents of California are entitled to specific disclosures under the California Consumer Privacy Act as amended. In the previous twelve months we have collected the categories of information described in Section 3: identifiers, professional or employment information, internet or network activity, and commercial information relating to institutional purchases.
We have not sold personal information and we do not share it for cross context behavioural advertising. We collect and use the categories above for the business purposes listed in Section 5, and we disclose them to the service providers described in Section 9 under written contracts that prohibit other uses.
California residents may request to know, delete, or correct personal information, and may request a portable copy. Write to research@mesozoicresearch.autos with the subject line Privacy Request. We will verify your identity using information already on file and will respond within the statutory period. An authorised agent may submit a request on your behalf with written permission.
Our laboratory and records are located in the United States. If you contact us from another country, your information will be transferred to the United States and processed under this policy. Data protection rules in the United States may differ from the rules in your home country.
When a partner institution outside the United States requires a transfer agreement, we use standard contractual clauses or an equivalent mechanism and we document the transfer in the project file. For research collaborators, we limit the information shared to the records needed for the specific visit or publication.
Visitors who prefer to keep information within their own jurisdiction may contact us by telephone and arrange a review of published material without submitting personal details through the website. We will accommodate reasonable requests where the research purpose allows it.
Our website and services are intended for professional audiences, university programs, and adult researchers. We do not knowingly collect personal information from children under the age of thirteen through this website. Field school programs that include younger students operate under the direct supervision of the host institution and its own parental consent process.
If we learn that we have collected information from a child under thirteen without the required consent, we will delete the information promptly. A parent or guardian who believes that a child has submitted information to us should write to research@mesozoicresearch.autos so that we can investigate and remove the record.
Our pages may link to scientific publications, institutional websites, or equipment suppliers for reference. Those sites operate under their own privacy policies, and we are not responsible for their content or their data practices. We encourage you to read the privacy notice of any site before submitting personal information to it.
A link does not imply that we endorse a third party product, and we do not receive compensation for links placed on this website. If you find a link that appears misleading, please report it to our team so that we can review it.
We review this policy at least once a year and whenever we introduce a new service, a new vendor, or a change in the way we handle personal information. When a change is material, we update the effective date at the top of the page and, where we hold a contact address for you, we send a short notice describing the change.
Continued use of our website after a revised policy takes effect indicates acceptance of the revision. If you object to a change, please contact us before continuing to use the affected service. We will explain the options available, including closure of an account or deletion of records where no legal obligation prevents it.
Questions about this policy, requests to exercise a privacy right, and reports of a possible incident are all welcome. Please include enough detail for us to respond usefully, and let us know if a matter is urgent.
Mesozoic Research Center
142 S 1200 E, Salt Lake City - 84102-1643, United States (US)
Email: research@mesozoicresearch.autos
Phone: +18025756837
If you are not satisfied with our response, you may raise the matter with the privacy authority in your jurisdiction. We will cooperate fully with any lawful inquiry and will provide the records needed to resolve the concern.