Lab41 (“we”, “us”, “our”) is committed to protecting and respecting your privacy. This Privacy Policy explains what personal data we collect when you visit lab41.co, how we use it, who we share it with, and what rights you have under UK data protection law.
This policy applies to personal data collected through the website https://lab41.co/ and does not extend to any other websites operated by third parties linked from this site.
1. Who We Are
Data controller: Lab41
Website: https://lab41.co/
Contact: Use the contact form on our website to reach us for any data protection queries.
Lab41 is a trading name operating in the United Kingdom. As the data controller, we determine the purposes and means of processing your personal data.
2. What Personal Data We Collect
We collect personal data in the following ways:
2a. Contact form
When you submit the enquiry form on our website, we collect:
- Name
- Company name
- Email address
- Message content you provide in the form
This data is submitted to Formspree (our form processing service) and forwarded to our business email address. Formspree temporarily stores submitted data on its servers. See section 5 (Third-Party Processors) for details.
2b. Usage and analytics data
We use Google Tag Manager to manage analytics tags on this website. Through these tags, we may collect:
- Pages visited and time spent on the site
- Browser type, device type, and operating system
- Approximate geographic location (country/city level, derived from IP address)
- Referral source (how you arrived at the site)
- Anonymous session identifiers
This data is collected in aggregate and is not used to identify you personally. Your IP address is anonymised before storage.
3. Legal Basis for Processing
We rely on the following lawful bases under the UK GDPR:
| Processing activity | Lawful basis |
|---|---|
| Responding to your contact form enquiry | Legitimate interests — to respond to a business enquiry you have initiated (Article 6(1)(f)) |
| Website analytics (Google Tag Manager) | Legitimate interests — to understand how visitors use our website and improve our services (Article 6(1)(f)) |
Where we rely on legitimate interests, we have carried out a balancing test and are satisfied that our interests are not overridden by your rights and freedoms. You may object to processing based on legitimate interests at any time — see section 7 (Your Rights).
4. How We Use Your Personal Data
We use your personal data only for the purposes described at the time of collection:
- Contact form submissions — to respond to your enquiry and, if appropriate, progress a business relationship.
- Analytics data — to understand website performance, identify areas for improvement, and measure the effectiveness of our marketing.
We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.
5. Third-Party Processors
We share personal data with the following processors, each subject to appropriate data processing terms:
| Processor | Purpose | Location | Privacy information |
|---|---|---|---|
| Formspree, Inc. | Form submission processing and delivery | United States (EU/UK adequacy mechanisms apply) | Formspree Privacy Policy |
| Google LLC | Tag management and website analytics (Google Tag Manager / Google Analytics) | United States (EU/UK adequacy mechanisms apply) | Google Privacy Policy |
| Cloudflare, Inc. | Website hosting and content delivery network (CDN) | United States (EU/UK adequacy mechanisms apply) | Cloudflare Privacy Policy |
International transfers to the United States and other third countries are made under the UK International Data Transfer Agreement (IDTA) or UK adequacy decisions where applicable.
6. Data Retention
We retain personal data only for as long as is necessary for the purpose it was collected:
- Contact form data: retained for up to 2 years from the date of submission, or until you request deletion, whichever is sooner. If a client relationship is established, data may be retained for the duration of that relationship plus any applicable legal retention periods.
- Analytics data: retained in aggregated, anonymised form in accordance with Google Analytics retention settings (default 14 months for user-level data; aggregated reports are retained indefinitely).
Formspree retains submitted form data for a period defined in their own data retention policy. We request that Formspree delete data once it has been forwarded to us where technically possible.
7. Your Rights
Under the UK GDPR you have the following rights in relation to your personal data:
- Right of access — request a copy of the personal data we hold about you.
- Right to rectification — request correction of inaccurate or incomplete data.
- Right to erasure (“right to be forgotten”) — request deletion of your personal data where there is no longer a lawful basis for processing it.
- Right to restriction — request that we restrict processing of your data in certain circumstances.
- Right to data portability — receive your personal data in a structured, commonly used, machine-readable format.
- Right to object — object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.
- Rights related to automated decision-making — we do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
To exercise any of these rights, please contact us via the contact form. We will respond within one calendar month. We may need to verify your identity before processing your request.
8. Cookies
This website uses cookies and similar tracking technologies placed by Google Tag Manager and Google Analytics. These cookies are used to distinguish visitors and help us analyse website usage.
You can control cookies through your browser settings. Most browsers allow you to refuse cookies or delete existing ones. Note that disabling cookies may affect website functionality. For more information on managing cookies, visit ico.org.uk/for-the-public/online/cookies/.
We will implement a cookie consent mechanism before full launch to allow you to opt in or out of non-essential cookies in line with UK PECR requirements.
9. Security
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. The website is served exclusively over HTTPS. Contact form data is transmitted securely via Formspree’s encrypted endpoint.
No method of transmission over the internet is 100% secure. While we use commercially reasonable safeguards, we cannot guarantee absolute security.
10. Links to Other Websites
Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. We encourage you to read their privacy policies before providing any personal data.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. Continued use of the website after any changes constitutes your acceptance of the revised policy. We encourage you to review this page periodically.
12. Right to Complain
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection:
- Website: ico.org.uk/make-a-complaint/
- Telephone: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would appreciate the opportunity to address your concerns before you contact the ICO, so please contact us first via our contact form.
13. Contact Us
For any questions, requests, or concerns about this Privacy Policy or how we process your personal data, please contact us using the contact form on our website.