Privacy notice

Summary: this website sets no cookies and has no analytics or advertising. If you contact us, we use your details only to reply and to discuss the work. We don't sell personal data, and you can ask us to see or delete what we hold.

1. Who we are

Cowl Labs Limited ("Cowl Labs", "we", "us") is the controller of the personal data described in this notice.

• Registered in England and Wales, company number to be added on registration
• Registered office: to be added on registration
• Contact for privacy questions: privacy@cowllabs.com

This notice covers cowllabs.com and our dealings with clients and enquirers. Apps and services we publish have their own privacy notices, which apply when you use them.

2. What we collect

When you contact us (form or email): your name, email address, company name if you give it, the topic you choose, your message, and anything else you decide to send us.

When you visit this website: our web server records each request automatically. That record holds your IP address, the date and time, the page or file requested, the referring page, your browser's user-agent string and the response code. It is used only to run and protect the site.

When you play the Bug Squash game on our home page: your best score is saved in your own browser's local storage so it's there next time. It never leaves your device and we can't see it. You can clear it by clearing this site's data in your browser.

If you become a client: contact details of the people we work with, and the information needed to agree, deliver and invoice the work.

We do not knowingly collect data from children through this website, and we don't collect special category data (such as health information) here.

3. Why we use it, and our lawful basis

• Replying to enquiries: our legitimate interest in answering people who contact us, or taking steps at your request before entering a contract.
• Delivering and invoicing work for clients: performance of our contract with you or your organisation.
• Keeping business and tax records: legal obligation.
• Running and securing the website (server logs, blocking abuse): our legitimate interest in keeping the site available and safe.

We don't use your data for marketing unless you ask us to keep you updated, and you can stop that at any time. We don't make decisions about you using automated processing.

4. Cookies and similar technology

This site sets no cookies. It uses no analytics, no advertising and no third-party scripts, fonts or embeds: everything is served from our own server. The only thing stored in your browser is the optional game score described above, which is needed for the feature you asked to use.

5. Who we share it with

We share personal data only with the service providers we need to run our business, under contracts that require them to protect it and use it only on our instructions:

• Hosting: our servers are rented from a provider in Stockholm, Sweden (EU).
• Email: our mailboxes are hosted by an email provider based in Switzerland.
• Professional advisers (such as our accountant), where needed.

We may disclose data if the law requires it, for example to a court or regulator. We never sell personal data.

6. International transfers

Our hosting is in the EU and our email is in Switzerland. The UK recognises both as giving adequate protection for personal data, so no further safeguards are needed. If that changes, or we use a provider elsewhere, we'll put appropriate safeguards in place (such as the UK International Data Transfer Agreement) and update this notice.

7. How long we keep it

• Enquiries that don't lead to work: up to 2 years after our last contact, then deleted.
• Client records and correspondence: for the length of the work and then 6 years, which is what UK tax and company law requires.
• Web server logs: 14 days, then deleted automatically.

8. How we protect it

The site is served only over encrypted connections (HTTPS). Our servers are hardened, firewalled and kept up to date, and access is limited to the people who need it, using keys rather than passwords. Backups are encrypted in transit and restore-tested.

9. Your rights

Under UK data protection law you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that's wrong or incomplete;
• delete it, where we have no good reason to keep it;
• restrict how we use it, or object to our use of it based on legitimate interests;
• give it to you, or another organisation, in a common machine-readable format.

Email privacy@cowllabs.com. We'll respond within one month and there's normally no charge. We may need to check your identity first.

10. Complaints

If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113.

11. Changes to this notice

We'll update this page if the way we handle personal data changes, and change the date at the top. For significant changes affecting clients, we'll tell you directly.