Privacy notice.

Who we are

HPY Labs Limited is the controller of personal information described in this notice.

Our registered office is 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. You can contact us about privacy at [email protected].

Information we collect

Enquiries and correspondence

If you contact us, we may receive your name, email address, organisation, the nature of your enquiry and anything you include in your message or later correspondence.

The enquiry form submits this information securely to our email delivery provider so that it can send the enquiry to us and an acknowledgement to you. The website does not retain a separate copy of the form submission, although the resulting messages and delivery records are retained within our business email and email delivery systems.

Business relationships

If we discuss or provide services, we may process business contact details, project communications, proposals, contracts, billing records and information needed to deliver and support the work.

Website operation

Our hosting provider may process standard technical logs such as IP address, browser information, requested pages, timestamps and security events. These logs are used to operate, protect and diagnose the website.

Why we use information

• To respond to enquiries and take steps requested before entering a contract.
• To provide, manage and support services under a contract.
• To manage professional relationships and improve how we work, where this is in our legitimate interests.
• To operate and protect our website, systems and business, where this is in our legitimate interests.
• To meet legal, regulatory, accounting or tax obligations.

Where we rely on legitimate interests, we consider those interests against your rights and reasonable expectations.

Sharing information

We do not sell personal information. We may share it only where reasonably necessary with:

• hosting, email and communications providers acting for us, including Mailgun for delivery of website enquiries and acknowledgements;
• professional advisers such as accountants, insurers and legal advisers;
• delivery partners or subcontractors involved in work you have asked us to perform, subject to appropriate confidentiality and data-protection arrangements;
• regulators, courts, law-enforcement bodies or other authorities where required by law; or
• a prospective buyer or successor if our business or assets are reorganised, sold or transferred.

International transfers

Our website enquiry messages are processed through Mailgun’s EU service region. Some other service providers may process information outside the United Kingdom. Where this happens, we use an applicable legal mechanism and appropriate safeguards, such as UK adequacy regulations or approved contractual protections.

How long we keep information

We keep information only for as long as it is reasonably needed for the purpose for which it was collected, including legal, accounting and dispute-resolution requirements.

Enquiries that do not lead to an engagement are normally retained for no longer than 24 months after the last meaningful contact. Records relating to contracted work may be retained for up to seven years after the relationship ends where needed for legal, tax or contractual purposes. Security logs are retained according to the operational settings of our hosting provider.

Your rights

Depending on the circumstances, UK data-protection law may give you rights to access, correct, erase or restrict your personal information, object to particular uses, and receive certain information in a portable format. Where processing relies on consent, you may withdraw it at any time.

To exercise a right, contact [email protected]. We may need to verify your identity before responding.

You can also complain to the Information Commissioner’s Office through ico.org.uk. We would appreciate the opportunity to address your concern first.

Marketing and children

We will not add you to general marketing communications merely because you send an enquiry. If we send business-to-business updates under a permitted basis, you can opt out at any time.

This website is intended for business and professional audiences and is not directed at children.

Changes to this notice

We may update this notice when our website, services or legal obligations change. The current version and its revision date will remain available on this page.