Privacy Policy

NookLab Ltd. · 307 Hotwell Road, Bristol, BS8 4NQ, United Kingdom
[email protected] · nooklab.uk · Company No. 17063153
Effective Date: March 2, 2026

NookLab Ltd. (“NookLab”, “we”, “us”, “our”) is committed to protecting the privacy and security of personal data. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the rights available to individuals under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

NookLab Ltd. is a company incorporated in England and Wales (Company No. 17063153), with registered office at 307 Hotwell Road, Bristol, BS8 4NQ. NookLab is the data controller for the personal data described in this Policy, except where stated otherwise.

If you have any questions about this Policy or how we handle personal data, please contact us at [email protected].

2. Scope of This Policy

This Policy applies to personal data that NookLab collects and processes as a data controller, for example personal data relating to visitors to our website, prospective and existing clients and their business contacts, suppliers, and job applicants.

This Policy does not apply to personal data that NookLab processes on behalf of a client in the course of delivering the Services (for example, a client's own customer data, email marketing lists, advertising pixel data, or analytics data). In those circumstances, NookLab acts as a data processor and the client acts as the data controller. That processing is governed by the Data Processing Agreement (DPA) entered into between NookLab and the relevant client, and by that client's own privacy policy — not by this document.

3. Personal Data We Collect

As a data controller, we may collect and process the following categories of personal data:

• Enquiry and contact data: name, email address, phone number, and the content of any message, submitted via our website, email, or social media channels;
• Client business contact data: name, job title, employer, email address, and phone number of individuals we deal with at client organisations, collected in connection with a Client Service Agreement, Statement of Work, or NDA;
• Website usage data: IP address, browser and device type, pages visited, and referral source, collected via cookies and similar technologies (see clause 5);
• Marketing preference data: records of consent or objection to receiving marketing communications from us;
• Recruitment data: CVs, cover letters, and interview notes, where an individual applies for a role with NookLab;
• Financial data: billing and payment details of clients, processed for invoicing and accounting purposes.

4. How We Use Personal Data

We use personal data for the following purposes, on the lawful bases indicated:

• to respond to enquiries and provide quotations — legitimate interests in operating our business, or steps taken prior to entering a contract;
• to perform and manage a Client Service Agreement or Statement of Work — performance of a contract;
• to send marketing communications — consent, or legitimate interests in respect of existing clients (with an opportunity to opt out at any time);
• to maintain accounting and tax records — compliance with a legal obligation;
• to operate and improve our website — legitimate interests, or consent where required for non-essential cookies;
• to assess job applications — steps taken prior to entering a contract of employment or engagement;
• to comply with our legal and regulatory obligations, including under the Bribery Act 2010 and applicable anti-money laundering requirements.

We do not use personal data for any purpose incompatible with the purpose for which it was collected without notifying the individual concerned.

5. Cookies and Similar Technologies

Our website may use cookies and similar technologies to distinguish visitors, remember preferences, and understand website usage. Where required under the Privacy and Electronic Communications Regulations 2003 (PECR), we will obtain consent before setting non-essential cookies. You can manage or withdraw cookie consent at any time through your browser settings or our cookie banner (where applicable).

6. Sharing Your Personal Data

We may share personal data with the following categories of recipients, each acting under appropriate contractual safeguards:

• our hosting, email, and productivity service providers (e.g. Cloudflare, Zoho), who process personal data on our behalf and are bound by written data processing terms;
• our accountant, bookkeeper, or professional advisers, for accounting, tax, and legal compliance purposes;
• our banking providers, for payment processing purposes;
• regulators, law enforcement, or courts, where required by law.

We do not sell personal data to third parties. We do not share personal data with third parties for their own independent marketing purposes without consent.

7. International Transfers

Some of our service providers may store or process personal data outside the United Kingdom. Where this occurs, we take steps to ensure appropriate safeguards are in place, such as reliance on an adequacy regulation, the UK International Data Transfer Agreement, or an approved addendum to the EU Standard Contractual Clauses.

8. Data Retention

We retain personal data only for as long as necessary for the purposes set out in this Policy, including to satisfy any legal, accounting, or reporting requirements. Client business contact data is generally retained for the duration of the business relationship plus six (6) years thereafter, in line with statutory limitation periods. Enquiry data from individuals who do not become clients is generally deleted within twenty-four (24) months of last contact, unless a longer period is required by law.

9. Your Rights

Under Chapter III of UK GDPR, individuals have the following rights in relation to their personal data, subject to certain exemptions:

• the right to be informed about how personal data is used;
• the right of access to a copy of personal data held about them;
• the right to rectification of inaccurate or incomplete data;
• the right to erasure of personal data in certain circumstances;
• the right to restrict processing in certain circumstances;
• the right to data portability, where processing is based on consent or contract and carried out by automated means;
• the right to object to processing based on legitimate interests or for direct marketing purposes;
• the right to withdraw consent at any time, where processing is based on consent;
• the right to lodge a complaint with the Information Commissioner's Office (ICO).

To exercise any of these rights, please contact us at [email protected]. We will respond within one month, in accordance with UK GDPR.

10. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or destruction, proportionate to the nature and sensitivity of the data concerned.

11. Children's Data

Our Services and website are directed at businesses and are not intended for use by children. We do not knowingly collect personal data from individuals under the age of 18.

12. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or legal requirements. Any material changes will be notified via our website. The "Effective Date" at the top of this Policy indicates when it was last revised.

13. Contact Us

Questions, requests, or complaints about this Policy or our handling of personal data can be directed to:

NookLab Ltd., 307 Hotwell Road, Bristol, BS8 4NQ | [email protected]

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.