Privacy notice

Halbon Labs Ltd is the data controller for the personal data described here. We are a software studio registered in England and Wales, company no. 16608971, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. We are registered with the Information Commissioner's Office, registration ZB957293.

We handle personal data under the UK General Data Protection Regulation and the Data Protection Act 2018. Reach us at hello@halbonlabs.com.

From the project request form: your name, email address and your message, plus the company name, project type, budget range and timeline where you choose to give them.

From emailing us directly: whatever you send, and the correspondence that follows.

From your visit: aggregated page-view counts only. No cookies, no identifiers, nothing that distinguishes you from anyone else reading the same page.

When you submit the form: our server briefly sees your IP address, as any web server does. We do not store it. It is immediately turned into a one-way scrambled value, held in memory only, which we use for one thing: stopping the same sender flooding the form. It is counted for ten minutes and then discarded. If the server has gone idle in the meantime it is discarded as soon as it wakes, or when it shuts down, whichever comes first. The key used to scramble it is random, never written down, and destroyed with the server, so the value cannot be turned back into your address by us or by anyone else.

We do not collect payment details on this site. There is nothing to buy here, and no accounts to create.

• To read your enquiry and reply to it.
• To understand what you need built, and to scope, price and deliver the work if it goes ahead.
• To keep records of work we have done, and to meet our legal obligations.
• To understand which pages are read, in aggregate, so we can improve them.

We do not use your details for marketing, we do not add you to a mailing list, and we never sell them.

• Steps towards a contract, Article 6(1)(b): replying to your enquiry and, where it proceeds, scoping and delivering the work.
• Legitimate interests, Article 6(1)(f): answering business enquiries sent to us, keeping our own records, and understanding in aggregate how the site is used. We have considered your interests and rights, and none of this is intrusive or unexpected.
• Legal obligation, Article 6(1)(c): keeping accounting and tax records where a project proceeds.

We do not rely on consent, because we do not do anything here that requires it. If that changes, we will ask you first.

Three processors, each under a data processing agreement, and only for the purposes above.

Resend

Delivers the form submission to us as an email.

Microsoft 365

Our mailbox. Enquiries and correspondence are stored here.

Vercel

Hosts this site, and provides the cookieless, aggregated page-view counts.

We do not share your data with anyone else, and we do not use advertising or profiling services. If a project proceeds and it becomes necessary to bring in a specialist, we will tell you who before they start.

Our processors may handle data outside the UK. Where they do, the transfer is covered by the safeguards UK GDPR recognises: the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

Only as long as there is a reason to. These are the periods we work to.

Enquiries that do not proceed

12 months from your last message, then deleted.

Enquiries that become a project

Kept with the project record for the duration of the work.

Project and contract records

6 years after the engagement ends, matching the limitation period for contract claims in England and Wales.

Accounting records

6 years from the end of the accounting period, as company and tax law requires.

Page-view analytics

Aggregated and never identifies you, so there is nothing personal to retain.

Form flood protection

A scrambled, unreadable value derived from your IP address, held in memory only. Counted for ten minutes, then discarded; on a server that has gone idle, at the latest when it next wakes or shuts down.

Under UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct it if it is wrong;
• delete it, where we have no continuing reason to keep it;
• restrict what we do with it, or object to us doing it at all;
• give it to you, or to somebody else, in a portable format.

Email hello@halbonlabs.com and we will deal with it. We will respond within one month, which is the deadline UK GDPR sets, and there is no charge.

This site sets no cookies at all. Not analytics cookies, not advertising cookies, nothing that needs a banner or a consent choice from you.

The page-view counts we do collect come from Vercel Web Analytics, which is cookieless and aggregated. It does not identify you and it does not follow you to other sites. If we ever add anything that does need consent, you will be asked before it runs, not after.

This site is for businesses and is not aimed at children. We do not knowingly collect personal data from anyone under 16.

If you think we have handled your data badly, tell us first at hello@halbonlabs.com. We will look into it and reply.

You can also complain to the Information Commissioner's Office at any time, whether or not you have raised it with us: ico.org.uk/make-a-complaint (opens in a new tab), or 0303 123 1113.

We may update this notice. Changes are posted here with a revised date at the top. Where a change materially affects how we handle data you have already sent us, we will tell you rather than rely on you noticing.