Privacy policy
Last updated: 22 October 2026
1. Who we are
Deedslab, trading as Deeds Lab, is the controller of the personal information described here.
Contact for anything in this policy: contact@deedslab.co
We are a small studio. We have not appointed a Data Protection Officer because the law does not require one for our activities, but you can raise any privacy question with us at the address above.
2. What we collect
When you contact us or book a call: your name, email address, company name if you give it, and what you tell us about your project. If you book through our calendar, the booking details (date, time, any answers you give).
When you become a client: contact and billing details for the people we work with, project communications, and any personal information inside the materials you share with us for the project.
When you visit the site: anonymous visit statistics, such as pages viewed, the site that referred you and your country. These statistics use no cookies and do not identify you.
We do not knowingly collect information from children, and we do not collect special category data (such as health information) about you as a website visitor.
3. Why we use it, and our legal basis
| Purpose | Legal basis under UK GDPR |
|---|---|
| Replying to your enquiry and scoping your project | Steps you ask us to take before entering a contract (Art. 6(1)(b)), or our legitimate interest in responding to business enquiries (Art. 6(1)(f)) |
| Delivering a project we have agreed with you | Performance of a contract (Art. 6(1)(b)) |
| Invoicing, tax and accounting records | Legal obligation (Art. 6(1)(c)) |
| Understanding how the site is used, anonymously | Legitimate interest in improving the site (Art. 6(1)(f)) |
| Loading Calendly's cookies when you choose "Accept all" | Consent (Art. 6(1)(a)), which you can withdraw at any time through "Cookie settings" |
We do not sell your information. We do not send marketing emails unless you have asked us to.
4. Who handles it for us
We use a small number of service providers who process information on our behalf, under contracts that require them to protect it:
- Calendly, for booking calls;
- our email provider, for receiving and replying to email;
- our form service, for the contact form;
- Vercel, for hosting the website;
- our analytics provider, for anonymous visit statistics;
- AI tools we use in our work (such as Anthropic's Claude, Cursor and Google's Gemini), when we use them to help design or build a client project. We use business or API terms under which these providers state they do not train their models on our inputs. If you need us not to use AI tools on your material, tell us and we will agree that in writing.
We may also share information where the law requires it, or with professional advisers such as accountants and lawyers.
5. Transfers outside the UK
Our team works outside the UK, so when you contact us your information is read and handled there. Some of our providers are based in, or store data in, the United States.
Where UK GDPR applies to a transfer to a country without a UK adequacy decision, we protect it with the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, supported by a transfer risk assessment, or we rely on a lawful exception where one applies (for example, where the transfer is necessary to take steps you have asked for before a contract). For US providers we rely on the UK-US data bridge where the provider is certified, or on the UK transfer agreements where it is not.
We apply the standards in this policy to everyone's information, wherever it is handled.
6. How long we keep it
- Enquiries that don't become projects: 12 months from our last contact, then deleted.
- Client project records and correspondence: for the length of the project and 6 years after it ends, to deal with any questions or claims.
- Invoices and accounting records: as long as tax law requires.
- Anonymous statistics: kept in aggregate; they contain no personal information.
7. Your rights
You have the right to:
- ask for a copy of the information we hold about you;
- ask us to correct it;
- ask us to delete it;
- ask us to restrict how we use it;
- object to our use of it where we rely on legitimate interests;
- ask us to transfer it to you or someone else in a common format;
- withdraw consent at any time, where we rely on consent.
Email contact@deedslab.co. We will reply within one month. We may need to confirm your identity first.
8. Complaints
Please tell us first and we will try to put it right. You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
9. Security
We keep access to personal information to the people who need it, use two-factor authentication on the accounts that hold it, and use providers with recognised security standards. No system is completely secure; if a breach affects you and is likely to put your rights at high risk, we will tell you.
10. Changes
We will update this policy when our practices change. The date at the top shows the latest version.