Privacy
This notice explains how Amber Fox Labs Ltd (“we”, “us”) handles personal data on amberfoxlabs.com, when you contact us, and when we work with you as a client. We are the controller of the personal data described here.
You can reach us about anything in this notice at privacy@amberfoxlabs.com, or by post at our registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ.
RotaHero
RotaHero, our rota and staff hours product, has its own privacy notice, linked from rotahero.com. That notice, not this one, covers RotaHero accounts and the data entered into the app.
This website
This site sets no cookies and runs no analytics. It loads nothing from third parties: its fonts, images and styles are all served from amberfoxlabs.com.
The site is hosted by Cloudflare. To deliver and protect it, Cloudflare handles each request at its location nearest to you, anywhere on its global network, and processes technical request data: your IP address, the address requested, the time, and technical details of your browser and connection. We keep no visit logs of our own.
If you email us
Emails sent to us are held in our Google Workspace mailbox, which Google stores in Europe. We use them to reply to you and, if you ask us about a project, to discuss working together. We keep enquiries for 2 years after the conversation ends, then delete them, unless they lead to client work (see below).
If you become a client
When we work together, we keep the names and work contact details of the people we deal with, our contract, invoices and payment records, and project correspondence.
Where a project means we handle personal data on your behalf, for example your customers’ or staff’s data in a system we build or support, we act as your processor. We handle that data only on your instructions and under a written data processing agreement, and your own privacy notice covers it.
Why we use your data (lawful bases)
Under UK GDPR, each use of personal data needs a lawful basis:
- Delivering this website and keeping it secure: our legitimate interest in running a working, secure website (Article 6(1)(f)).
- Replying to your enquiry: our legitimate interest in answering people who contact us (Article 6(1)(f)). Where you ask about working with us, taking steps at your request before entering into a contract (Article 6(1)(b)).
- Delivering client work: performing our contract with you (Article 6(1)(b)). Where our client is an organisation, we use its staff’s work contact details on the basis of our legitimate interest in running the project (Article 6(1)(f)).
- Invoices, accounting records and data-protection requests: complying with our legal obligations (Article 6(1)(c)).
Where we rely on legitimate interests, you have the right to object. See “Your rights” below.
How long we keep it
| Data | How long |
|---|---|
| Enquiries that do not lead to client work | 2 years after the conversation ends |
| Contracts, invoices and accounting records | 6 years after the end of the financial year they relate to, as UK tax law requires |
| Project correspondence and client contact details | 6 years after the engagement ends, in case of a contract claim |
| Technical request data processed by Cloudflare | As set by Cloudflare to deliver and protect the site; we keep no copy |
Who has access
- Cloudflare: hosting, content delivery and security for this site.
- Google: our email (Google Workspace).
- Our accountant: invoices and accounting records, to prepare our accounts and tax returns.
We never sell personal data, and we share none with advertisers or data brokers.
International transfers
Some processing happens outside the UK:
- Cloudflare handles each request at its location nearest to the visitor, anywhere on its global network, which includes the United States.
- Google stores our mailbox in Europe, and may process it, and provide support for it, from outside Europe.
Data sent to the European Economic Area relies on the UK’s adequacy regulations for the EEA. Where personal data leaves the UK for anywhere else, it is protected by the safeguards in each provider’s data processing agreement: the UK’s International Data Transfer Addendum to the standard contractual clauses and, where the provider is certified, the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”). You can ask us for details at privacy@amberfoxlabs.com.
Automated decisions
We make no decisions about you by automated means alone, and we do not profile you.
Your rights
Under UK GDPR you have the right to:
- access: get a copy of the personal data we hold about you;
- rectification: have inaccurate or incomplete data corrected;
- erasure: have your data deleted, where we have no reason to keep it, such as a legal obligation;
- restriction: ask us to limit how we use your data, for example while we check its accuracy;
- object: object to processing based on our legitimate interests. We will then stop, unless we have compelling legitimate grounds that override your interests, or need the data to establish, exercise or defend legal claims;
- data portability: receive data you gave us under a contract in a structured, machine-readable format, or have it sent to another organisation.
To use any of these rights, email privacy@amberfoxlabs.com. It is free, and we reply within one month. We may ask you to confirm your identity first.
Complaints
If you are unhappy with how we have handled your personal data, please tell us first at privacy@amberfoxlabs.com and we will look into it. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this notice
When we change this notice, we update the date at the top of this page.