Privacy Policy

Mimaroo Labs Ltd ("we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website mimaroolabs.com or engage with our services.

This policy complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are

Data Controller: Mimaroo Labs Ltd
Company Number: 14860756
VAT Number: 443224325
Registered Office: McGills, Oakley House, Tetbury Road, Cirencester, Gloucestershire GL7 1US
Data Protection Contact: peter@mimaroolabs.com

2. Information We Collect

2.1 Information You Provide Directly

We collect personal information that you voluntarily provide to us when you:

• Contact Form Submissions: Name, email address, phone number, company name, job role, and message content
• Live Chat: Name, email address, and chat conversation content via Tawk.to
• Email Communications: Email address and correspondence content
• Newsletter Subscriptions: Email address (if you opt in)
• Service Enquiries: Business information relevant to your enquiry

2.2 Information Collected Automatically

When you visit our website, we automatically collect certain information about your device and browsing behaviour:

• Website Analytics: IP address (anonymised), browser type, operating system, referring URLs, pages viewed, time spent on pages, click patterns
• Cookies: See our Cookie Policy for detailed information
• Log Data: Server logs including IP addresses, browser information, and access times

2.3 Information We Do Not Collect

We do not collect:

• Payment card information (we do not process payments online)
• Sensitive personal data (health, religious beliefs, political opinions, etc.)
• Information about children under 18 (our services are B2B only)

3. How We Use Your Information

3.1 Legal Basis for Processing

We process your personal data under the following legal bases:

• Legitimate Interests (B2B): To respond to business enquiries and provide professional services
• Consent: When you submit contact forms or accept cookies
• Contract Performance: To deliver services you've engaged us for
• Legal Obligations: To comply with tax, accounting, and regulatory requirements

3.2 Purposes of Processing

We use your information to:

• Respond to Enquiries: Answer your questions and provide information about our services
• Service Delivery: Provide consulting services and fulfil contractual obligations
• Business Communications: Send relevant information about our services (with consent)
• Website Improvement: Analyse website usage to enhance user experience
• Legal Compliance: Meet regulatory, tax, and accounting obligations
• Marketing: Send marketing communications (only with your consent, which you can withdraw at any time)
• Security: Protect against fraud, abuse, and security threats

4. How We Share Your Information

4.1 Third-Party Service Providers

We share personal data with trusted third-party service providers who help us operate our business:

• Web3Forms: Contact form processing (forms submitted are sent to our email)
• Google Analytics 4: Website analytics with IP anonymisation (USA/EU servers)
• Tawk.to: Live chat functionality (data stored in their servers)
• Google Workspace: Email and document storage (data stored in EU/UK data centres)
• Cloud Hosting Providers: Website hosting services

All third-party processors are required to:

• Process data only for the purposes we specify
• Maintain appropriate security measures
• Comply with UK GDPR requirements
• Have valid Data Processing Agreements (DPAs) in place

4.2 We Do Not Sell Your Data

We never sell, rent, or trade your personal information to third parties for marketing purposes.

4.3 Legal Disclosures

We may disclose your information if required to:

• Comply with legal obligations (court orders, regulatory requests)
• Protect our legal rights or defend against legal claims
• Prevent fraud or protect security
• Respond to law enforcement requests

5. International Data Transfers

Your personal data may be transferred to and processed in countries outside the UK and European Economic Area (EEA), including the United States, where our third-party service providers operate servers.

When we transfer data internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses: EU Commission-approved contracts
• Adequacy Decisions: Transfers to countries with adequate data protection laws
• Privacy Shield / Data Privacy Framework: For US-based processors where applicable

Specifically:

• Google Services: Covered by Standard Contractual Clauses and compliance certifications
• Tawk.to: Review their privacy policy and data transfer safeguards

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy:

• Contact Form Submissions: 3 years from last contact (standard B2B practice)
• Email Correspondence: 3 years from last communication
• Live Chat Transcripts: 2 years from conversation date
• Website Analytics Data: 26 months (Google Analytics 4 default)
• Client Project Data: 6 years minimum (UK tax and accounting requirements)
• Cookie Data: See our Cookie Policy for specific retention periods

After the retention period expires, we securely delete or anonymise your personal data.

7. Your Data Protection Rights

Under UK GDPR, you have the following rights regarding your personal data:

7.1 Right of Access

You can request a copy of the personal data we hold about you (Subject Access Request).

7.2 Right to Rectification

You can request that we correct inaccurate or incomplete personal data.

7.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data in certain circumstances (e.g., when no longer necessary for the purpose collected).

7.4 Right to Restrict Processing

You can request that we limit how we use your data in certain circumstances.

7.5 Right to Data Portability

You can request your data in a structured, machine-readable format to transfer to another service.

7.6 Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

7.7 Rights Related to Automated Decision-Making

We do not use automated decision-making or profiling.

7.8 Right to Withdraw Consent

Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration:

• Encryption: HTTPS/SSL encryption for data transmission
• Access Controls: Limited access to personal data on a need-to-know basis
• Secure Storage: Data stored on secure servers with regular backups
• Security Monitoring: Regular security assessments and updates
• Third-Party Security: All processors must meet security standards
• Staff Training: Data protection awareness for all personnel

However, no internet transmission is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your website experience and analyse usage. For detailed information, please see our Cookie Policy.

You can control cookie preferences through our cookie consent banner or your browser settings.

10. Third-Party Websites

Our website may contain links to third-party websites (e.g., LinkedIn, client websites). We are not responsible for the privacy practices of these external sites. We encourage you to read their privacy policies.

11. Children's Privacy

Our services are intended for business professionals aged 18 and over. We do not knowingly collect personal data from individuals under 18. If we become aware of such collection, we will delete it promptly.

12. Marketing Communications

We may send you marketing communications about our services if:

• You have provided consent, or
• You are an existing client and the communication relates to similar services (soft opt-in for B2B)

You can opt out at any time by:

• Clicking "unsubscribe" in any marketing email
• Emailing us at peter@mimaroolabs.com
• Updating your preferences (if you have an account)

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make significant changes, we will:

• Update the "Last Updated" date at the top of this policy
• Notify you via email (if you've provided contact details)
• Display a prominent notice on our website

We encourage you to review this policy periodically.

14. Complaints and Regulatory Authority

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the UK's data protection authority:

We would appreciate the opportunity to address your concerns before you contact the ICO, so please contact us first.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

---

Document Version: 1.0
Approved By: Peter McShane, Founder & Data Controller
Next Review Date: February 2027