PRIVACY LAST
Privacy Policy
EM DASH LABS LTD, 66 Paul Street, London, EC2A 4NA United Kingdom. Contact: office@emdashlabs.cloud · +44 7700 900142. Website: https://emdashlabs.cloud. Effective date: 1 September 2026. Governing law: England and Wales.
1. Controller and last room
This Privacy Policy explains how EM DASH LABS LTD processes personal data when you visit https://emdashlabs.cloud, submit a fit construction request, correspond with the last room, receive professional services in computer systems design, cloud hosting, custom software development, data processing, managed IT services, database administration or systems integration, or otherwise deal with us as a supplier, applicant, or visitor. EM DASH LABS LTD is the controller for website enquiry data and for relationship data about client contacts. For personal data processed on a client’s systems under a services contract, we typically act as processor and a data processing schedule will last that relationship. The company address is 66 Paul Street, London, EC2A 4NA United Kingdom. The contact path for privacy is the same bench path used for construction: office@emdashlabs.cloud and +44 7700 900142. We are established in the United Kingdom and this policy is drafted under the United Kingdom General Data Protection Regulation, the Data Protection Act 2018, and, where electronic marketing or cookies are concerned, the Privacy and Electronic Communications Regulations 2003.
If you are reading this because you found a pressure mark in how we handle data, write first to the last room so we can recut the edge. You also have the right to complain to the Information Commissioner’s Office. We will not require you to use a decorative portal. Plain text is enough. This policy is intended to be a finished legal edge of approximately five thousand words, unique to our form-to-fit practice, and not a generic template last stretched over another organisation’s foot.
2. Categories of people and data
We process data about website visitors, people who send fit notes, client staff named as operational contacts, supplier staff, job applicants if we open a last for hiring, and occasional visitors to 66 Paul Street by arrangement. We do not seek special category data through the public form. Typical data includes name, job title, organisation, return path, telephone, the content of a pressure description, technical logs such as IP address, user agent, date and time of request, pages worn, and, if you attend the last room, visitor book entries required for safety. If we provide hosting or managed services, we may process personal data contained in client systems strictly as processor according to documented instructions. We do not need, and should not be sent, live production secrets through the public request note.
3. Purposes and lawful bases
We process website logs to keep the sole of https://emdashlabs.cloud secure and available, relying on legitimate interests in operating a professional last room and in defending the domain against abuse. We process fit construction requests to take steps at your request prior to entering a contract, and thereafter to perform a contract if a last is agreed. We process supplier data to perform contracts and to meet accounting and tax lasts under United Kingdom law. We process relationship data to manage delivery of computer related consulting services, to send operational notices, and to keep a last reference true. Where we send electronic marketing to a sole trader or to an individual subscriber, we will last that send to PECR consent or to the soft opt-in where those conditions are truly met. We do not pretend that a website visit alone is consent to a newsletter last we do not operate.
Legitimate interests are balanced. The interest in answering a construction request is aligned with the requester’s interest in a reply. The interest in security logs is necessary to prevent the welt of the site from opening under attack. We do not use legitimate interests as a loose form for selling lists. If you object to a legitimate-interest pull that is not required for a contract or a legal last, we will stop unless we have compelling grounds or the data must be held for a claim.
4. Sources
Most data comes from you: the form, email to office@emdashlabs.cloud, a call to +44 7700 900142, or documents you provide under a statement of work. Some data comes from your organisation when it names you as a fit contact. Technical data comes from your browser and from our hosting last. We do not buy marketing lists. We do not scrape professional networks to last a cold foot without a lawful basis. If a third party introduces you, we will tell you the source when we first write, unless the law requires silence for a short investigation last.
5. Recipients and processors
Recipients include EM DASH LABS LTD personnel who need the data to cut, pull, stitch or finish work; professional advisers bound by confidentiality; hosting and infrastructure providers who store the website and mail; map and font providers as described in the Cookie Policy; and public authorities when the law requires a pull we cannot refuse. We last processors with written terms that include confidentiality, security, sub-processor control, deletion or return at the end of the last, and assistance with data subject rights. We do not permit a processor to last our enquiry data onto an advertising sole.
6. International transfers
The last room is in London. Some processors may store or access data outside the United Kingdom. Where that occurs, we use the United Kingdom International Data Transfer Agreement, the Addendum to the EU Standard Contractual Clauses, or an adequacy regulation as the welt. We assess whether the destination last can hold the tension of United Kingdom data protection. If it cannot, we recut the architecture: regional hosting, separate last, or a decision not to use that tool. You may ask office@emdashlabs.cloud for a summary of transfer lasts relevant to your request or contract.
7. Retention
Website logs are typically kept for a short operational last, often between thirty and one hundred and eighty days, unless needed longer to investigate a pressure mark of abuse. Unsuccessful fit notes that do not become a contract are kept long enough to complete correspondence and to defend a complaint, then reduced or deleted. Contract, invoice and tax records are kept for the statutory last, commonly six years from the end of the relevant accounting period. Processor data in a client environment follows the client’s instruction and the exit clause of the Terms and Conditions. Applicant data, if any, is kept only for the recruitment last plus a short period for defending a claim. We do not keep a permanent museum of every leather scrap.
8. Security
We apply organisational and technical measures matched to the risk: access on a need-to-last basis, authentication, encryption in transit for the public site, backup as sole support, and vendor review. No digital last is immune to a determined pull. We will notify you and the ICO when the law requires notice of a personal data breach. Clients who last production secrets into a public form create a pressure we cannot fully relieve after the fact; do not do that.
9. Your rights
You have rights of access, rectification, erasure, restriction, objection, and portability, in the circumstances set out in the United Kingdom GDPR. You may withdraw consent where consent was the basis. You may complain to the ICO. To exercise rights, write to office@emdashlabs.cloud from a path we can reasonably relate to the data, or write to 66 Paul Street, London, EC2A 4NA United Kingdom. We may need to measure the foot of the request to avoid giving data to the wrong last. We will not charge a fee unless a request is manifestly unfounded or excessive. We will respond within one month, extendable by two months for complex or numerous requests, as the statute allows. Rights are not absolute. Legal claims, tax lasts, and the rights of others may require us to hold a stitch.
10. Automated decisions
We do not make solely automated decisions that produce legal or similarly significant effects about website visitors or clients. Fit verification of a system is a human construction sequence. Analytics, if used, may count page wear; they do not refuse a last without a person.
11. Children
Our services are lasted for organisations. We do not knowingly collect data from children through the website. If you believe a child has sent a fit note, tell us and we will delete the scrap unless the law requires a short hold.
12. Client processor work
When we host, administer databases, process data, or develop software that stores personal data for a client, the client is typically controller and we are processor. Instructions will be documented. We will not process except on those instructions unless United Kingdom law requires a different pull. We will assist with security, breach, and data subject requests to the extent the contract lasts. Sub-processors will be listed or notified according to the schedule. International transfers in processor work follow the same welt as section 6 unless the client instructs a specific last. Confidentiality of client data is also governed by the Terms and Conditions.
13. Marketing and contact paths
We may reply to your construction request without a separate marketing last. We do not operate a high-volume promotional stitch. If we ever send a newsletter about last-method notes, we will last it to PECR. You can refuse marketing by writing to office@emdashlabs.cloud. Operational messages about an active last, invoices, and security notices are not marketing.
14. Cookies
Cookies are described in the Cookie Policy at cookie-policy.html. That page is the finished edge for PECR transparency. This Privacy Policy covers the personal data that cookies may involve.
15. Records, DPIA, and DPO
We keep records of processing suited to a firm of our scale. We will conduct a data protection impact assessment when a pull is likely high risk. We have not appointed a statutory data protection officer because we are not in the class of public authority or core-processing enterprise that the statute requires to do so; this will be recut if our last changes. Accountability remains on the directors of EM DASH LABS LTD.
16. Sharing on legal demand
We may disclose data if required by a court in England and Wales, by a statute, or by a competent regulator. We will narrow the stitch to what is demanded. We will notify you unless the law forbids the notice or notice would prejudice the purpose of the demand.
17. Accuracy and your duty
You must not send us another person’s data in a fit note unless you have a lawful last to do so. You must keep contact paths true so that a last number can reach you. We will recut obvious errors when we find them.
18. Links
The site may link to real pages such as about.html, services.html, portfolio.html, contact.html, and legal pages. External sites have their own lasts. We are not controller of their processing.
19. Changes
We may publish a new Privacy Policy on privacy-policy.html with a new effective date. Material changes will be described at the head. If a change requires consent, we will not rely on silence.
20. Detailed purposes table in prose
For clarity, the following purposes are lasted again in narrative form so that a professional reader does not have to guess. Purpose A: serving HTML, CSS, JavaScript, images and maps so that you can wear the last-room pages; data: IP, user agent, request path; basis: legitimate interests. Purpose B: receiving a fit construction request; data: name, return path, message; basis: pre-contract steps. Purpose C: performing computer systems design, custom programming, hosting, data processing, managed services, database administration or integration; data: client contact details and any personal data in scope as processor; basis: contract and legitimate interests in delivery. Purpose D: invoicing and tax; data: names on invoices, addresses, payment references; basis: legal obligation and contract. Purpose E: defending claims and keeping audit edges; data: correspondence and contract files; basis: legitimate interests and legal claims. Purpose F: security of the domain and of hosted estates we manage; data: logs, alerts; basis: legitimate interests and, for managed estates, contract. Purpose G: supplier management; data: supplier staff contacts; basis: contract. We do not have a Purpose H for selling profiles.
21. Hosting and infrastructure context
Because EM DASH LABS LTD provides computing infrastructure, web hosting and related services, clients sometimes ask whether website privacy and hosting privacy are the same last. They are not. This policy covers the public last room and our relationship data. Hosted client environments are lasted by the client’s own notices to their users, plus our processor terms. We will not use hosted client personal data to measure our marketing last. We will not mix a public fit note with a production database. Isolation is part of finishing the edge.
22. Professional scientific and technical clients
Organisations in professional, scientific and technical services often handle sensitive commercial data even when it is not special category data under the statute. We treat such material as confidential under contract and as personal data where it identifies a person. Our staff are instructed not to paste client pressure maps into public tools that would recut the last onto a third-party training sole. That instruction is an organisational measure under this policy and under the Terms and Conditions.
23. Contacting the last room about privacy
Write to office@emdashlabs.cloud with the subject grain of your request: access, deletion, objection, or a pressure mark you have found. Include enough last numbers or dates for us to find the scrap. Call +44 7700 900142 if you cannot write. Visit 66 Paul Street only by arrangement; a walk-in is not a guaranteed data-rights last. We will not ask you to create an account to exercise rights. We will not hide the ICO from you.
24. Summary of the form
Work lasts longer when the form is built correctly, pressure points are mapped and every edge is finished for real use. The same sentence governs privacy: we collect only the foot we must measure, we map who can pull the data, we stitch processors with written welts, and we finish the edge with rights, retention and a complaint path. If this policy and our practice ever part, practice must be recut to the policy or the policy recut to a lawful practice. Silence is not a last.
25. Lawful bases explained in operational grain
This section recuts the lawful bases so that a governor can wear them without a second last. Contract and pre-contract steps apply when you ask us to measure a system, to host an estate, to write software, to process data, to administer a database, or to integrate systems, and when we perform the last you accepted. Legal obligation applies to tax, company, health and safety at 66 Paul Street, and to responses we must give a court or the ICO. Legitimate interests apply to securing https://emdashlabs.cloud, to keeping a record of who asked for a last so that we can defend a complaint, to improving method without identifying you, and to telling a named client contact about an incident on an estate we manage. Consent applies only where PECR or the GDPR truly require it, such as a non-essential cookie last or an electronic marketing stitch we do not currently run as a product. Vital interests are not our ordinary last. Public task is not our last because we are not a public authority. We will not invent a basis after the pull. If a basis fails, we stop or recut.
26. Each data subject right in finished language
Access means you may ask what personal data we hold about you as controller and receive a copy, with information about purposes, categories, recipients, retention, rights and transfers, unless an exemption applies such as legal professional privilege, the rights of others, or a crime-prevention last. Rectification means we will recut inaccurate data when you show the pinch. Erasure is available when the data are no longer needed, when you withdraw consent and no other basis holds, when you object and we have no compelling grounds, when processing was unlawful, or when erasure is required by law; it is not available when we must keep invoices, when claims are live, or when freedom of expression in a limited professional record applies, which will be rare on our bench. Restriction means we will store but not use, except with consent, for claims, for the rights of another, or for important public interest, while a dispute about accuracy or objection is measured. Portability applies to data you provided that we process by contract or consent by automated means; we will export in a commonly used machine-readable last where that clause applies. Objection applies to legitimate-interest processing and to direct marketing; we will stop marketing on objection without a balancing last. We do not profile for marketing. Automated decision rights are described earlier because we do not run that last.
27. Legitimate interests assessment in prose
For website security logs our interest is to keep the sole of the domain from being lasted by an attacker. The processing is limited to technical data, retained short, and is in the reasonable expectation of a professional visitor. For enquiry records our interest is to answer and to defend. The processing is what you sent us. For method improvement we use anonymised or aggregated grain. We do not think a visitor would be surprised. If a child were involved we would not rely on this last. The balancing is recorded in our internal fit note for processing, which we will summarise on request to office@emdashlabs.cloud unless doing so would itself open a security welt.
28. Recipients named by class with more tension
Personnel of EM DASH LABS LTD who design, host, programme, process, support or administer. Directors who must see a pressure mark. Accountants and tax agents in the United Kingdom. Solicitors if a claim last is cut. Insurers if a notification is required. Hosting processors who store the public site and mail. Map and font providers as in the Cookie Policy. Client organisations when you are their staff and the data are about the engagement. Police, courts, HMRC, ICO, Companies House correspondents, and similar bodies when the law pulls. We do not list every cloud region in this policy because regions are lasted per contract for client estates; for the public site the primary last is the United Kingdom or an adequate location unless we publish a recut.
29. Retention schedule in narrative
Server access logs: thirty to one hundred eighty days unless an incident last is open. Fit construction requests that do not convert: up to twenty-four months from last correspondence, then deletion or anonymisation. Contracts and statements of work: six years from end of contract plus the current accounting year, aligning with limitation and tax. Invoices: six years from the end of the financial year. Processor data: according to the client instruction and exit window. Visitor records at 66 Paul Street: as short as safety and insurance require, typically not more than twelve months. Insurance notifications: as the policy last requires. ICO correspondence: as long as the complaint last plus a short hold. We review the schedule when a new service last is added to the bench.
30. Office, visitors and calls
The last room at 66 Paul Street, London, EC2A 4NA United Kingdom is not a retail floor. Visitors by arrangement may have their name recorded for fire and security. We do not currently operate CCTV as a marketing last; if CCTV is used for safety, signage will mark it and this policy will be recut with a retention last. We do not record telephone calls as a default. If a call is recorded for a regulated or quality last, you will be told at the start. Wi-Fi if offered to a visitor is a convenience last, not an anonymous hide; technical logs may exist on the router for a short period.
31. Applicants and suppliers
If we open a hiring last, applicant data will be used to measure fitness for a role in systems design, hosting, programming, data, support or administration. Basis: pre-contract and legitimate interests in recruiting. We will not require irrelevant special category data. Criminal record checks, if ever required, will use a lawful last and a separate notice. Supplier staff data are used to buy services we need to finish our edge: studios, accountants, counsel, infrastructure. Basis: contract and legitimate interests in a working bench.
32. Photographs and last-room imagery
Images on the site are workshop photographs of lasts, leather, thread, kraft and professional objects. They are not photographs of clients. We do not publish staff portraits as a required last. If a person is ever identifiable in a future image, we will last that publication to consent or another lawful basis and recut this section.
33. Social media and search
If you mention EM DASH LABS LTD on a public network, that network is controller of its platform. We may read a public mention. We will not scrape private profiles. Search engines may index public pages of https://emdashlabs.cloud. Legal pages are intended to be readable by people, not to be a tracking last.
34. ICO and cross-border complaints
The lead supervisory authority for our controller processing is the Information Commissioner’s Office of the United Kingdom. If you are in the European Economic Area and a residual GDPR right applies because of our offering, you may also speak to your local authority, but our establishment last is London. We will cooperate. We will not treat a complaint as a failure of tension on the services last unless the facts show that.
35. Records of processing and accountability
EM DASH LABS LTD keeps records suited to a limited company that designs computer systems, hosts infrastructure, writes custom software, processes data, administers databases and supports estates. The record names purposes, categories of data and people, recipients, transfers, retention and security grain. It is a working last, reviewed when a new service is offered from 66 Paul Street. Accountability sits with the directors. Staff are told not to paste client personal data into public generative tools. Access to enquiry mail is limited. Paper, if any, is uncommon; if a visitor book exists it is stored in the last room and not published. We will provide a relevant extract of our record to the ICO on demand. We will not publish the full record because it would itself describe security tension.
36. Data protection impact assessments
A DPIA is lasted when a pull is likely high risk to people: large-scale systematic monitoring, special category data on a new last, or innovative use that people would not expect. Ordinary website logs and ordinary B2B fit notes are not automatically high risk. Hosting a client’s production estate may require the client, as controller, to DPIA; we assist as processor. If we are controller of a new measurement tool that profiles visitors, we will DPIA before it is worn. The assessment describes the foot, the pressure, the measures, and whether residual risk is acceptable. We consult the ICO only when residual risk remains high, as the statute requires.
37. Security measures in more finished grain
Measures include unique accounts, strong authentication, least privilege, encrypted transit for the public site, patched systems on a reasonable cadence, backups of the public content last, vendor review, and incident notes. Portable media are not our ordinary last. Production credentials are not stored in the public request form. We separate the public last room from client estates. We review privileges when a person leaves the bench. We do not claim a named certification in this policy unless we have earned it; if we later hold one, we may mention it without making it a consumer-style badge last. No measure removes all risk. You must still keep your own secrets off the public form.
38. Breach handling as controller
If we become aware of a personal data breach in processing for which we are controller, we will assess risk to people. If required, we will notify the ICO without undue delay and not later than seventy-two hours after becoming aware, with reasons if we are late. We will notify affected people if the risk is high. We will keep a breach fit note. We will recut the welt that opened. A security event that does not affect personal data may still be handled as an operational last without ICO notice.
39. Processor breach and client notice
If we are processor and become aware of a breach, we will notify the client without undue delay, with such particulars as we then have: nature, categories and approximate numbers if known, likely consequences, and measures. We will not notify data subjects as if we were controller unless the client instructs or the law requires. Time spent investigating may be charged if the breach was caused by the client’s instruction or by a third party the client required us to use, except where our own failure caused it.
40. Joint controllers
We do not ordinarily act as joint controller with a client. If a rare last requires joint control, we will set out in writing who answers rights requests and who talks to the ICO. Until that writing exists, each party is independent controller for the data it decides the purposes of.
41. Automated tools and AI
If we use an automated assistant inside the last room, we will not feed it your confidential fit note unless a contract last allows a private deployment. We do not make solely automated legal-effect decisions about you. A spam filter on mail is ordinary security, not a prohibited automated decision. Analytics counts are not decisions about a person.
42. Direct marketing PECR recut
We may send electronic mail about our services to a corporate subscriber without PECR consent, while still offering a simple refuse path as good practice. We will not send to an individual subscriber without consent or a true soft opt-in after a sale, with a chance to refuse at collection and in each send. Telephone marketing to a number on the TPS will not be our last. We do not buy lists. A fit construction reply is not marketing.
43. Children’s additional last
The website and services are not directed at children. We do not offer information society services directly to a child. If we learn that a child sent personal data, we will delete it unless we must keep a short record of the deletion last. Parental consent tools are not part of our ordinary bench.
44. Special category and criminal data
We do not seek special category data or criminal data through the website. If a client instructs processing of such data in an estate we manage, the client must identify an Article 9 or Schedule 1 last and we must have processor terms. We may refuse a last we cannot finish securely. Health data, trade-union data, biometric last for identification, and similar, are not to be pasted into office@emdashlabs.cloud without a prior schedule.
45. Location and cookies overlap
We do not continuously locate your device. An IP address may suggest a coarse region for security and for approximate analytics if you consent to analytics. The map iframe may send location-of-request data to the map provider. See the Cookie Policy. Turning off location in your device does not remove the need for an IP address to route the page.
46. How long this policy is meant to wear
This policy is reviewed at least annually, and sooner if we add a service last, change processors in a material way, or the law recuts. The effective date at the head is the wear date. Prior versions may be requested from office@emdashlabs.cloud for a reasonable historical last, unless we have a lawful reason not to keep them. Related pages remain privacy-policy.html, cookie-policy.html, terms-of-service.html, terms-and-conditions.html, about.html, services.html, portfolio.html and contact.html.
47. Company identification
EM DASH LABS LTD operates from 66 Paul Street, London, EC2A 4NA United Kingdom. Telephone +44 7700 900142. Email office@emdashlabs.cloud as plain text. Website https://emdashlabs.cloud. If our registered office ever differs from the last room, we will recut this paragraph. For the avoidance of doubt, we are not a cobbler shop, not a fashion house, and not a leather goods retailer; we are a computing practice that uses a form-to-fit construction metaphor. That metaphor does not reduce our duties under the Data Protection Act 2018.
48. Requests that are excessive
If a rights request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse. We will explain. Repeated identical requests without new grain may be excessive. A request made solely to disrupt the last room may be unfounded. We will not use this clause to avoid a genuine access last.
49. Identity verification
We will not give a copy of data to a person we cannot relate to the data. We may ask for information to verify. We will not demand a passport for a simple correction of a spelling on a fit note if the return path already matches. We will demand more tension if the data are sensitive in a commercial sense even when they are not special category data.
50. Closing last on privacy
Work lasts longer when the form is built correctly, pressure points are mapped and every edge is finished for real use. Privacy is an edge. If you find a raw cut, write to office@emdashlabs.cloud. We will measure, recut, and, where the law requires, notify. This policy, together with the Cookie Policy, is the public last for personal data at EM DASH LABS LTD as of 1 September 2026.