Privacy Policy

1.Who we are

20th Labs Ltd is the data controller for the personal data described in this policy. We are registered in England & Wales under company number 17323190, with our registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

This policy explains how we handle personal data when you visit our website, create an account, or use our software products. It is written to meet our obligations under the UK GDPR and the Data Protection Act 2018.

You can contact us about anything in this policy at support@20thlabs.com.

2.Personal data we collect

We collect the following categories of personal data:

• Account data — name, business email address, company name, job title, password (stored in hashed form), and account settings.
• Billing data — billing name and address, VAT number where applicable, plan and subscription details, invoice and transaction history. Card payments are handled by our payment provider; we receive confirmation of payment and limited card metadata such as the card type and last four digits, but not the full card number.
• Usage and technical data — IP address, browser and device type, pages and features used, timestamps, referring pages, and diagnostic or error logs.
• Support and communications data — the content of emails, support requests and any other correspondence with us.
• Content you submit — data you upload or enter into our products, which may include personal data about your own contacts. Where that happens you are the controller of that data and we act as your processor.

We do not intentionally collect special category data, and we ask that you do not submit it to our products.

3.Lawful bases for using it

We only use personal data where the law allows. The bases we rely on are:

• Performance of a contract — to create and run your account, provide the product you have subscribed to, take payment, and give support.
• Legitimate interests — to keep our services secure, prevent fraud and abuse, understand how our products are used so we can improve them, and communicate with business customers about their account. We balance these interests against your rights.
• Legal obligation — to keep accounting and tax records and to respond to lawful requests.
• Consent — for optional analytics cookies and any marketing emails you have asked to receive. You can withdraw consent at any time.

4.How we use personal data

We use personal data to:

• provide, operate and maintain our products;
• set up accounts and authenticate users;
• take payment, issue invoices and manage subscriptions;
• respond to support requests and send service messages about changes, outages or billing;
• monitor performance, diagnose faults and improve our products;
• detect, prevent and investigate abuse, fraud and security incidents; and
• meet our legal and accounting obligations.

We do not sell personal data, and we do not use it to make decisions about you by automated means that produce legal or similarly significant effects.

5.Who we share it with

We share personal data with service providers who process it on our behalf, under written contracts that require them to protect it and to use it only on our instructions. These fall into the following categories:

• Payment processing — a regulated payment provider that collects card payments and handles billing records.
• Hosting and infrastructure — cloud hosting, storage, database and content delivery providers that run our website and products.
• Email delivery — providers that send transactional and service email on our behalf.
• Analytics and monitoring — providers that help us measure website and product usage and detect errors.
• Professional advisers — accountants, auditors and lawyers, where needed.

We may also disclose personal data where we are required to by law or a regulator, to establish or defend legal claims, or in connection with a sale or reorganisation of our business. We will tell you if that happens and this policy changes as a result.

6.International transfers

Some of our providers are based outside the United Kingdom, which means personal data may be transferred abroad. Where that happens, we make sure the transfer is covered by an appropriate safeguard recognised under UK law — normally UK adequacy regulations, or the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

You can ask us for details of the safeguards that apply to a particular transfer.

7.How long we keep it

We keep personal data only for as long as we need it for the purposes set out above.

• Account data — for as long as your account is open, and normally for up to 12 months after it closes.
• Billing and transaction records — for at least six years after the end of the relevant accounting period, as UK tax law requires.
• Usage and technical logs — normally up to 12 months.
• Support correspondence — normally up to 24 months after the request is resolved.

We may keep data for longer where we need it to establish, exercise or defend legal claims.

8.Security

We take appropriate technical and organisational measures to protect personal data, including encryption of data in transit, access controls, and limiting access to those who need it. No system is completely secure, but we work to keep risks low and will notify you and the regulator of a personal data breach where the law requires it.

9.Your rights

Under UK data protection law you have the right to ask us to:

• give you access to the personal data we hold about you;
• correct data that is inaccurate or incomplete;
• erase data where there is no good reason for us to keep it;
• restrict how we use your data while a concern is resolved;
• transfer your data to you or another provider in a portable format;
• stop using your data where we rely on legitimate interests, by objecting to that use; and
• withdraw consent at any time where we rely on consent.

To exercise any of these rights, email support@20thlabs.com. We will respond within one month. We may ask you to confirm your identity first. Exercising your rights is free, unless a request is manifestly unfounded or excessive.

10.Complaints

If you are unhappy with how we have handled your personal data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection.

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline: 0303 123 1113. Website: ico.org.uk.

11.Cookies

We use cookies and similar technologies on our website and in our products. Our Cookie Policy explains which ones we use and how to control them.

12.Changes to this policy

We may update this policy from time to time. The current version is always published on this page with the date it was last updated. Where a change is significant, we will tell you by email or through the product.

13.Contact

For any privacy question or request, email support@20thlabs.com, or write to 20th Labs Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.