Privacy Policy

1. About this policy

This Privacy Policy explains how Meta Defence Labs Ltd ("MDLabs", "we", "us" or "our") collects and uses personal data when you visit our website, contact us about our services or otherwise interact with us as a prospective client or business contact.

This policy is focused on our website and business enquiries. Separate contractual terms, privacy information or data-processing arrangements may apply when we provide services, employ people, recruit candidates or process information on behalf of a client.

2. Who is responsible for your personal data?

Meta Defence Labs Ltd is the controller of the personal data described in this policy. We are a company registered in England and Wales under company number 09691044. Our registered office is First Floor, 81-85 High Street, Brentwood, Essex, England, CM14 4RR.

For data protection enquiries, contact dpo@metadefencelabs.com.

3. Personal data we collect

When you contact us through the website, we may collect your name, business email address, organisation, job role, approximate organisation or scope size, the service you are interested in, your target timeframe and any high-level requirements you choose to provide.

We may also process website and attribution information such as the page through which you entered the website, UTM campaign parameters, referral source, pages visited, browser and device information, approximate geographic information, interactions with the website and your cookie or analytics preference.

If you contact us by email or telephone, we may keep the contact details and correspondence needed to respond and manage the relationship.

Please do not submit passwords, credentials, vulnerability details, assessment evidence, special category personal data or other sensitive technical information through our public website form. If sensitive evidence is required later, we will agree a suitable channel with you.

4. How we collect personal data

We collect personal data directly from you when you complete a form, email us, telephone us or otherwise communicate with MDLabs. We also collect limited technical, attribution and analytics information automatically when you use the website, subject to the consent requirements described in our Cookie Policy.

In a business context, we may occasionally receive your professional contact details from a colleague, your organisation, a referral partner or a publicly available business source. Where required, we will provide appropriate privacy information.

5. Why we use personal data and our lawful bases

Enquiries and pre-contract discussions: to respond to your request, understand your requirements, arrange the right conversation and prepare a proposal or next step. We rely on steps taken at your request before entering into a contract where applicable and on our legitimate interests in managing business enquiries and developing our services.

Business relationship management: to maintain appropriate records of discussions, contacts and opportunities and to communicate with relevant business contacts. We rely on contract where applicable and our legitimate interests in managing professional relationships and running our business.

Website operation and security: to operate, maintain, troubleshoot and protect our website and supporting systems. We rely on our legitimate interests in providing a secure and effective website and, where applicable, compliance with legal obligations.

Website analytics: to understand how visitors find and use the website and improve its content and performance. Where analytics technologies require consent, we rely on your consent and do not activate those non-essential technologies until the required consent has been given.

Legal, regulatory and security matters: to meet legal or regulatory obligations, establish or defend legal claims, prevent misuse and protect our organisation, clients and users. We rely on legal obligations and our legitimate interests as appropriate to the circumstances.

6. Google Analytics, cookies and similar technologies

MDLabs uses Google Analytics 4 to understand website usage. Analytics is treated as non-essential and is only activated where the required consent has been given. We also use limited browser storage for attribution and to remember cookie preferences.

For more information about how Google uses information collected through websites that use its services, see How Google uses information from sites or apps that use our services.

Our Cookie Policy explains the technologies we use, the information they store, typical durations and how to change your preferences.

7. Who we share personal data with

We share personal data only where there is a business, operational, legal or security reason to do so. This may include Webflow and its supporting infrastructure for website hosting and form processing; Google for consented Google Analytics processing; providers supporting our email, communications, customer relationship management, security and IT operations; and professional advisers, insurers, regulators, law-enforcement bodies or other authorities where necessary.

Relevant enquiry information may be recorded in our customer relationship management or other business systems so that we can manage the enquiry and subsequent relationship. Access is limited to people who need the information for their work.

We do not sell personal data.

8. International transfers

Some technology and service providers may process personal data outside the United Kingdom. Where a restricted international transfer occurs, we take steps intended to ensure that it is covered by a lawful transfer mechanism, such as UK adequacy regulations or appropriate contractual safeguards, together with any additional measures required in the circumstances.

You can contact us at dpo@metadefencelabs.com if you would like more information about the safeguards relevant to your personal data.

9. How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, taking account of the nature of the enquiry or relationship, whether a business relationship develops, our record-keeping needs, security requirements and any applicable legal, regulatory or contractual obligations. When information is no longer required, we delete it, anonymise it or otherwise dispose of it in accordance with our retention practices.

Browser-session attribution information is intended to last only for the browser session. Cookie preference storage and Google Analytics cookie durations are described separately in our Cookie Policy. Google Analytics account-level data retention is managed separately through the settings available within our Analytics property.

10. Security

We use technical and organisational measures intended to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. Access to business information is restricted according to role and need. No internet service or method of storage can be guaranteed to be completely secure, so we also ask website users not to submit sensitive technical evidence through public forms.

11. Your data protection rights

Depending on the circumstances and the lawful basis being used, you may have rights to request access to your personal data, correction of inaccurate data, erasure, restriction of processing, data portability and withdrawal of consent. Where processing is based on consent, withdrawing consent does not affect processing that was lawful before withdrawal.

Your right to object: where we rely on legitimate interests, you may have the right to object to that processing. You also have the right to object to the use of your personal data for direct marketing.

To exercise a data protection right, contact dpo@metadefencelabs.com. We may need to verify your identity before acting on a request, and some rights are subject to legal conditions or exemptions.

12. Complaints

If you have a concern about our use of your personal data, please contact us first so that we can investigate it. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection. Information about making a complaint is available from the Information Commissioner's Office.

13. Children

Our website and services are intended for organisations and professional users. They are not directed at children, and we do not intentionally use the website to collect personal data from children.

14. Automated decision-making

We do not use personal data collected through this website to make solely automated decisions that produce legal effects or similarly significant effects about you.

15. Changes to this policy

We may update this Privacy Policy when our website, services, technology or legal obligations change. The date at the top of the page shows when this version was last updated. Where a change materially affects how we use personal data, we will take appropriate steps to bring the change to the attention of affected individuals.

16. Contact us

Meta Defence Labs Ltd
Company number 09691044
Registered office: First Floor, 81-85 High Street, Brentwood, Essex, England, CM14 4RR
Data protection enquiries: dpo@metadefencelabs.com