Privacy policy
Last updated: 10 November 2026
This policy explains how CRM Lab ("we", "us", "our") collects and uses personal data when you visit crm-lab.co.uk, contact us or become a client. We take privacy seriously and follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
Who we are
CRM Lab is a UK-based business. Our address is 54 Westpark Road, Smethwick, B67 7JH, United Kingdom. We are the data controller for the personal data described in this policy.
Contact for anything privacy-related: team@crm-lab.co.uk.
What we collect
Information you give us
- Enquiry form: your name, work email, company, the tools you use today, team size and anything you write in your message.
- Emails and calls: what you send us and notes we make about your requirements.
- Clients: contact details of the people we work with, contract and billing information, and project communications.
Information collected automatically
- Server logs: our hosting provider automatically records technical data such as IP address, browser type, the page requested and the time, to keep the site secure and working. We do not use this to identify you.
- No tracking: we do not use analytics cookies, advertising pixels, fingerprinting or third-party tracking. Our fonts are hosted on our own servers, so visiting the site does not send your data to Google or other font providers.
We do not intentionally collect special category data (such as health or ethnicity). Please do not include it in enquiries.
How and why we use it
| Purpose | Data | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Reply to your enquiry, run a systems audit and prepare a quote | Enquiry and contact details | Steps taken at your request before entering a contract; legitimate interests in responding to business enquiries |
| Deliver a project and provide support | Client contact, project and billing data | Performance of a contract |
| Invoicing, accounting and tax records | Billing data | Legal obligation |
| Keep the website secure and prevent abuse or spam | Server logs, form data | Legitimate interests |
| Occasional relevant updates (only if you opt in) | Name and email | Consent, which you can withdraw at any time |
Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details of that assessment.
AI and automated decisions
We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. We do not put enquiry data into AI services that use it to train their models. Where we use AI tools in delivering client projects, we do so under written data processing terms and the client's instructions.
Who we share it with
We never sell your personal data. We share it only with trusted service providers who process it on our behalf, under contracts that require them to protect it:
- Netlify, Inc.: website hosting and enquiry form handling.
- Microsoft: business email (Microsoft 365), provided through GoDaddy.
- Google: email notifications of new enquiries.
- Professional advisers such as accountants, lawyers and insurers, where necessary.
- Authorities, where the law requires it.
International transfers
Some of our providers process data outside the UK, including in the United States. Where they do, we rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework where the provider is certified) or the UK International Data Transfer Agreement / Addendum, so that your data receives an equivalent level of protection.
How long we keep it
- Enquiries that do not become projects: up to 24 months after our last contact, then deleted.
- Client records: for the life of the contract plus 6 years, to meet legal, tax and limitation-period requirements.
- Marketing consent: until you unsubscribe or withdraw consent.
- Server logs: held by our host for a short period in line with its own retention policy.
Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to our use of it, including objecting to direct marketing at any time;
- receive your data in a portable format;
- withdraw consent where we rely on it.
To exercise any right, email team@crm-lab.co.uk. We will respond within one month and there is normally no charge. We may need to verify your identity first.
If you are unhappy with how we handle your data, please tell us so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.
How we protect it
The website is served only over encrypted HTTPS, with strict security headers. Access to enquiry data is limited to the people who need it and protected by strong passwords and multi-factor authentication. Client systems we build are hosted in UK/EU data centres with encryption, role-based permissions, audit logs and backups.
Cookies
This website does not set cookies or use similar tracking technologies. See our cookie policy for details.
Children
Our services are for businesses and are not directed at children under 18.
Changes to this policy
We may update this policy from time to time. The "last updated" date at the top shows when it last changed. Significant changes will be highlighted on this page.