This policy explains what personal data we collect when you visit showlab.co.uk, submit our contact form, or sign up to our newsletter. It also explains how we use that data, who we share it with, how long we keep it, and what rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy does not cover other websites that we link to. Please check their own privacy policies before sharing personal data with them.

Under UK GDPR, we need a lawful basis for processing your personal data. The bases we rely on are:

• Responding to your enquiries. We use the information you provide through the contact form to reply to you and to keep a record of our correspondence. Our lawful basis is our legitimate interests (Article 6(1)(f) UK GDPR) in communicating with people who have contacted us.
• Sending you our newsletter. If you subscribe, we use your email address to send you marketing emails about ShowLab. Our lawful basis is your consent (Article 6(1)(a) UK GDPR), which you can withdraw at any time using the unsubscribe link in any email we send you, or by emailing privacy@showlab.co.uk .
• Operating and securing the website. We use technical data and our session cookie to keep the website running, protect against fraud and abuse (including cross-site request forgery), and diagnose problems. Our lawful basis is our legitimate interests (Article 6(1)(f) UK GDPR) in providing a secure and reliable service.
• Meeting our legal obligations. Where the law requires us to process personal data (for example, to respond to a lawful request from a regulator), our lawful basis is legal obligation (Article 6(1)(c) UK GDPR).

Some of the service providers listed above (notably Google, and potentially our future email marketing provider) are based outside the United Kingdom. Where your personal data is transferred outside the UK, we rely on one of the safeguards permitted by UK GDPR, namely:

• UK adequacy regulations made by the Secretary of State; or
• the UK International Data Transfer Agreement; or
• Standard Contractual Clauses approved by the European Commission together with the UK Addendum, plus a transfer risk assessment where required.

You can ask us for more information about the safeguards in place for any particular transfer by emailing privacy@showlab.co.uk .

You have the following rights in relation to the personal data we hold about you:

• The right to be informed - through policies like this one.
• The right of access (Article 15) - to ask for a copy of the personal data we hold about you.
• The right to rectification (Article 16) - to have inaccurate or incomplete data corrected.
• The right to erasure (Article 17) - sometimes called the "right to be forgotten".
• The right to restrict processing (Article 18).
• The right to data portability (Article 20) - to receive your data in a structured, machine-readable format.
• The right to object (Article 21) - including to processing based on our legitimate interests.
• The right to withdraw consent (Article 7(3)) - for example, by unsubscribing from our newsletter.
• Rights in relation to automated decision-making (Article 22). We do not use your personal data to make solely automated decisions that produce legal or similarly significant effects on you.

To exercise any of these rights, please email privacy@showlab.co.uk . We will respond within one calendar month of receiving your request. Where a request is particularly complex, we may extend this by up to two further months, but we will let you know if so.

You also have the right to lodge a complaint with the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or by calling 0303 123 1113. We would, however, appreciate the chance to deal with any concerns first, so please do contact us before approaching the ICO.

We take the security of your personal data seriously and use appropriate technical and organisational measures to protect it. These include encrypting traffic between you and our website using HTTPS, limiting who has access to systems that store personal data, and choosing reputable service providers who maintain their own recognised security standards.

No method of transmission or storage is completely secure, however, and we cannot guarantee the security of data transmitted to or stored by us.

We may update this privacy policy from time to time to reflect changes in our practices or for legal or regulatory reasons. The "last updated" date at the top of this page shows when the most recent change was made.

Where a change materially affects how we use personal data we already hold about you, we will let you know by email if we have an address for you.