Draft — not yet approved
Privacy notice
This notice explains what personal data LAB processes, why, on what legal basis, and what you can require of us.
Who is responsible
The controller is {{ENTITY}}, registered at {{ADDRESS}}. Questions about this notice, or any request under it, go to {{DPO}}.
What we collect
- Contact details you give us — name, organisation, email, telephone, country.
- Details of the building you ask us to assess: floor area, type of site, operating hours.
- Correspondence with us, including assessment notes and quotations.
- For customers: site contacts, access arrangements, and operational data produced by the fleet.
- Standard server logs, which include IP address, for security and availability.
Why, and on what legal basis
- To answer an enquiry and prepare an assessment — necessary for steps taken at your request prior to a contract.
- To deliver and support a contracted service — performance of a contract.
- To keep the fleet safe and available, and to investigate faults — our legitimate interest in operating a reliable service.
- To meet accounting, tax and product-safety obligations — legal obligation.
- To send service updates you have asked for — consent, which you may withdraw at any time.
Robots, cameras and the floor
Our machines navigate using sensors, and coverage data is recorded so that a pass can be evidenced. Where a platform is capable of capturing images, we configure and operate it so that footage is used only for navigation and fault diagnosis, is not used to monitor individual staff, and is retained no longer than needed for that purpose. Site-specific arrangements are set out in the contract, and we will support any data protection impact assessment your organisation needs to carry out.
Who else sees it
We use service providers for hosting, email and, where a site requires it, platform telemetry supplied by the machine manufacturer. They act on our instructions under a written processing agreement. We do not sell personal data.
Transfers outside the EEA
Some manufacturer telemetry services operate outside the EEA. Where that applies to your site we rely on the European Commission's standard contractual clauses and assess the transfer before it begins. We will tell you which platforms this affects during the assessment, not after signature.
How long we keep it
- Enquiries that do not become contracts: 24 months, then deleted.
- Contract and operational records: the term of the contract plus the period required by tax and accounting law.
- Server logs: 12 months.
Your rights
You may ask for a copy of your data, ask us to correct or delete it, ask us to restrict or stop a particular use, object to processing based on our legitimate interests, and ask for your data in a portable form. Where we rely on consent you may withdraw it at any time without affecting what we did beforehand. We answer within one month.
Complaints
If you think we have handled your data badly, tell us first at {{DPO}}. You also have the right to complain to the data protection authority in your country — in Ireland the Data Protection Commission, in Portugal the CNPD.
Automated decisions
We do not make decisions about people by automated means alone, and we do not profile you.