Privacy notice
This notice explains what personal data this website collects, why, and what your rights are. It is written to be read, not just published.
1. Who we are
This website is operated by Growth Tech Labs Ltd (trading as Pangolin), a company registered in England and Wales (company number 17300296) at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. We are the data controller for the personal data described in this notice. ICO registration number: [ICO registration number].
Privacy questions: [contact email].
2. What data we collect, and why
Contact form
If you use our contact form, we collect the details you enter: name, email address, phone number, company, and your message. Name plus either an email address or phone number is required; the rest is optional.
- Purpose: responding to your enquiry and arranging a demo if you ask for one.
- Lawful basis (UK GDPR Art. 6): legitimate interests - responding to an enquiry you initiated. Where the enquiry leads towards a contract, taking steps at your request prior to entering into a contract.
- How it travels: the submission is emailed from our web server to our team inbox. It is not stored in a database on the website.
- Retention: enquiry emails are kept for [retention period, e.g. 24 months], then deleted unless we are working together.
Server logs and IP addresses
Like almost every website, our hosting infrastructure and Cloudflare (see section 5) automatically log technical data about each request: IP address, date and time, requested URL, browser user-agent, and referrer.
- Purpose: security, abuse prevention, and diagnosing faults.
- Lawful basis: legitimate interests - keeping the site secure and working.
- Retention: logs are kept for [retention period, e.g. 30 days] and then rotated.
Analytics (only if you accept)
With your consent, we load Google Tag Manager and Google Analytics to understand how the site is used (pages visited, approximate location from IP, device type). If you choose "Essential only", none of this loads and no analytics cookies are set.
- Purpose: understanding aggregate site usage.
- Lawful basis: consent (which also satisfies PECR Regulation 6 for the cookies involved). You can withdraw it at any time below.
3. Cookies
This table lists every cookie this site can set, and who sets it.
| Cookie | Set by | Purpose | Type | Lifetime |
|---|---|---|---|---|
pangolin_consent |
Us (first party) | Remembers your cookie choice so we don't ask again. | Essential | 180 days |
__cf_bm, cf_clearance |
Cloudflare | Bot detection and security challenges that protect the site. Set by Cloudflare when needed. | Essential | Up to 1 year |
_ga, _ga_* |
Google Analytics (via Google Tag Manager) | Distinguishes visitors to measure site usage. | Analytics - only with consent | Up to 2 years |
Google Fonts, which we use for the site's typefaces, sets no cookies - but see section 4, because it still receives your IP address.
4. Third parties and processors
- Cloudflare - sits in front of this site as a content delivery network and security layer, so every request passes through it (including your IP address). Cloudflare acts as our processor for this traffic.
- Google Fonts - the site's typefaces load from Google's servers. Your browser sends your IP address and user-agent to Google to fetch them, even though no cookie is set. Google may process this data outside the UK.
- Google Tag Manager / Google Analytics - loaded only with your consent, as above.
- Scream.io - hosts the web server that serves this site and relays contact form emails, acting as our processor. Servers are provided by Hetzner Online GmbH in Germany, so this data stays in the EU (covered by the UK's adequacy regulations).
5. International transfers
Cloudflare and Google are US-headquartered companies, so some technical data (such as IP addresses) may be processed outside the UK. Where that happens, transfers rely on the UK Extension to the EU-US Data Privacy Framework or the ICO-approved International Data Transfer Agreement / addendum to EU Standard Contractual Clauses, as applicable to each provider.
6. How long we keep data
- Contact enquiries: [retention period, e.g. 24 months] after our last exchange.
- Server and security logs: [retention period, e.g. 30 days].
- Analytics data (if consented): retained by Google Analytics for [analytics retention, e.g. 14 months].
- Your consent choice: 180 days, then we ask again.
7. Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to our processing (including any processing based on legitimate interests);
- data portability, where processing is based on consent or contract;
- withdraw consent at any time (for analytics, use the control in section 3).
To exercise any of these, email [contact email]. We will respond within one month.
8. Complaints
If you are unhappy with how we handle your data, please contact us first at [contact email]. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or by phone on 0303 123 1113.
9. Changes to this notice
If we change what the site collects (for example, adding a new analytics tool), we will update this notice and, where required, ask for your consent again. The date at the top reflects the latest revision.