Last updated: October 2026
The short version
- HauteLab is a trading name of Lakewood Media Limited. We decide how we use your data on this site and in our own business.
- We collect what you give us and what our suppliers log when you visit. We also collect what we need to run a client account.
- Our site analytics do not save your IP address. They set no cookies unless you opt out. You can opt out at any time.
- When we host or manage a client’s website, the client decides what happens to its customers’ data. We follow the client’s instructions.
- We do not sell your data. We do not ask you for sensitive information.
- We tell you how long we keep each kind of data. The tables below give each period.
- You can ask to see, correct or delete your data. You can complain to us. You can also complain to the Information Commission’s Office (the ICO).
1. Who we are
HauteLab is a trading name of Lakewood Media Limited. We are a company registered in England and Wales, number 08477710. Our registered office is 128 City Road, London EC1V 2NX. We have no staffed office there.
We pay the ICO data protection fee every year. Our ICO registration reference is A8859532.
Write to us at [email protected]. This mailbox takes every privacy request and complaint. Our data protection officer handles them.
We play two roles:
- Controller. We decide how and why we use your data. This covers visits to our site, enquiries, subscriptions and client work. This policy explains that use.
- Processor. When we host or manage a client’s website, we handle that site’s data for the client. The client is the controller. Section 9 explains what that means for you.
This policy covers hautelab.agency and our own business. It does not cover our team or our employees. They have a separate policy.
2. What we collect, why, and our lawful basis
A lawful basis is the legal reason UK GDPR lets us use your data. We name one for each use.
| When | What we collect | Why | Lawful basis | How long we keep it |
|---|---|---|---|---|
| You visit hautelab.agency | IP address, browser type, pages viewed and time of visit, in server and Cloudflare logs | To keep the site secure and working | Legitimate interests: protecting our site | 12 months |
| You visit hautelab.agency (analytics) | The pages you view, where you came from, your device type and browser, and the time of your visit. Our analytics tool (Matomo) does not save your IP address. Our server logs do, as the row above says | To see how the site is used, and to improve it | Legitimate interests: improving our site | 12 months, then only totals |
| You email [email protected] | Your name, email address and what you write | To reply to you | Legitimate interests: answering enquiries. Contract, if you ask for a quote | 12 months after the last message, if no work follows |
| You message us on WhatsApp | Your phone number, name and messages | To reply to you | Legitimate interests: answering enquiries | 12 months after the last message, if no work follows |
| You use the contact form or chat | Your name, contact details and what you write (Pipedrive) | To reply to you | Legitimate interests: answering enquiries | 12 months after the last message, if no work follows |
| You subscribe to our newsletter | First name and email address. The form also logs your browser, the page you came from and your country | To send you HauteLab Insights | Your consent. You confirm it by clicking a link in an email we send you (double opt-in) | Until you unsubscribe |
| You send a copyright notice, a counter-notice or an urgent removal request (DMCA page) | Your name, address, phone, email, the web addresses and your statements | To handle the notice. We pass on to the site owner what they need to respond. We pass the notice to the site’s host when it is not us. For a counter-notice, we send a copy to the person who sent the notice. It includes your name, address and phone number. Tell us when you write if you want any detail held back | Legitimate interests: protecting rights | 12 months |
| You become a client | Names, work email addresses and phone numbers of your staff | To agree and deliver the work | Contract | 12 months after the engagement ends |
| You sign our agreement | The signed agreement and onboarding details | To keep a record of the contract | Contract, and legitimate interests: protecting our rights | 6 years after the engagement ends. This is the time limit for contract claims |
| We invoice you | Billing contacts and invoice records | To bill you and meet tax rules | Contract, and legal obligation | 6 years. For company accounts, the six years run from the end of the financial year. GOV.UK sets this for company accounts and VAT |
| You pay by Direct Debit | Bank details on your mandate (GoCardless) | To collect payment | Contract | For the life of the mandate |
| We email our customers and subscribers | Business contact details | To tell you about our services | Legitimate interests, for our customers: promoting our services to people who already buy from us. Consent, for people who subscribed on our site or by form | Until you unsubscribe or object |
If you do not give us the data a form asks for, we cannot reply to you. If you are a client and do not give us the data we need, we cannot do the work.
3. Where we get your data
Most data comes from you. Some comes from other places:
- If you are a client, you give us details of your staff. You may also give us details of your customers, under section 9.
- Our suppliers log technical details when you visit our site.
- A DMCA notice gives us the details of the person who sends it.
4. Marketing and our newsletter
We send marketing emails only to our customers and to people who subscribed. Subscribers gave their consent on our site or by form. Every marketing email has an unsubscribe link. You can also email us to stop.
We do not buy lists.
5. Sensitive information
We do not ask you for sensitive information. Examples are data about your sex life or sexual orientation. UK GDPR gives this kind of data extra protection.
If you run an adult business, your customers’ data may fall in this group. It stays your data under section 9. You must name your own legal condition for using it. Our agreement says so.
6. Who can see your data
We name the suppliers that handle your data on this site, and our main business tools. We group the rest by type.
6.1 On this website
| Supplier | What it does for us |
|---|---|
| Cloudflare | Website delivery, security and DNS |
| Pipedrive | Contact form, chat and our client records |
| Akismet (Automattic) | Spam checks on form entries |
| Newsletter email service | Sends HauteLab Insights |
We host our site analytics (Matomo) on a server we control. We do not share that data with anyone.
6.2 In our business
We use these tools to run the business and to do client work:
- Google Workspace, for email and documents.
- Xero, for accounting.
- GoCardless, for Direct Debits.
- WhatsApp, for messages.
- 1Password, to store access details safely.
- Anthropic, OpenAI and Google (Gemini), for AI tools. We use business subscriptions. These suppliers do not use our data to train their models by default.
- Other tools for our team inbox, projects, hosting, backups and site care. Our team and approved contractors use them.
6.3 Other recipients
We share data with courts, police or a regulator when the law requires it. We share it with our accountants, insurers and lawyers when we need their advice. We also share it to protect our legal rights. We share a notice with the site owner and the host it concerns. We share a counter-notice with the person who sent the notice. We do not sell data.
7. Sending data outside the UK
Some suppliers above handle data in the United States, New Zealand or other countries. We send data there only if one of these applies:
- The UK government has found the country adequate. This covers the EU and EEA, and New Zealand.
- The recipient joined the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge).
- We rely on the International Data Transfer Agreement, or the UK Addendum to the EU standard clauses.
For our AI suppliers, Anthropic and OpenAI use standard clauses with the UK Addendum. Google uses the UK-US data bridge.
Our team works from the UK, Europe, South Africa and the Philippines.
You can ask us for a copy of the safeguard we use for a supplier. Email [email protected].
8. How we keep data safe
For everyone
- We keep access details in a password manager (1Password). Each team member has a named account.
- We switch on two-step verification for accounts that hold personal data.
- We back up hosted sites.
- A person checks each deliverable that AI helped to make.
- We never make a solely automated decision that has a legal or similarly significant effect on a person.
If we are the controller and a breach puts you at high risk, we tell you without undue delay. We also tell the ICO within 72 hours where the law requires it.
If you are our client
- We never ask you for a password or a recovery code.
- We do not ask you for registrar logins. To share DNS access, use Cloudflare user management (see section 9).
- If you or your developer needs SSH access, we give it for that task. We turn it off after the work ends.
- We do not knowingly put your confidential information into free or personal AI tools. We use business subscriptions for these tools.
- If a breach affects data you control, we tell you within 48 hours. For a suspected account compromise, we tell you within 24 hours.
9. If you use a client’s website, or you are our client
If you use a client’s website
The client is the controller of the data on its site. We handle that data only on the client’s instructions. If you write to us about it, we pass your request to the client without delay. The client then answers you. We help the client to do so.
If you are our client
We act only on your written instructions. Our agreement with you sets the rules.
- Ending the work. You have 30 days after the work ends to choose. You can tell us to delete or return your data. If you make no choice, we may delete it. For hosted sites, we delete the data 60 days after the contract ends.
- Backups. Backup copies expire on the backup schedule.
- ID and age-check files. We do not ask clients or visitors for ID or age-verification files. If your site holds them, they stay your data. Keep them out of web forms and the media library.
- Our suppliers. The suppliers in section 6 may handle your data for us. We tell you at least 15 business days before we add a new supplier that handles your data.
- Domain names. We recommend that you manage your domain’s DNS in Cloudflare. You can share access through Cloudflare user management. Or you can point your name servers at our Cloudflare account. We do not ask for registrar logins.
10. Cookies and similar technologies
A cookie is a small file that a website stores on your device. Some tools do the same job without a cookie.
Our site analytics
We use Matomo to count visits. We host it ourselves. It sets no cookies. It does not save your IP address. It records the pages you view and where you came from. It also records your device type, your browser and the time of your visit. It does not follow you from day to day. It does not record your screen. It does not share data with anyone. We use the data only to see how the site is used and to improve it.
You can opt out at any time. Use the analytics opt-out link in the footer of any page. Opting out sets one small cookie on your device so that Matomo remembers your choice. It costs nothing.
Other cookies
We show no cookie banner. These are the cookies you may meet.
| Name | Set by | What it does | How long it lasts | Needs your consent? |
|---|---|---|---|---|
| __cf_bm | Cloudflare | Tells people from bots | 30 minutes, or 1 hour through the Pipedrive chat or form | No. Cloudflare treats it as strictly necessary for security |
| mtm_consent_removed | Matomo, on this site | Remembers that you opted out of analytics. Set only if you opt out | As long as your browser keeps it. Browsers often remove it within a year | No |
Pipedrive may set cookies when you use the chat or form. So may services it uses, such as Google reCAPTCHA. Pipedrive lists them at support.pipedrive.com/en/article/leadbooster-cookies.
11. Your rights
You can ask us to:
- tell you what data we hold about you, and give you a copy;
- correct data that is wrong;
- delete your data;
- limit how we use your data;
- move your data to you or to another company, where the law applies;
- take back your consent at any time. This does not affect what we did before.
We answer within one month. If we need proof of who you are, the month starts when you send it. For an access request, we may need more detail to find your data. Days spent waiting for it do not count. For a complex request, or many requests, the law lets us take up to two more months. We tell you in the first month and say why. We charge no fee. We may charge a fee, or refuse, if a request is manifestly unfounded or excessive.
Email [email protected]. If your request concerns a client’s website, see section 9.
Your right to object
You can object at any time to our use of your data for direct marketing. We then stop. You can also object, on grounds that relate to your situation, where we rely on legitimate interests. This includes our site analytics. Email [email protected], use the unsubscribe link, or use the analytics opt-out in section 10.
12. How to complain
Please tell us first. Email [email protected] with “Complaint” in the subject line. We acknowledge your complaint within 30 days of receiving it. We then look into it without undue delay and tell you the outcome.
If you are not happy, you can complain to the ICO at ico.org.uk. The ICO recommends that you complain to us first. Since 30 September 2026 the ICO has been the office of the Information Commission. It keeps the name ICO.
13. Children
Our services are for adults who run businesses. We do not knowingly collect data from children. If you think a child gave us data, email us and we will delete it.
14. Changes to this policy
We post changes on this page and update the date at the top. We do not treat your continued use of the site as consent to a new use of your data.
15. Contact
HauteLab, a trading name of Lakewood Media Limited
Registered office: 128 City Road, London EC1V 2NX
Email: [email protected] (data protection officer and all privacy requests)