Hidden Insight Labs
Hidden Insight Labs is a UK-registered limited company providing UX testing, software evaluation, and programme management services to B2B clients. We are the data controller in respect of the personal data we hold about our clients and their representatives.
Company name: Hidden Insight Labs Ltd
Registered address: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ
Company number: 16941841
Contact email: privacy@hiddeninsightlabs.com
We are registered with the Information Commissioner's Office (ICO). ICO registration number: ZC149156.
We collect the minimum personal data necessary to deliver our services and manage the client relationship. This may include:
| Category | Examples | Source |
|---|---|---|
| Identity & contact | Name, job title, company name, business email address, phone number | Provided directly by you or your organisation |
| Contract & engagement | Signed agreements, statements of work, project briefs, correspondence | Created or received during the engagement |
| Financial | Invoice details, payment records, billing address | Provided by you or your finance team |
| Technical | Access credentials we create on your behalf for testing environments, software or systems you share with us | Provided by you for service delivery |
| Communications | Emails, meeting notes, written feedback, project updates | Generated through our working relationship |
| Website visitors | IP address, browser type, pages visited, time of visit (via cookies — see Section 10) | Automatically collected when you visit our website |
We do not intentionally collect special category data (e.g. health, ethnicity, biometric data) from clients. If any such data is shared incidentally as part of your product or materials submitted for testing, it will be handled with additional care and not retained beyond the project scope.
We use your personal data for the following purposes:
Under the UK GDPR, we must have a lawful basis for processing personal data. Our bases are:
| Processing purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Delivering services under a signed agreement | Contract — Art. 6(1)(b): processing necessary for the performance of a contract |
| Responding to pre-contract enquiries | Contract — Art. 6(1)(b): steps taken at your request prior to entering a contract |
| Accounting, invoicing, tax obligations | Legal obligation — Art. 6(1)(c): UK tax and company law requirements |
| Maintaining business records, managing disputes | Legitimate interests — Art. 6(1)(f): our legitimate interest in operating a lawful business |
| Marketing to existing clients (email updates) | Legitimate interests — Art. 6(1)(f): we balance this against your interests and you may opt out at any time |
| Marketing to new contacts (newsletter opt-in) | Consent — Art. 6(1)(a): you have given clear, specific consent |
Where we rely on legitimate interests, we have carried out a balancing test to ensure our interests do not override your rights. You may request details of this assessment by contacting us.
As a business operated from Japan by a UK-registered company, your data may be processed or accessed from Japan. Japan has received an adequacy decision from the UK (under Article 45 UK GDPR), meaning the UK recognises Japan's data protection standards as equivalent. No additional safeguards are required for this transfer.
Where we use third-party service providers based outside the UK or Japan (for example, cloud services based in the US), we ensure transfers are protected by one of the following mechanisms:
You may request details of the specific transfer mechanisms in place for any particular service by contacting us at the address in Section 12.
We retain personal data only for as long as necessary for the purposes for which it was collected, and in line with our legal obligations. Specific retention periods:
| Data type | Retention period | Reason |
|---|---|---|
| Client contracts and engagement records | 6 years from project end | UK Limitation Act 1980 (contractual claims period) |
| Invoices and financial records | 6 years from the end of the relevant financial year | HMRC tax record requirements |
| Project correspondence and deliverables | 3 years from project completion | Operational need and potential dispute resolution |
| Marketing contact data (opt-in) | Until you withdraw consent or 2 years of inactivity | Consent-based; withdrawn consent triggers deletion |
| Pre-contract enquiries (not converted) | 12 months | Legitimate interest in managing our sales pipeline |
When data is no longer needed, it is securely deleted or anonymised.
Under the UK GDPR, you have the following rights in relation to your personal data:
Request a copy of the personal data we hold about you (a Subject Access Request).
Ask us to correct inaccurate or incomplete data about you.
Ask us to delete your data where there is no longer a lawful reason to hold it ("right to be forgotten").
Ask us to pause processing of your data in certain circumstances.
Receive your data in a structured, commonly-used format to transfer to another organisation.
Object to processing based on legitimate interests, including direct marketing.
Where processing is based on consent, withdraw it at any time without affecting prior lawful processing.
We do not use automated decision-making or profiling. This right would apply if we did.
To exercise any of these rights, contact us using the details in Section 12. We will respond within one calendar month of receiving your request. In complex cases we may extend this by a further two months and will notify you if so.
We will not charge a fee for exercising your rights in most cases. If a request is clearly unfounded or excessive, we may charge a reasonable fee or refuse the request, and will explain why.
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, or destruction. Measures include:
In the event of a personal data breach that is likely to pose a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, inform you directly without undue delay.
We review this privacy notice at least annually and whenever there are material changes to how we process personal data. The "last reviewed" date at the top of this page will be updated accordingly.
Where changes are significant, we will notify active clients directly by email prior to the changes taking effect. Continued engagement with us after that date constitutes acknowledgement of the updated notice.
If you have any questions about this notice, wish to exercise your rights, or have a concern about how we handle your data, please contact us:
Hidden Insight Labs Ltd
📧 Email: privacy@hiddeninsightlabs.com
📮 Post: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Website: ico.org.uk/make-a-complaint
Phone: 0303 123 1113
Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
We would appreciate the opportunity to address your concerns directly before you contact the ICO.