Privacy Policy

Last updated: 31 October 2026

This policy explains what personal data SecureByDesignLabs collects through securebydesignlabs.com, our emails and our services, why we collect it, who we share it with, how long we keep it, and the rights you have over it. We have written it to match what the site actually does. If something here doesn’t match what you see, tell us at support@securebydesignlabs.com.

1. Who we are

The controller of your personal data is SecureByDesignLabs Ltd, a company registered in England and Wales (company number 17543312), registered office 66 Paul Street, London, England, EC2A 4NA.

Email: support@securebydesignlabs.com
Post: 66 Paul Street, London, England, EC2A 4NA

We are not required to appoint a data protection officer. Questions about this policy or your data go to the email address above.

2. What we collect, and why

We collect what you give us, what your browser sends when you visit, and, if we contact you about your business, the public business details described in 2.9. For each way we collect data, this section says what we collect, what we use it for, and the lawful basis we rely on under the UK GDPR.

The newsletter form on our homepage and other pages collects your email address. It is submitted directly to Brevo, our email provider, which keeps the address on our mailing list and sends the newsletter. Basis: your consent. You can unsubscribe with the link in any email, or by writing to us.

2.2 The CRA scope checker, enquiry forms and reminders

Where we offer them, our forms include the “Email me my checklist” form on the CRA scope checker, enquiry and quote-request forms on our offer pages, and reminder signups (for example, a reminder before your security.txt file expires). Depending on the form, we collect:

your work email address, and your name and company if the form asks for them;
what you tell us in the form: for the scope checker, the answers you gave (added to the form automatically); for an enquiry, your message and the options you picked; for a reminder, the date it relates to and the web address you entered;
whether you ticked the box asking for occasional CRA updates;
technical details sent with the form (your IP address, browser type and the page you were on), which are used to filter spam.

What happens next: the submission is stored on our website (hosted by WordPress.com) and checked for spam by Akismet. It is emailed to our inbox, and a short notification of it is sent to us through Telegram so we can reply quickly. Brevo sends you the email you asked for: your checklist, a confirmation that we’ve received your enquiry, or the reminder when it is due. If you ticked the updates box, Brevo also adds your address to our “CRA updates” list.

Basis: to do what you asked us to (send your checklist or reminder, reply to your enquiry, or prepare a quote), which is our legitimate interest and, for quotes, a step you asked for before entering a contract. The CRA updates list is used only with your consent, which you can withdraw at any time with the unsubscribe link.

2.3 When you email us

If you email us, we receive your email address, your message and anything you attach. Our mailboxes are hosted by Titan. Basis: our legitimate interest in replying to you, or the contract with you if you’re a customer.

2.4 Buying from us

When you order a product, our shop (WooCommerce, running on our WordPress.com site) collects your name, email address, billing address, company name if you give one, what you ordered and what you paid. Card payments are handled by Stripe, and PayPal payments by PayPal. If you pay with Apple Pay, Google Pay or Stripe Link, that service is involved too. When you type your email address at checkout, Stripe checks whether it belongs to a Link account, so it can offer you faster payment if you have one. We never see or store your full card number. Stripe and PayPal also run fraud checks when you pay, which use details about your device and connection, and WooCommerce’s fraud protection (run by Automattic) checks the device placing the order. FunnelKit, the checkout and automation plugins our shop runs, also keeps a contact record for each customer (name, email address and orders), and for some people who have an account on our site (name and email address), in our website’s own database on WordPress.com.

If we deliver a digital product through a private GitHub repository, we will ask for your GitHub username and share it with GitHub. For services and engagements, we also keep the quote, contract, invoices and our correspondence with you.

Basis: performing our contract with you, and our legal obligation to keep tax and accounting records.

2.5 Material you give us during an engagement

During a review, setup or monitoring engagement, you may give us code, app builds, documents or access to systems that contain personal data about your own users or staff. We handle that material only to deliver the service, under our Terms of Service and, where we act as your processor, a data processing agreement. How we may use anonymised, aggregated statistics from our work is set out in the “How we use data from our work with you” section of the Terms of Service.

2.6 Comments and reviews

If you comment on an article or review a product, we collect the name, email address and website you enter, your comment, and your IP address and browser details. Your name, website and comment are published; your email address is not. Comments are checked for spam by Akismet. Your email address is also used to look up a Gravatar profile picture, if you have one. If you tick the boxes to be notified of follow-up comments or new posts, WordPress.com sends those emails. Basis: our legitimate interest in running a public comment section, and your consent for notification emails.

2.7 Accounts

Public registration is closed. If we have created an account for you (for example, to give you access to a purchase), we store your username, email address, password (in hashed form) and the content you add to your profile. Basis: performing our contract with you.

2.8 Browsing the site and using our data tools

Like every website, ours receives your IP address, browser type, the page you asked for and the page you came from. WordPress.com, which hosts the site, processes these to serve pages and keep the site secure. Jetpack Stats (part of WordPress.com) uses them to count page views for us. The cookies and similar technologies the site uses are listed in section 3.

Our interactive data tools run in your browser. When you search one of them, a one-way hash of your IP address is kept for 60 seconds to stop automated overuse. If nothing matches your search, we keep the search term itself, without anything that identifies who searched, so we know what to add. The CRA scope checker’s answers stay in your browser unless you send them to us with the “Email me my checklist” form.

Basis: our legitimate interest in running a secure, working website and understanding which pages are useful. For non-essential cookies, see section 3.

2.9 If we contact you about your business

We sometimes email people at companies whose products we think our services could help. For this we keep a business contact’s name, work email address and role, the company and the public fact about its product that we wrote about, and a record of what we sent and when. We find these details in public business sources (such as the company’s own website and the developer contact shown on an app store listing), in public registers, and from professional contact-data providers. If a company doesn’t publish a work email address for the person, we may work it out from the format the company uses for its work email addresses and check with a professional contact-data provider that it can receive email. If we don’t use an address worked out this way, we delete it within 30 days. Every email tells you how to ask us to stop. If you do, we stop, and we keep your address only on our “do not email” list, stored in scrambled form that can’t be read back, so we don’t contact you again by mistake. We record the date we last contacted you, so we know when the 24 months in section 6 end. These records are kept on our own computer and backed up to a private GitHub repository. Basis: our legitimate interest in telling businesses about services relevant to their products. You can object at any time, and we will stop.

3. Cookies and similar technologies

Cookies are small files a website stores in your browser. We only use cookies that are needed for the site to work: a basket, a login, a download, a payment and the fraud checks that protect it. We don’t use advertising or marketing cookies, and our page-view statistics don’t use cookies, so we don’t ask you to accept any. These are the cookies the site uses. Durations are the longest we observed.

Needed for the site to work

Shop and basket (WooCommerce and FunnelKit Cart, on our own site): fkcart_cart_qty, fkcart_cart_total and, once you add something to your basket, WooCommerce’s basket and session cookies. They remember what’s in your basket. Session, or up to 2 days.
Downloads (Download Manager, on our own site): __wpdm_client, which identifies your session for file downloads. Session.
Logging in (WordPress): wordpress_test_cookie and, if you log in, WordPress’s login cookies. Session, or up to 14 days if you tick “Remember me”.
Payment security and fraud prevention: Stripe’s payment script loads on every page so the basket and express checkout work, and it sets the fraud-prevention cookies __stripe_mid (1 year), __stripe_sid (30 minutes) and m (set on stripe.com); on the product and checkout pages, PayPal’s cookies (on paypal.com, up to 400 days) and a bot check run by hCaptcha for Stripe (__cf_bm, 30 minutes); and on the product, checkout, login and register pages, WooCommerce’s fraud-protection cookie __Host-_bb_c_uid (set on wp.com, 1 year).
Comments: if you tick “Save my name, email, and website in this browser”, WordPress stores those details in cookies so you don’t have to type them again.

Page-view statistics, without cookies

Jetpack Stats, part of WordPress.com, counts page views for us from the details your browser sends with each request (see section 2.8). It doesn’t set cookies on our site.

Pages that show “Like” buttons or profile pictures load them from WordPress.com and Gravatar. If you’re logged in to WordPress.com, those services can recognise you. You can delete or block cookies in your browser settings. Blocking the “needed” ones may stop the basket, login or payment from working.

We don’t sell your personal data. We share it only with the service providers that run parts of our business for us, who may use it only to provide their service to us (except where noted):

Automattic (WordPress.com): hosts the website and its database, including form submissions, orders, comments and accounts. Also provides Jetpack (forms, statistics, Likes, comment and post notifications), Akismet (spam filtering), Gravatar (profile pictures) and WooCommerce’s fraud protection.
Brevo: sends our emails (checklists, confirmations, reminders, newsletters), and keeps our mailing lists, including the CRA updates list.
Stripe: processes card, Apple Pay, Google Pay and Link payments and runs fraud checks (including hCaptcha). When you pay with Apple Pay or Google Pay, Apple or Google also process that payment under their own terms. Stripe is also a separate controller for some data it needs to meet its own legal obligations.
PayPal: processes PayPal payments and runs fraud checks. PayPal is a separate controller for your PayPal account.
Professional contact-data providers: when we look up or check a business contact’s work email address (section 2.9), the provider receives the person’s name and company domain, or the address being checked. These providers are also sources of business contact details, which they hold under their own privacy policies.
Titan: hosts our email inboxes.
Telegram: carries the short notification we receive when someone submits a form on the site.
GitHub: hosts the private repositories we use to deliver digital products. GitHub sees your GitHub username when we invite you. GitHub also hosts the private backup of our business-contact records (section 2.9): contact names, work email addresses, what we sent and when, and our “do not email” list, whose addresses are stored only in scrambled form.

We may also share data with professional advisers (such as an accountant), and where the law requires it, for example with HMRC or in response to a valid legal request. If SecureByDesignLabs Ltd’s business is transferred to another company, your data transfers with it, and this policy continues to apply.

5. Transfers outside the UK

Several of these providers store or access data outside the UK, including in the European Economic Area and the United States. When that happens, we rely on UK adequacy regulations (which cover the EEA and US organisations certified under the UK Extension to the EU-US Data Privacy Framework), or on the provider’s standard contractual protections approved for UK transfers (the ICO’s International Data Transfer Agreement or Addendum). You can ask us for details of the protection that applies to a particular provider.

6. How long we keep it

Newsletter and CRA updates list: until you unsubscribe. After that we keep only your email address on a “do not email” list, so we don’t email you again by mistake.
Reminders: until the reminder has been sent, or until you ask us to stop, whichever is first. After that we delete the reminder details. If you asked us to stop, we keep only your email address on our “do not email” list.
Form submissions, enquiries and emails that don’t lead to an order: up to 24 months after our last contact with you.
Orders, invoices, contracts and payment records: for as long as UK tax and accounting law requires us to keep them: 6 years from the end of the financial year they relate to.
Material you give us during an engagement: for the engagement, then as the Terms of Service describe. You can ask us to delete it at any time. Unless you ask us to keep it for follow-on work, we delete code, app builds and system access within 90 days after the engagement ends. We keep the reports we produced for you, and our records of the work, for 6 years, like our other business records.
Comments and reviews: for as long as the comment is published. Ask us to remove it at any time.
Accounts: until you ask us to close the account, or until we close it once the purchase it was for has ended.
Business contact records (section 2.9): 24 months after the date we last contacted you, which we record, unless you become a customer. Addresses we worked out from a company’s email format and didn’t use are deleted within 30 days. If you asked us to stop, we keep only the scrambled address on our “do not email” list.
Cookies: for the durations listed in section 3.

7. Your rights

Under UK data protection law you have the right to:

ask for a copy of the personal data we hold about you;
ask us to correct data that is wrong or incomplete;
ask us to delete your data, or to restrict how we use it;
object to our use of your data where we rely on legitimate interests, and to direct marketing at any time;
receive data you gave us in a portable format, where we use it on the basis of consent or a contract;
withdraw your consent at any time, where we rely on it (this doesn’t affect what we did before).

To use any of these rights, email support@securebydesignlabs.com. We will reply within one month. Some rights have limits: for example, we can’t delete records the law requires us to keep. We don’t make decisions about you based solely on automated processing.

If you’re unhappy with how we’ve handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint, or by phone on 0303 123 1113.

8. Keeping your data secure

We use providers with established security programmes, limit access to your data to the people who need it, and encrypt data in transit to and from the site. No system is perfectly secure. If a breach puts your data at risk, we will tell you and the ICO where the law requires it.

9. Changes to this policy

We will update this page when what we collect or who we share it with changes, and change the “Last updated” date at the top. If a change materially affects how we use data you’ve already given us, we will tell you by email before it takes effect.