Privacy Policy (UK GDPR)

Last updated: November 2026 · Data Controller: ETHAR LABS UK LTD (Company No. 17032523)

1. Introduction

ETHAR LABS UK LTD (“we”, “us”) provides defensive security and infrastructure engineering services. This policy explains how we process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data We Collect

We collect business contact data (name, email, organisation), order and payment reference metadata (transaction hashes, invoice references), and technical scope data you submit (domains, configuration excerpts). We do not request credentials, private keys, or production secrets.

3. Purpose & Lawful Basis

Processing is necessary for contract performance (delivering your authorised audit), legitimate interests (fraud prevention and service integrity), and legal obligations (financial record-keeping).

4. Data Minimisation & Retention

We apply data minimisation by design. Sensitive target configuration supplied for analysis is not retained after engagement completion beyond what is required for your delivered report. Executive PDF reports are stored encrypted at rest on our infrastructure for the warranty period stated in our Refund & SLA policy, then securely deleted unless you request earlier erasure.

5. Security

Reports and order metadata are protected using access controls, encrypted storage, and principle-of-least-privilege administrative access aligned with Cyber Essentials practices.

6. Non-Disclosure

All engineers operate under strict confidentiality. Findings, scope, and deliverables are not disclosed to third parties except subprocessors strictly required to host infrastructure (e.g. cloud hosting), bound by data processing terms.

7. Your Rights

You may request access, rectification, erasure, restriction, portability, or object to processing. Contact: privacy@etharlabs.uk (operational address on file with Companies House). You may lodge a complaint with the ICO (ico.org.uk).

8. International Transfers

Where data is processed outside the UK, we implement appropriate safeguards such as UK IDTA or adequacy regulations.