Privacy Policy

1. Who is responsible for your information?

The controller responsible for the processing described here is BUCHANON COMPANY LTD, acting through its registered Swiss branch, BUCHANON COMPANY LTD, London, Zweigniederlassung Zug, trading as Northern Revenue Labs.

The company is registered in England and Wales under number 11111405; its UK registered office is 7 Bell Yard, London WC2A 2JR. See Legal Information for the full company details.

2. Which personal data do we process?

• Website visits: technical connection and security information such as IP address, request time, browser or device information, referring page and requested URL may be processed by our hosting and security provider.
• Contact enquiries: the name, business email, company, website (if provided), challenge selected and any message you submit. We may retain our correspondence and steps taken to respond.
• Bookings and meetings: the name, contact details, appointment time, information supplied to Calendly, Zoom meeting participation details and relevant communications.
• Professional B2B communications: where permitted, professional identity, job role, business contact details, company information, relevant publicly available professional information and a history of our communications. Such information may originate from a public company website, a professional network, a direct referral or a business information provider.
• Business relationships: if you engage us, the correspondence and business records reasonably required to deliver services, administer contracts and meet legal obligations. Client project data may also be covered by a separate agreement or data processing arrangement.

We do not request passwords, payment card details, health information or confidential financial records through our introductory website enquiry form. Please do not include such information in free-text messages.

3. Why do we use this information?

We process relevant data to operate and protect the site, respond to an enquiry, assess whether our services may be suitable, arrange and conduct meetings, develop professional business relationships, prepare proposals and, where relevant, fulfil a contract and legal record-keeping requirements.

Under the EU/UK GDPR where applicable, the legal grounds may include steps requested before entering into a contract (Article 6(1)(b)); our legitimate interests in managing relevant professional enquiries, maintaining site security and establishing B2B relationships (Article 6(1)(f), balanced against individual rights); and compliance with legal obligations (Article 6(1)(c)). Other grounds are used only where appropriate for the specific purpose. Swiss processing is also subject to the Swiss Federal Act on Data Protection (FADP).

Submitting an enquiry asks us to respond to that enquiry; it is not a subscription to a general marketing mailing list. Any other direct marketing or outreach is conducted subject to applicable national electronic marketing rules and the right to object. You can request that we stop contacting you for marketing purposes at contact@nrlabs.io.

4. Which providers receive or process information?

• Google Analytics 4 (GA4) is our optional audience measurement provider; its direct Google tag is loaded only after your analytics opt-in. Measurement may involve device and technical information, page views and interaction events subject to Google Analytics settings, consent and Google policies. Google Analytics privacy controls.
• Google Tag Manager loads the Google-hosted container and may process connection metadata. See Google privacy information.
• Cloudflare hosts and delivers the static site and provides technical or security services; network and security data may be processed when the site is visited. Cloudflare privacy information.
• Formspree receives enquiry form submissions on our behalf and forwards notifications to our contact email. Form submissions include the fields you complete and associated delivery/security information. Formspree privacy information.
• Calendly handles bookings and sends appointment-related communications. The booking takes place on Calendly's own website after you choose the booking link. Calendly privacy notice.
• Zoom provides video meetings when you join a scheduled call. Zoom privacy statement.
• Email and professional service providers may handle correspondence and records where needed for business operations. Advisers, contractors or authorities receive information only as required for an appropriate purpose or legal obligation.

We do not publish enquiry submissions or offer visitors' personal information for sale. Access to submissions and correspondence is limited according to operational need.

5. International processing and transfers

Our business operates from Switzerland through a UK company, and we work with providers whose systems may process information in other countries, including the United States. In particular, Formspree and Calendly describe US-based processing. Cloudflare's network operates internationally; Zoom and communications services may involve further processing locations.

Where cross-border processing requires specific legal safeguards, applicable data protection rules may require an adequacy basis, recognised data transfer framework or suitable contractual safeguards such as standard contractual clauses. Relevant providers describe their arrangements in their published notices and contractual materials. Contact contact@nrlabs.io if you require information relevant to a particular transfer.

6. How long do we retain information?

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected. We assess retention based on whether an enquiry or opportunity is active, whether you remain in correspondence with us, whether a client relationship develops, the need to address potential disputes and applicable statutory record-keeping requirements.

Inactive enquiries are reviewed for deletion or anonymisation when they no longer serve a valid business purpose. If an engagement begins, relevant contractual, accounting and other business records may need to be kept for longer periods required by law. Our external providers may keep their own security logs or service copies for periods described in their policies or our service configuration. We can explain the applicable criteria in response to a request.

7. Cookies, analytics and external websites

This site includes Google Tag Manager (container GTM-KQTM8M64), a tag-management service loaded from Google's servers. Loading the container may send technical request data such as an IP address, browser and time of access to Google. Which further information is processed depends on the tags configured and published in the container. See Google's privacy policy.

Optional Google Analytics 4 (measurement ID G-9K059EJ4WC) helps us understand which pages visitors use and how people navigate our website. It is not loaded by our site's own analytics integration until you choose “Accept analytics”. If you reject analytics, the optional GA4 library is not loaded by that integration. You can change or withdraw this choice at any time using “Privacy choices” in the website footer. We save this preference in your browser's local storage; no additional opt-in is assumed from using the website or submitting an enquiry.

Our Google consent defaults deny analytics and advertising storage. Accepting analytics permits analytics storage only; we do not grant advertising consent with this control. Please note that the Google Tag Manager container itself loads separately and may transmit technical request information, and its actual behaviour also depends on the tags published in the container. Where applicable, Google's own analytics cookies and retention settings apply after consent. Before adding advertising or other optional tags, we will review their purposes, ensure that appropriate consent choices are offered and update this policy. Our hosting and security services may separately process technical request data needed to operate or protect the site.

When you follow a link to Calendly, Zoom or another external website, that provider's own cookies, technologies and privacy choices apply.

8. Your data protection rights

Subject to the law that applies, you may ask for access to information held about you, correction of inaccurate information, deletion, restriction of processing, or object to processing. Where applicable, you may also have a right to data portability or to withdraw consent without affecting earlier lawful processing. We will consider requests under the applicable Swiss FADP and, where relevant, the EU or UK GDPR.

Send requests to contact@nrlabs.io. To protect personal information, we may ask for appropriate verification before disclosing or changing data. You may also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or an applicable EU, EEA or UK supervisory authority.

9. Security, automated decisions and confidentiality

We use reasonable technical and organisational measures appropriate to the nature of the information and the services involved. No internet transmission or storage method is guaranteed to be completely secure. Business enquiries are reviewed by a human; website enquiry submissions are not used to make solely automated decisions producing legal or similarly significant effects.

Do not send sensitive personal information, passwords or client-confidential records through the general contact form. Appropriate confidentiality and any client-specific processing arrangements are addressed separately when we discuss a paid engagement.

10. Updates and contact

We may amend this notice when our services, suppliers or relevant legal requirements change. The effective date above indicates the current version. For questions about this notice or requests concerning your information, contact contact@nrlabs.io.