Privacy and Data Protection Policy
Sports Labs Ltd
Effective Date: 24/06/2026 | Review Date: 24/06/2027
1. Introduction
Sports Labs Ltd (“Sports Labs”, “we”, “us”, or “our”) is an independent sports technology testing and certification organisation. We are committed to protecting the personal data of our website visitors, clients, and contacts.
This Privacy and Data Protection Policy explains what personal data we collect through our website at www.sportslabs.co.uk, why we collect it, how we use it, how we protect it, and the rights available to you under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Please read this Policy carefully. By using our website, you acknowledge that your personal data will be handled as described in this Policy.
2. Who We Are (Data Controller)
For the purposes of UK data protection law, the Data Controller responsible for your personal data is:
Sports Labs Ltd
Registered Address: 1 Adam Square, Brucefield Industry Park, Livingston, EH54 9DE, Scotland, United Kingdom
Company Number: SC186755 (registered in Scotland)
ICO Registration Number: [INSERT ICO REGISTRATION NUMBER]
Email: info@sportslabs.co.uk
Telephone: +44 (0) 1506 444 755
Website: www.sportslabs.co.uk
Data Protection Contact: Niall MacPhee, Director at info@sportslabs.co.uk
3. Personal Data We Collect
We collect only the minimum personal data necessary for the purposes described in this Policy (the principle of data minimisation). When you use our website, we may collect the following categories of personal data:
3.1 Data You Provide Directly
Identity and contact information: full name, job title, business name, business email address, business telephone number, and business postal address.
Enquiry data: the content of any messages, queries, or correspondence you submit through our contact form or by email.
Subscription data: your name and email address if you subscribe to our Field Notes or Pitch Matters newsletters.
Recruitment data: your name, contact details, CV, and professional information if you apply for a role with us through the website.
3.2 Data Collected Automatically
When you visit our website, the following technical data may be collected automatically through cookies and similar technologies:
Technical identifiers: your IP address and approximate geographic location (at country or city level).
Device and browser data: browser type and version, device type, and operating system.
Usage data: the pages you visit, time spent on each page, navigation paths, and referring website or search terms.
Cookie identifiers: session data and unique cookie identifiers as detailed in Section 6.
3.3 Data We Do Not Collect
We do not collect special category (sensitive) personal data such as health, biometric, racial, religious, or political data through our website.
We do not knowingly collect data from individuals under the age of 18. Our website is directed at business professionals.
We do not process payment card or financial data through the website. All payments are handled offline through separate channels.
We do not engage in profiling or automated decision-making that produces legal or similarly significant effects on individuals.
4. Purposes and Legal Bases for Processing
Under the UK GDPR, we must have a lawful basis for each purpose for which we process your personal data. The legal bases on which we rely are set out below.
To respond to enquiries: we process your name, contact details, and the content of your enquiry on the basis of our Legitimate Interests (Article 6(1)(f) UK GDPR) in responding to business communications.
To send newsletters you have subscribed to: we process your name and email address on the basis of your Consent (Article 6(1)(a) UK GDPR), which you may withdraw at any time.
To analyse website usage: we process technical data on the basis of our Legitimate Interests (Article 6(1)(f) UK GDPR) in improving the website. Non-essential cookies are only used with your consent in accordance with the Privacy and Electronic Communications Regulations (PECR).
To process job applications: we process recruitment data on the basis of our Legitimate Interests (Article 6(1)(f) UK GDPR) and to take pre-contractual steps at your request (Article 6(1)(b) UK GDPR).
To comply with legal obligations: we process personal data where required by law, regulation, or accreditation requirements, on the basis of Legal Obligation (Article 6(1)(c) UK GDPR).
To establish, exercise, or defend legal claims: we may process relevant data on the basis of our Legitimate Interests (Article 6(1)(f) UK GDPR).
Where we rely on Legitimate Interests, we have conducted a balancing test to confirm that our interests are not overridden by your rights and freedoms. These assessments are documented internally and available on request.
5. How We Collect Your Data
We collect personal data through the following means.
Directly from you: when you complete a contact form, subscribe to a newsletter, submit a job application, or correspond with us by email or telephone.
Automatically: through cookies and analytics technologies when you visit our website. See Section 6 for full details.
From third parties: in limited cases, a colleague or business contact may provide your details to us in connection with a project or enquiry. In such cases we will inform you of their involvement at the earliest practical opportunity.
6. Cookies and Tracking Technologies
We use cookies and similar technologies on our website. Cookies are small text files placed on your device that help us operate the website and understand how it is used.
6.1 Categories of Cookies We Use
Strictly Necessary Cookies: essential for the website to function (for example, session management and security). These do not require your consent.
Analytics Cookies: we use Google Analytics to understand how visitors interact with the website. These cookies are only set with your consent.
Functional Cookies: these remember your preferences (for example, language and cookie banner status). These are only set with your consent.
6.2 Managing Your Cookie Preferences
You can manage or withdraw your consent to non-essential cookies at any time. You may do this through the cookie preference centre or banner on our website, or through your browser settings (most browsers allow you to refuse or delete cookies).
You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on at tools.google.com/dlpage/gaoptout.
Please note that disabling strictly necessary cookies may affect your ability to use certain features of our website.
7. Data Sharing and Third-Party Processors
We do not sell, rent, or trade your personal data. We share your personal data only in the circumstances described below.
7.1 Third-Party Service Providers
We engage carefully selected third-party processors who handle personal data on our behalf, under written data processing agreements that require them to process data only on our documented instructions. These include providers of website hosting, website analytics (Google Analytics), email and newsletter delivery, and cloud-based file storage and communications.
7.2 Legal Disclosure
We may disclose personal data to law enforcement agencies, courts, regulators, or government bodies where we are legally required to do so, or where it is necessary to protect the rights, property, or safety of Sports Labs Ltd or others.
7.3 Business Transfers
In the event of a merger, acquisition, restructuring, or sale of assets, personal data may be transferred to the successor entity. Any such transfer will be subject to equivalent data protection obligations.
8. International Data Transfers
Some of our third-party service providers are based outside the United Kingdom (for example, certain analytics and email providers located in the United States). Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place to protect your data, as required by the UK GDPR.
These safeguards include the use of the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, alongside any supplementary measures necessary to ensure an equivalent level of protection to that provided under UK law.
You may request a copy of any relevant transfer mechanism by contacting us using the details in Section 14.
9. Data Retention
We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law or regulation. Our retention periods are as follows.
Contact form and enquiry data: retained for 24 months from the date of last contact, then securely deleted.
Newsletter subscriber data: retained until you unsubscribe, plus a further 6 months for record-keeping purposes.
Job application data (unsuccessful applicants): retained for 6 months from the date of application, in case of further suitable opportunities. Longer retention requires your consent.
Website analytics data: retained for 14 months in Google Analytics (the configured default).
Client and contract records: retained for 7 years from project completion to satisfy legal obligations including tax and Companies Act requirements.
Following the expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymised. Anonymised aggregate data (from which no individual can be identified) may be retained indefinitely for statistical or research purposes.
10. Security Measures
We implement appropriate technical and organisational security measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure, or destruction.
Technical measures include SSL/TLS encryption of all data transmitted to and from our website, secure hosting infrastructure with access controls, regular software updates and security patches, and encrypted email communications in transit.
Organisational measures include restricting access to personal data on a need-to-know basis, providing data protection training to staff, vetting third-party processors and entering into written data processing agreements with them, and maintaining internal data protection policies that are reviewed annually.
10.1 Data Breach Procedures
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the UK Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach, in accordance with Article 33 UK GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.
11. Your Rights Under UK GDPR
You have the following rights in relation to your personal data. We will respond to all valid requests within one calendar month, although this period may be extended by up to two further months for complex or numerous requests, in which case we will notify you.
Right of Access (Article 15): you may request a copy of the personal data we hold about you, also known as a Subject Access Request.
Right to Rectification (Article 16): you may ask us to correct any inaccurate or incomplete personal data we hold about you.
Right to Erasure (Article 17): also known as the “right to be forgotten”, you may ask us to delete your personal data where there is no compelling legal reason for us to continue processing it.
Right to Restrict Processing (Article 18): you may ask us to pause processing of your data in certain circumstances, for example while accuracy is being contested.
Right to Data Portability (Article 20): where processing is based on consent or contract and carried out by automated means, you have the right to receive your data in a structured, machine-readable format, or to have it transferred to another controller.
Right to Object (Article 21): you may object to processing based on legitimate interests, or to processing for direct marketing purposes. We will stop unless we can demonstrate compelling legitimate grounds.
Right to Withdraw Consent (Article 7): where we process data on the basis of your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.
Right Not to Be Subject to Automated Decision-Making (Article 22): you have the right not to be subject to a decision based solely on automated processing (including profiling) that produces a legal or similarly significant effect on you. We do not engage in such processing.
To exercise any of these rights, please contact us using the details in Section 14. We may need to verify your identity before processing your request. There is no charge for exercising your rights unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request.
11.1 Right to Lodge a Complaint
You have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) if you believe that we have not handled your personal data in accordance with the UK GDPR. You can contact the ICO at www.ico.org.uk, by telephone on 0303 123 1113, or by post at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
We would, however, appreciate the opportunity to address your concerns directly before you contact the ICO. Please contact us first if possible using the details in Section 14.
12. Children’s Privacy
Our website and services are directed at business professionals and organisations. We do not knowingly collect personal data from individuals under the age of 18. If you believe that a child has submitted personal data to us through the website, please contact us immediately using the details in Section 14 and we will take prompt steps to delete such data.
13. Third-Party Websites and Social Media
Our website may contain links to third-party websites, including governing body websites and our official social media profiles on LinkedIn, X (Twitter), Facebook, Instagram, and YouTube. Once you leave our website, this Policy no longer applies, and your interactions with those third parties are governed by their own privacy policies and terms.
We have no control over the content or privacy practices of third-party websites and accept no responsibility for them. We encourage you to review the privacy policies of any third-party site you visit before submitting any personal data to it.
14. Contact Us
For any questions, requests, or concerns relating to this Policy or our processing of your personal data, please contact our designated Data Protection Contact.
Email: info@sportslabs.co.uk
Post: Data Protection Contact, Sports Labs Ltd, 1 Adam Square, Brucefield Industry Park, Livingston, EH54 9DE, Scotland, United Kingdom
Telephone: +44 (0) 1506 444 755
We aim to resolve all data protection queries promptly and fairly. If you are not satisfied with our response, you have the right to escalate your complaint to the ICO (see Section 11.1).
15. Changes to This Policy
We review this Policy at least annually and whenever there is a material change to our processing activities, applicable law, or regulatory guidance. We will publish the updated Policy on this page with a revised effective date. For significant changes, we will provide prominent notice on the website and, where appropriate, notify newsletter subscribers by email at least 14 days prior to the change taking effect.
The effective date shown at the top of this Policy will always reflect the most current version.