Privacy Policy

Last Updated 7 October 2026 

Digital Wonderlab respects your privacy and is committed to protecting your personal information. This notice explains how we collect, use, store and share personal information when you visit our website, contact us, receive communications from us, interact with us as a business contact, attend an event or meeting, or otherwise engage with Digital Wonderlab.

1. Who we are 

Digital Wonderlab Limited is the data controller responsible for the personal information described in this Privacy Notice. 

Detail Information 

Company Digital Wonderlab Limited

Company number 06671481

ICO Registration number ZA008548

Registered office Runway East, Parsonage Lane, Bath, England, BA1 1ER

Privacy email privacy@digitalwonderlab.com

Website digitalwonderlab.com 

Where Digital Wonderlab processes personal information on behalf of one of our clients when delivering websites, applications, platforms or other digital services, we may instead act as a data processor. That processing is governed by our contractual arrangements with the relevant client and their privacy information.

2. What personal information we collect 

The information we collect depends on how you interact with us and may include: 

• your name, job title and organisation; 

• business email address, telephone number and other contact details; 

• information that you provide when contacting or corresponding with us; 

• information about your organisation, business requirements, interests and potential projects; 

• information about meetings, events and communications with us; 

• information about our business relationship and previous interactions; 

• marketing preferences, subscriptions and opt-out information; 

• publicly available professional and business information; 

• information supplied by business information and lead-generation providers; 

• information about how you interact with our marketing communications; 

• IP address, browser, device, referring website and website usage information; and 

• cookie, analytics and similar technical information where applicable. 

We do not generally require special category personal information, such as health information, racial or ethnic origin, religious beliefs or information about sexual orientation, as part of ordinary website, sales or marketing interactions. Please avoid providing this type of information unless it is genuinely necessary.

3. How we obtain your information 

We may obtain personal information directly from you when you contact us through our website, email, telephone or another communication channel; subscribe to Lab Notes or other communications; download content; book a meeting; attend an event; become a customer, supplier or business partner; or otherwise interact with Digital Wonderlab. 

We may also obtain business contact information from other sources, including: 

• your organisation's website; 

• professional networking platforms such as LinkedIn; 

• publicly available business information; 

• referrals and introductions; 

• events and professional networks; 

• business directories; and 

• business information and lead-generation services such as Apollo.io.

We may use sales-enablement technologies, including Dripify, to help manage appropriate business-to-business outreach through professional networking channels. 

Where we obtain your personal information from somewhere other than directly from you, we will provide appropriate privacy information as required by law, including information about the source and categories of information involved. Where we communicate with you, this information will normally be provided at or before our first communication, or otherwise within the period required by law.

4. Why we use personal information 

We use personal information for the following purposes:

Where we rely on legitimate interests, we consider whether the processing is necessary and proportionate and balance our interests against the interests, rights and freedoms of the individual concerned. Our legitimate interests can include developing our business, identifying organisations that may benefit from our services, communicating with relevant professional contacts, maintaining business relationships, understanding the effectiveness of our services and communications, improving our digital services, and protecting our business and systems.

5. Business-to-business marketing and lead generation 

As a business-to-business organisation, we may identify and contact people in relevant professional roles where we reasonably believe our services or expertise could be relevant to their organisation. 

This may include information identified from professional networking platforms, public business information and specialist business information services such as Apollo.io. We may use sales-enablement services such as Dripify to support appropriate outreach and engagement. 

Where personal information is involved, UK data protection law continues to apply even though the information relates to an individual's professional role. For business-to-business marketing we may rely on our legitimate interests where it is appropriate to do so. We take account of the nature of the contact, their professional role, the relevance of the communication and their reasonable expectations. 

Different electronic marketing rules can apply to sole traders and certain types of partnerships. We take these differences into account when planning and operating outbound marketing activity. 

You can object to direct marketing at any time. We will respect that request and may retain limited information on a suppression list to ensure that we do not contact you again. 

6. Email marketing 

We may send Lab Notes, insights, invitations and other relevant communications about Digital Wonderlab. Where consent is required, we will obtain it before sending these communications. Where the law permits business-to-business marketing without consent, we may rely on legitimate interests where our assessment shows that this is fair and proportionate. 

You can unsubscribe at any time using the unsubscribe link in an email or by contacting privacy@digitalwonderlab.com. 

We currently use Mailchimp to manage aspects of our email marketing, subscriptions and marketing preferences. Mailchimp and its authorised sub processors may process information on our behalf in accordance with applicable contractual and data protection safeguards.

7. Customer and business relationship management 

We maintain information about existing and prospective customers, partners and other business contacts to help us manage our relationships and understand previous interactions. 

We currently use Salesforce as one of our customer relationship management platforms. Information held there may include contact details, organisation, job role, correspondence, meetings, previous interactions, opportunities, requirements, interests and marketing preferences.

8. Website hosting 

Our website is hosted using Umbraco Cloud, provided by Umbraco A/S. Our production Umbraco Cloud environment is hosted in the UK South Microsoft Azure region. 

Information submitted through the website and technical information associated with operation of the website may therefore be processed through Umbraco Cloud and its authorised service providers, including infrastructure providers such as Microsoft Azure.

9. Meetings, integrations and automation 

We use technology services to help organise meetings and automate routine business processes. These currently include: 

Service Purpose 

Calendly Scheduling meetings and managing associated booking information 

Zapier Connecting approved systems and automating workflows between them 

Information processed through these services depends on the workflow involved and may include names, contact details, meeting information and relevant business information. Where these services process personal information on our instructions, we require appropriate contractual and data protection arrangements.

10. Artificial intelligence 

We use approved artificial intelligence and AI-assisted services to help our team work more effectively. This may include services such as Anthropic Claude and other approved business AI tools for activities including research, drafting, summarisation, analysis and supporting internal business workflows. 

Where these activities involve personal information, we seek to use only the information reasonably necessary for the task and apply appropriate organisational, access and contractual controls. Staff are expected to use approved business accounts and follow Digital Wonderlab's internal rules for the use of personal, confidential and client information in AI services. 

We do not use AI tools to make solely automated decisions about individuals that produce legal or similarly significant effects.

11. Website analytics, tags and cookies 

We use cookies and similar technologies to operate our website and understand how it is used. We also use Google Tag Manager to manage analytics and other website tags. The information ultimately processed depends on the tags configured within Tag Manager and the choices you make through our cookie controls. 

Where consent is required for cookies or similar technologies, we ask for it before carrying out the relevant processing. Some strictly necessary and other permitted low-risk technologies may be used without consent where applicable law allows this, subject to the relevant transparency requirements. 

Our separate Cookie Policy describes the technologies currently in use, their purposes, providers and retention periods.

12. Organisations we share information with 

We do not sell personal information. 

We may share or otherwise make personal information available to trusted organisations where necessary to operate our business. Our principal services currently include: 

Provider / service Main purpose 

Umbraco Cloud / Microsoft Azure Website hosting and infrastructure 

Salesforce CRM and business relationship management 

Mailchimp Email marketing and subscriptions 

Apollo.io Business information and lead generation 

Dripify Sales enablement and LinkedIn outreach 

Calendly Meeting scheduling 

Zapier Systems integration and workflow automation 

Anthropic Claude and other approved AI-assisted business activities 

AI services  

Google services, including Google Website tagging, measurement and analytics where configured 

Tag Manager

We may also use professional advisers, IT and security providers, accounting providers and other services necessary to operate our business. Some providers act as processors on our instructions. Others may act as independent controllers for certain activities. Some providers use their own authorised sub processors. 

We require appropriate contractual and data protection arrangements where a provider processes personal information on our behalf. Our suppliers and systems may change from time to time, and we review this notice when changes materially affect how personal information is processed. 

13. International transfers 

Although our principal website hosting environment is located in the UK, some of our other service providers operate internationally. This means personal information may sometimes be processed or accessed outside the United Kingdom, including in the United States. 

Where a transfer is subject to UK restrictions on international transfers, we use an appropriate lawful mechanism. Depending on the provider and destination, this may include UK adequacy regulations, participation in an applicable approved data-transfer framework, the UK International Data Transfer Agreement, the UK Addendum to approved Standard Contractual Clauses, or another lawful safeguard. 

We also consider appropriate technical, organisational and contractual measures when selecting and managing providers. 

14. How long we keep information 

We keep personal information only for as long as there is a continuing and justifiable need for the purpose for which it is held. Retention periods therefore vary according to the information involved, the purpose for which it is used, legal requirements and the nature of our relationship with you. 

• Business contacts and prospective customers may be retained while the information remains relevant to an existing, previous or reasonably anticipated business relationship and while we have a legitimate reason to retain it. 

• Customer and contractual records may be retained for longer where needed for contractual, accounting, taxation, legal or regulatory purposes. 

• Marketing information may be retained while we have a lawful basis to communicate with you. If you object or unsubscribe, we may retain limited information on a suppression list so that we can respect that preference. 

• Website and analytics information is retained according to the relevant technology and configuration, as described in our Cookie Policy. 

We periodically review personal information and will delete, anonymise or otherwise stop actively using information where there is no longer a reasonable purpose for retaining it. We do not retain personal information indefinitely simply because it may be useful in the future.

15. How we protect information 

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration, loss or destruction. Measures include, where appropriate: 

• access controls and authentication; 

• secure cloud platforms; 

• encryption and secure communications; 

• security monitoring; 

• controlled permissions; 

• supplier and processor due diligence; 

• contractual data protection controls; 

• staff awareness and training; and 

• appropriate incident-management procedures.

16. Your rights 

Depending on the circumstances, UK data protection law gives you rights including the right to: 

• ask what personal information we hold about you and obtain a copy; 

• correct inaccurate or incomplete information; 

• ask us to delete information in certain circumstances; 

• restrict certain processing; 

• object to processing based on legitimate interests; 

• object at any time to direct marketing; 

• withdraw consent where processing relies on consent; 

• receive certain information in a portable form; and 

• raise concerns about how your personal information is used.

These rights can be subject to conditions and exemptions under data protection law. To exercise a right, email privacy@digitalwonderlab.com.

17. Data protection complaints 

If you are concerned about how we have collected or used your personal information, you can make a data protection complaint to privacy@digitalwonderlab.com. 

We will provide a clear route for making a complaint, acknowledge receipt within 30 days, investigate it appropriately without undue delay and communicate the outcome. 

You also have the right to raise your concern with the UK's data protection regulator. The legal regulator is the Information Commission and the organisation is known as the Information Commission's Office (ICO). Further information is available at ico.org.uk.

18. Contact us 

For privacy questions, data-protection rights requests or complaints, contact: 

Privacy Team 

Digital Wonderlab Limited 

Runway East 

Parsonage Lane 

Bath 

BA1 1ER 

Email: privacy@digitalwonderlab.com

19. Links to other websites 

Our website may contain links to websites and services operated by other organisations. Those organisations are responsible for their own privacy practices. We recommend reviewing their privacy information before providing personal information to them.

20. Changes to this Privacy Notice 

We review this Privacy Notice periodically and may update it when our services, systems, suppliers or legal obligations change. The latest version will always be published on our website and the date at the top will show when it was last updated. Where a change materially affects how we use personal information, we will take reasonable steps to notify affected individuals where appropriate.