Privacy policy.

We keep this simple. This policy explains what personal data we collect when you use this website or get in touch with us, why we collect it, and what your rights are.

Who we are.

Cobalt Labs Limited, trading as Cobalt, is an AI consultancy for small and medium-sized businesses, registered in England and Wales under company number 17347364.

We are the controller of the personal data described in this policy, and we are registered with the Information Commissioner's Office (ICO).

If you have any questions about this policy or your data, email Ben Farley at ben@cobalt.work.

The data we collect.

We collect very little, and only what we need.

When you contact us or book a call

Your name, email address, company name, and anything you choose to tell us about your business. We get this directly from you, by email or through our booking process.

When you become a client

Contact details, billing details, and information about your business needed to deliver our services. Our client work is governed by our Client Engagement Agreement, which contains detailed confidentiality and data protection commitments.

When you visit this website

Standard technical data such as your IP address, browser type, device type, and pages visited. See our cookies policy for details of any cookies used.

We do not collect special category data, such as health or political information.

Children and young people.

This website and our services are for businesses and the adults who run them. They are not intended for children or young people.

Please do not contact us, book a call or submit any personal data through this site if you are under 18. Under UK GDPR a child of 13 or over can in principle consent to their own data being processed, and under EU GDPR the age ranges from 13 to 16 depending on the country, but our services are not designed for under-18s and we do not want their data.

If you are under 18 and you submit personal data anyway, that is on you. We will treat any data we realise has come from someone under 18 as submitted in breach of these terms, and we will delete it as soon as we become aware. If you are a parent or guardian and believe your child has sent us data, email ben@cobalt.work and we will remove it.

Why we collect it, and our lawful basis.

We do not sell your data. We do not use your data for automated decision-making or profiling. If we ever want to send you marketing you have not asked for, we will get your consent first, and every message will include a way to opt out.

Who we share it with.

Only the service providers we need to run the business, and only what they need to do their job:

• Website hosting and infrastructure. Our website is built and hosted on Lovable, with assets served via Cloudflare.
• Email and productivity tools. To communicate with you and manage our work.
• Accounting and payment providers. To invoice and keep proper records.
• Professional advisers. Accountants, lawyers and insurers where necessary.

Each provider is bound by contract to protect your data. We never give your data to third parties for their own marketing.

If we are required to disclose data by law, a court or a regulator, we will.

Where your data lives.

We store data in the UK and the European Economic Area where possible. Some of our providers process data outside the UK (for example, in the United States). Where that happens, the transfer is protected by recognised safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision.

How long we keep it.

• Enquiries that do not go anywhere. Up to 12 months, then deleted.
• Client records. For the length of our engagement, then up to six years to meet legal, tax and insurance obligations.
• Accounting records. Six years, as required by law.

When we no longer need data, we delete it securely.

Your rights.

You have the right to:

• Access the personal data we hold about you
• Correct anything that is inaccurate
• Delete your data, where we no longer have grounds to keep it
• Restrict or object to how we use it
• Receive a copy of your data in a portable format
• Withdraw consent at any time, where we rely on consent

To exercise any of these, email ben@cobalt.work. We will respond within one month. There is no fee unless a request is clearly unfounded or excessive.

If you are not happy with how we have handled your data, you can complain to the ICO at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put it right first.

Changes to this policy.

If we change this policy, we will update this page and the date at the top. Significant changes affecting how we use your data will be flagged clearly.

Where you live.

We are a UK company and this policy is written around UK law. The rights above apply to everyone, but a few jurisdictions give people extra ones.

UK

Your data is governed by the UK GDPR and the Data Protection Act 2018. Our supervisory authority is the Information Commissioner's Office at ico.org.uk.

European Economic Area

If you are in the EEA, the EU GDPR applies to our processing of your data. You have the same rights set out above, and you can complain to the supervisory authority in the country where you live, work or believe the issue happened. A list is available at edpb.europa.eu.

California

If you are a California resident, the CCPA and CPRA give you the right to know what personal information we hold, request deletion or correction, and opt out of the sale or sharing of your data. We do not sell or share personal information, we do not use it for cross-context behavioural advertising, and we do not use it to train AI models. To exercise any of these rights, email ben@cobalt.work.

Everywhere else

If your local law gives you stronger rights than those described above, those rights still apply. Get in touch and we will honour them.