Last updated: 19 October 2026
1. Who we are
This website is operated by KFY LABS LLP (“KFY LABS”, “we”, “us”, “our”), a limited liability partnership registered in England and Wales under number OC449599, with its registered office at 27 Old Gloucester Street, London WC1N 3AX, United Kingdom. We are the controller of the personal data processed through this website within the meaning of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Contact for privacy matters: info@kfylabs.com. We have not appointed a Data Protection Officer, as we are not required to do so.
2. What this policy covers
This policy explains what personal data we collect when you visit this website or contact us through it, why we collect it, how long we keep it and what rights you have. It applies to the website at https://kfylabs.com and to email or telephone correspondence that starts here. Where an inquiry leads to an order, this policy also explains, in outline, how we handle the business contact details of our customers’ and suppliers’ representatives during that order (sections 4, 5, 7 and 8); further details may be set out in the relevant contract documents.
3. Data we collect
3.1 Data you give us through the contact form
When you send a request, we collect the information you enter: name, company, email address, telephone number (optional), country (optional), subject, message text and any file you attach. Attachments may contain technical drawings or parts lists; please do not include personal data of third parties unless it is necessary for your request. The form runs on our own web server (WordPress plugin Contact Form 7). Submissions are sent to us by email to info@kfylabs.com and are not stored in the website’s database; temporary copies of attachments are deleted from the server automatically once the email has been sent. The fields marked * are needed to answer your request; without them we cannot process it. All other fields are voluntary.
To protect the form against automated abuse, it contains a hidden field that is invisible to human visitors (a “honeypot”). Submissions that fill in that field are discarded. No third-party anti-spam service is used and no cookies are set for this purpose.
3.2 Data you give us by email or telephone
If you contact us directly, we process the contact details and content you provide in order to handle your inquiry.
3.3 Data collected automatically (server log files)
When you open the website, the web server that hosts it automatically records technical information: the IP address of your device, date and time of access, the pages requested, the referring URL, browser type and version, and operating system. This data is needed to deliver the website securely and to detect and investigate misuse. Log files are deleted after 30 days.
3.4 Cookies
See section 6.
4. Why we process your data and on what legal basis
| Purpose | Data | Lawful basis (UK GDPR Article 6(1)) |
|---|---|---|
| Responding to your inquiry and preparing a quotation | Contact form data, email and telephone correspondence | (f) our legitimate interest in responding to business inquiries and preparing quotations for the organization you represent; where you contact us in your own name (for example as a sole trader), (b) steps taken at your request prior to entering into a contract |
| Delivering the website securely and preventing abuse | Server log data | (f) our legitimate interest in a secure, functioning website |
| Essential cookies (session, security and cookie-notice cookies set by this website itself) | Cookie data | (f) legitimate interest; the cookies are strictly necessary for the service you have requested, so no consent is required under the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), which exempt strictly necessary cookies from the consent requirement |
| Complying with legal obligations (accounting, tax and export-control record-keeping) | Correspondence and documents relating to orders | (c) compliance with a legal obligation |
Where we rely on legitimate interests, we have assessed that the processing is necessary for those interests and that your interests and fundamental rights do not override them. We do not use your data for automated decision-making or profiling, and we do not sell personal data.
5. Who receives your data
We share personal data only to the extent necessary:
- Hosting and email provider: Hosting.one, a brand of FastVPS Eesti OÜ (Estonia). The website and our email service (including the mailbox that receives contact form submissions) run on a virtual server located in the European Union; the provider operates the infrastructure on which the website, our email correspondence and the server logs are stored, and acts as our processor under a written data-processing agreement.
- Business partners: if your inquiry leads to an order, we may pass on the business contact details needed for fulfillment (name, company, delivery address, telephone number, email address) to the manufacturers, freight forwarders, customs brokers and carriers involved in that order. Some of them are located outside the United Kingdom — see section 7.
- Professional advisers: accountants, auditors, lawyers and insurers, where necessary.
- Authorities: HM Revenue & Customs, courts, regulators, and customs or law-enforcement authorities, where required by law or to protect our legal rights.
Service providers that process personal data on our behalf do so under written contracts that meet the requirements of Article 28 UK GDPR.
6. Cookies
Cookies are small text files stored by your browser. This website uses only essential cookies: cookies set by the website itself to keep the site and the contact form functioning (for example session and security cookies, and a cookie that remembers that you have closed the cookie notice). They are stored for the duration of your visit or for up to 12 months and are strictly necessary, so your consent is not required (exemption for strictly necessary cookies under PECR). We do not use analytics, advertising or other third-party cookies, and we do not embed content from third-party servers that could set cookies.
You can delete or block cookies at any time in your browser settings. Blocking essential cookies may stop parts of the website from working.
7. International data transfers
We are established in the United Kingdom. This website is hosted on servers located in the European Union by a hosting provider established in Estonia. Transfers of personal data from the United Kingdom to the European Economic Area are covered by the UK’s adequacy regulations for the EEA, so no additional safeguards are required. Our email correspondence, including contact form submissions, is stored on the same server in the European Union.
If your inquiry leads to an order, we may need to share business contact details with manufacturers, freight forwarders and customs brokers in the country of manufacture, transit or delivery, which may be outside the United Kingdom and the EEA (for example China or the United States). Where the destination country is not covered by UK adequacy regulations, we put in place appropriate safeguards — the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses — or, for occasional transfers, rely on the transfer being necessary for the performance of a contract concluded at your request or in your interest (UK GDPR Article 49(1)(b) and (c)). You can request information about the safeguards used by writing to info@kfylabs.com.
8. How long we keep your data
- Inquiries that do not lead to a contract: deleted 24 months after our last contact, unless you ask us to delete them sooner.
- Inquiries that lead to a contract: retained for the duration of the business relationship and then for six years after the end of the financial year in which the last transaction took place, in line with UK tax record-keeping requirements and the limitation period for contractual claims under the Limitation Act 1980.
- Server logs: 30 days, then deleted.
- Cookies: see section 6.
When a retention period expires, the data is deleted or anonymized.
9. Your rights
Under the UK GDPR you have the right to:
- Access the personal data we hold about you;
- Rectify inaccurate or incomplete data;
- Erase your data, subject to legal retention obligations;
- Restrict processing in certain circumstances;
- Object to processing based on legitimate interests;
- Data portability — receive the data you provided to us in a structured, commonly used, machine-readable format;
- Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom; telephone 0303 123 1113; https://ico.org.uk/make-a-complaint/. We would welcome the opportunity to address your concerns before you approach the ICO, but you may contact the ICO at any time.
To exercise your rights, write to info@kfylabs.com. We may ask you to verify your identity before acting on a request. We respond within one month; for complex or numerous requests this period may be extended by a further two months, in which case we will inform you within the first month.
10. Security
We use technical and organizational measures appropriate to the risk, including TLS encryption of the website (HTTPS), access controls, regular software updates and backups. No method of transmission over the internet is completely secure; if you prefer, you may send sensitive documents by other means agreed with us.
11. Children
This website is intended for business users and is not directed at children. We do not knowingly collect personal data from anyone under 18 years of age.
12. Links to other websites
This website may contain links to third-party websites. We are not responsible for their content or privacy practices. Please read their privacy policies.
13. Changes to this policy
We may update this policy from time to time. The current version is always available on this page with the date of the last update. Material changes will be highlighted on the website.
14. Contact
KFY LABS LLP
27 Old Gloucester Street
London WC1N 3AX
United Kingdom
Email: info@kfylabs.com