Privacy policy

Section 1Who we are

Lacuna Ltd is a company registered in England and Wales, company number 17507110, with its registered office at Elizabeth Suite, 3rd Floor, 207 Regent Street, London, W1B 3HH, United Kingdom. We provide managed IT services to businesses, principally in the United States.

For the personal data described in this policy, Lacuna Ltd is the controller — meaning we decide why and how it is used, and we are accountable for it.

We are registered with the UK Information Commissioner's Office under registration number ZC277648.

Privacy questions go to hello@wearelacuna.com. We have not appointed a statutory Data Protection Officer, because we are not required to — that obligation applies to public authorities, to organisations whose core activity is large-scale monitoring, and to large-scale processing of special category data, none of which describe us. Privacy enquiries are handled directly by the people running the business.

Section 2The short version

Section 3What this policy covers

This policy applies to personal data we handle as a controller:

• Visitors to wearelacuna.com
• People who enquire, book a consultation, call or email us
• Contacts at our clients, prospective clients and suppliers
• People who apply to work with us

It does not cover personal data we handle inside a client's IT systems while delivering managed services. There we act as a processor on that client's instructions, and the terms are set out in the data processing agreement that forms part of our managed service agreement. Section 17 explains the difference and why it matters.

Section 4Personal data we collect

4.1 Information you give us

You do not have to give us any of this. If you do not, we cannot reply to an enquiry or provide a service — but nothing on this site requires personal data simply to read it.

4.2 Information collected automatically

• Analytics data, only if you accept analytics cookies: pages viewed, approximate location derived from a truncated IP address, device and browser type, and how you arrived. Your IP address is anonymised before storage.
• Server logs, kept by our hosting provider for security and fault diagnosis: IP address, timestamp, the file requested and the response code.

If your browser sends a Global Privacy Control or Do Not Track signal, we treat that as a refusal of analytics cookies and do not show you the consent banner at all.

4.3 Sensitive data

We do not ask for special category data under UK GDPR, or sensitive data as defined by the Texas Data Privacy and Security Act. We do not sell sensitive personal data. We do not sell biometric personal data. We do not process biometric or genetic data at all.

If you volunteer something sensitive in a free-text field, we will use it only to answer you and will not retain it beyond that purpose.

Section 5Why we use it, and our lawful basis

UK GDPR requires us to have a lawful basis for each purpose. Here they are.

Where we rely on legitimate interests we have weighed our interest against your rights. You can ask us for that assessment and we will send it to you.

Section 6Cookies and similar technologies

We use as few as we can get away with.

Under UK law analytics cookies require your consent before they are set, not merely an opportunity to opt out afterwards. Nothing analytical loads on this site until you click Accept.

Change your cookie preferences

Section 7Who we share it with

We share personal data only with organisations that help us run the business, and only what they need. Each is bound by a contract that restricts what they may do with it.

We may also disclose personal data where the law requires it, to professional advisers under a duty of confidence, or to a buyer if the business is sold — in which case you would be told beforehand.

Section 8International transfers

This is more involved for us than for most, and worth being clear about.

We are a UK company. Most of our clients and site visitors are in the United States. Several of our suppliers are also American. So personal data routinely moves between the UK and the US in both directions.

For transfers out of the UK we rely on one of the following, depending on the supplier:

• The UK Extension to the EU–US Data Privacy Framework, where the supplier is certified under it
• The UK International Data Transfer Agreement, or the UK Addendum to the European Commission's standard contractual clauses
• UK adequacy regulations, where the destination country has been found adequate

In each case we also carry out a transfer risk assessment and apply additional safeguards — encryption in transit and at rest, and minimising what is sent in the first place. You can ask us which mechanism applies to a specific supplier and we will tell you.

Section 9How long we keep it

When a period ends we delete the data or anonymise it so it can no longer identify anyone. Backups are overwritten on their own cycle, so a deleted record may persist in a backup for a short period before being written over.

Section 10How we protect it

• Encryption in transit, and at rest where the system supports it
• Multi-factor authentication on every account that holds personal data
• Access on a least-privilege basis, reviewed periodically
• Supplier due diligence before anything is shared, and written data processing terms
• A documented breach procedure — we will notify the ICO within 72 hours where required, and tell you directly where there is a high risk to you

No system is perfectly secure, and anyone who tells you otherwise is selling something. What we can commit to is that we will tell you promptly and honestly if something goes wrong.

Section 11Your rights under UK law

Under UK GDPR you have the right to:

• Be informed — which is what this document is for
• Access a copy of the personal data we hold about you
• Rectification of anything inaccurate or incomplete
• Erasure — the so-called right to be forgotten, where no overriding reason to keep it applies
• Restrict processing while a dispute about accuracy or legitimate interests is resolved
• Data portability — receive data you gave us in a machine-readable format, or have it sent elsewhere
• Object to processing based on legitimate interests, and absolutely to direct marketing
• Withdraw consent at any time, where consent is the basis — which does not affect what was done before you withdrew it

Email hello@wearelacuna.com. We respond within one month, extendable by two further months for complex requests, in which case we will tell you inside the first month and explain why. There is no charge unless a request is manifestly unfounded or excessive.

We may ask you to verify your identity before we act. That is a protection for you, not an obstacle for us — sending someone's personal data to the wrong person is itself a breach.

Section 12Your rights under Texas law

If you are a Texas resident acting in an individual or household capacity, the Texas Data Privacy and Security Act gives you the right to:

• Confirm whether we process your personal data, and access it
• Correct inaccuracies, taking into account the nature of the data and our purpose
• Delete personal data you provided or that we obtained about you
• Obtain a copy in a portable, readily usable format, where processing is automated
• Opt out of targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects

How to exercise these rights. Email hello@wearelacuna.com with the subject line Texas privacy request. We respond within 45 days, extendable once by a further 45 days where reasonably necessary, in which case we will tell you inside the first period.

Authorised agents. You may use an agent to make a request on your behalf. We will ask for proof that you authorised them.

12.1 If we refuse — your right to appeal

If we decline to act on your request we will tell you why, within the response period. You may then appeal by emailing hello@wearelacuna.com with the subject line Texas privacy appeal.

We will respond in writing within 60 days, explaining the reasons for our decision. If the appeal is denied, we will provide you with a method to contact the Texas Attorney General to submit a complaint, as the Act requires.

Section 13Other US state privacy laws

Several other states have comprehensive privacy laws with rights broadly similar to those in section 12 — including California, Virginia, Colorado, Connecticut, Utah, Oregon and Montana, among others.

Where one of those laws applies to you, we will honour the equivalent rights on the same terms. Use the same contact route and tell us which state you are in.

Section 14Marketing

We may send occasional emails about our services to business contacts. Under UK PECR we may do this to corporate subscribers on the basis of legitimate interests, but:

• Every message carries a one-click unsubscribe
• We act on an unsubscribe immediately, and certainly within 48 hours
• We do not pass your details to anyone else for their marketing. Ever
• We do not buy contact lists

Unsubscribing from marketing does not stop service messages — invoices, incident notifications, scheduled maintenance and the like — because those are part of the service you are paying for.

Section 15Automated decisions

We do not make decisions producing legal or similarly significant effects about you by automated means.

One point of honesty: our enquiry form applies a simple rule that flags enquiries below ten users in non-regulated sectors, and shows a message saying we are probably not the right fit. That is a suggestion on a web page, not a decision about you — a person reads every enquiry, and you can reply and say why your situation is different.

Section 16Children

Our services are sold to businesses and this site is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, email hello@wearelacuna.com and we will delete it.

Section 17When you are our client

Delivering managed IT means our engineers can reach systems that hold your personal data — email, files, databases, line-of-business applications. This matters, so here is the position plainly.

• For that data, you are the controller and we are your processor. We act only on your documented instructions
• The terms are in the data processing agreement forming part of your managed service agreement, which covers confidentiality, security, sub-processors, breach notification, audit rights and what happens to data when the agreement ends
• We do not use your data for our own purposes. Not for analytics, not for product development, not to train anything
• Access is least-privilege and logged

If one of your staff or customers asks us to exercise their rights over data in your systems, we will refer them to you and tell you it happened — because it is your decision to make, not ours.

Section 18Changes to this policy

We update this policy when what we do changes, or when the law does. The version number and dates at the top of the page tell you where you stand.

For material changes — a new purpose, a new category of recipient, a change of lawful basis — we will give reasonable notice before the change takes effect, by email where we hold your address. We will not change this policy retrospectively.

Section 19How to complain

Come to us first if you can — hello@wearelacuna.com. Most things are a misunderstanding we can fix quickly. But you are entitled to go straight to a regulator, and nothing here requires you to contact us first.

Section 20Contact us