Privacy Policy

Who we are

This privacy policy explains how LaingLogic, the trading name of Ellis Laing, of Office 1, Technology House, 9 Newton Place, Glasgow, G3 7PR ("we", "us") collects and uses personal data when you visit https://lainglogic.com, contact us, use our client portal at login.lainglogic.com and portal.lainglogic.com, or work with us. We are the data controller for that personal data. We are registered with the Information Commission (the ICO), registration number ZC263460.

Email: enquire@lainglogic.com · Phone: +44 7538 900825

The personal data we collect

We collect:

• Contact form: your name, email address, any phone number, business name or website you add, and the message you send.
• Bookings and payments: your name, email address, phone number, any business name, website or social media accounts you add, any notes you add and records of what you booked or paid for. Payment card details go directly to our payment provider (Stripe); we never see or store your full card number.
• Clients: the portal account, project records and documents described under Client portal and client records.
• Technical data: the IP address, browser type and pages visited that our hosting provider records in routine server logs.
• Cookies: see our cookie policy for exactly what is set and when.

How and why we use personal data

UK data-protection law requires a lawful basis for every use:

Client portal and client records

If you are a client, we also hold:

• Your portal account: your email address and display name, the passkeys you register (we keep only their public keys), a passcode if you set one (stored only as a hash), a notification token if you turn on push notifications, and records of when you sign in.
• Sign-in codes: each code we email you is stored as a hash, with a hash of the IP address it was requested from so we can limit misuse. Codes expire after 10 minutes and a nightly job clears them.
• Your project: the content, files and messages you send through the portal or by email, and the proposals, invoices and signed documents we exchange.
• An activity log of sign-ins and changes in the portal, kept to keep the portal secure.

We use these to provide our services under our contract with you. The sign-in and activity records are also kept for our legitimate interest in keeping the portal secure.

Visitors to websites we host

If you use a website we host for one of our clients, that business is the controller of the personal data its site collects, such as messages sent through its forms and its bookings, and its own privacy policy applies. We process that data for the business, on its instructions, under our Hosting Terms. To ask about it, or to exercise your rights, contact the business named on the site. If you contact us instead, we will pass your request to it.

Analytics

We use Google Analytics 4 to understand how the site is used. It runs only after you consent through the cookie banner, and you can withdraw that consent at any time. See our cookie policy.

Form security

Our forms use Turnstile, from Cloudflare, Inc., to check that a form is sent by a person. When you use a form, it reads your IP address and signals from your browser and device. We use it to stop automated abuse of our forms. That is part of keeping the site secure, so its lawful basis is our legitimate interest in running the business safely.

Turnstile relies on the security exemption in the Privacy and Electronic Communications Regulations (PECR Schedule A1 paragraph 4(2)), so it needs no cookie consent.

Cloudflare acts for us when it secures the form. It also acts for itself, as a controller, when it uses what it reads to improve its bot detection; its Turnstile privacy notice, at www.cloudflare.com/turnstile-privacy-policy, covers that use.

When you send a form, we also check the request itself for signs that it was not sent by the person whose email address it carries, such as the network it came from, whether the browser's own headers are present, how recently the form check was passed, and whether the message carries links or markup. We are trialling this check: for now it only records which rules applied and changes nothing about how we answer you. Once it is switched on, it will decide only whether we email an automatic confirmation to the address you gave; your message will always reach us. The record of which rules applied is kept for 90 days. It holds no raw identifiers: no IP address, no email address and none of your message. It is linked to the copy of your enquiry we keep, so we treat it as personal data and delete it after those 90 days. If a confirmation to an address bounces or is reported as spam, we keep a scrambled form of that address (a hash) for 90 days. We do this on our legitimate interest in keeping our forms and our email sending secure, which UK GDPR Article 6(11)(c) names as a legitimate interest. It is not a decision with a legal or similarly significant effect on you, and if we ever hold back a confirmation you can still reach us by replying to the address on the page.

Who we share personal data with

We use carefully chosen service providers who process personal data on our instructions under contract:

We may also share personal data with our professional advisers and our insurers, and with authorities where the law requires it. We do not sell your personal data.

AI tools

We use AI tools, currently Claude from Anthropic, to help design, write and build websites, to prepare our documents and to look after our systems. While we do, the tool may see the content clients send us for their sites, such as text, images and business details, and client contact details that appear in proposals, invoices and project records. We never put the personal data of our clients' customers into it.

Anthropic Ireland, Limited handles what it receives as a separate controller under its own terms and its privacy policy (www.anthropic.com/legal/privacy), which explains how long it keeps that data and how it uses it. We review everything the tool produces before it is used.

Transfers outside the UK

Some of our providers process data outside the UK. Transfers to the European Union are covered by the UK's adequacy regulations. Transfers to Cloudflare, Resend, Stripe, Google and GitHub in the United States rely on the UK Extension to the EU-US Data Privacy Framework, under which each is certified. Anthropic receives data in Ireland, which the UK's adequacy regulations cover, and its privacy policy explains its own onward transfers. Where none of these applies, we use the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. Our backup drive stays in the United Kingdom. The weekly database copies are also kept on our encrypted laptop, which may travel with us abroad; it is never handed to anyone else.

How long we keep personal data

We keep personal data only as long as we need it:

• Messages sent through our contact form, and bookings for a call: deleted 12 months after they were sent or the call took place. Any email exchange that follows is kept for 12 months after our last message, then deleted.
• Client portal: sign-in codes expire after 10 minutes; files uploaded through the portal are deleted after 14 days unless we keep them for your project; content and messages sent through the portal are deleted 12 months after they were sent, unless their files are kept for your project; a signed-in session lasts up to 30 days, and 90 at most; security and account events in the activity log, such as sign-ins and changes to accounts and sites, are kept for 12 months, and its record of each form sent for 90 days.
• Client accounts: kept until you close your account, or for 12 months after our work together ends, whichever comes first.
• Proposals, invoices, signed documents and other records we must keep for tax and accounting: six years.
• Google Analytics data: no longer than 14 months.
• Database backups: Cloudflare, which hosts the platform's database, keeps a copy it can restore from for 30 days; we keep each weekly copy for eight weeks, and our computer's own encrypted backup may hold older copies until it overwrites them, kept only to recover from a disaster.
• The record of the form check: 90 days.
• Everything else: only as long as needed for the purpose we collected it for, then deleted or anonymised.

How we protect personal data

We protect personal data with encrypted connections, encryption of stored data, hashed passcodes and sign-in records, passkeys, two-step sign-in on our own accounts and encrypted backups. Only Ellis Laing has access to it.

Your rights

Under UK data-protection law you have the right to:

• access the personal data we hold about you
• have inaccurate data corrected
• have your data erased in many circumstances
• restrict or object to how we use it (including objecting to direct marketing, which we always honour)
• receive the data you gave us in a portable format
• withdraw any consent you have given, at any time
• complain to us, and to the Information Commission

To exercise any of these, email enquire@lainglogic.com. We will respond within one month and will not charge a fee unless the law allows one. We may need to confirm your identity first.

If you are unhappy with how we handle your personal data, please complain to us first at enquire@lainglogic.com or through our contact form. We will acknowledge your complaint within 30 days, deal with it without undue delay and tell you the outcome, as UK law requires. You also have the right to complain to the Information Commission (the ICO) at ico.org.uk, helpline 0303 123 1113.

Automated decision-making

We do not make any decision about you based solely on automated processing that would have a legal or similarly significant effect on you.

Changes to this policy

We may update this policy from time to time; the date at the top shows when it last changed. Significant changes will be highlighted on the site.