Privacy policy

1. Who we are

UX Lab is a usability testing lab at The Sharp Project in Manchester. It is owned and run by El Capitan Digital Ltd (“elcap”, “we”, “us”), a company registered in England and Wales under company number 10977108, with its registered office at [registered office address].

El Capitan Digital Ltd is the controller of the personal information described in this policy. This means we decide how and why it is used. We are registered with the Information Commissioner’s Office (ICO) under registration number [ICO registration number].

If you have any questions about this policy or how we use your information, email [privacy@uxlab.co.uk] or write to us at Gold 158, The Sharp Project, Thorp Road, Manchester M40 5BJ.

2. Who this policy covers

Website visitors: anyone who browses uxlab.co.uk, sends an enquiry or books a call.
Clients: people at the organisations we work for, whether they hire the lab or ask us to run a full study.
Research participants: people who take part in, or are screened for, a usability testing session.
Observers and visitors: anyone who comes to the lab to watch sessions, or watches a live stream.

If you take part in a study, you will also get a participant information sheet and consent form for that study. These explain anything specific to it.

3. The information we collect

Website visitors

What you tell us in our enquiry form: your name, work email address, company, what you want to test and your timings.
What you tell us when you book a call: your name, email address and the time you choose.
How you use our website, such as the pages you visit, your device and browser, and your approximate location. We only collect this through cookies if you agree. See our Cookie policy.

Clients

Names, job titles and contact details of the people we work with.
Billing details and records of what you have bought from us.
Emails, call notes and other correspondence about your project.

Research participants

Your name, contact details and availability.
Your answers to screening questions. These may include your age range, job, location, the devices you use and how you use certain products or services.
Recordings of your session, which may include video of your face, your voice and what happens on screen.
Eye-tracking data, which shows where you looked on a screen and for how long.
Notes made by the moderator and observers, and your answers to any questionnaires.
Records of your consent.
The details needed to pay your incentive. This is usually handled by our recruitment partner.

Observers and visitors

Your name and the organisation you are with.
Any access or dietary needs you tell us about.
[Your vehicle registration, if you need a parking space.]

Health and disability information

Some studies need to understand how people with a disability or health condition use a product, for example testing with screen reader users. Information about your health is “special category” data under UK GDPR. We only collect it when a study needs it, we only collect what is necessary, and we ask for your explicit consent first.

4. How we use it, and our lawful basis

We only use your information when the law allows us to. For each use, this is the lawful basis we rely on:

Replying to your enquiry and arranging a scoping call: our legitimate interests in responding to people who contact us, or taking steps you have asked for before a contract.
Delivering the services you have booked, invoicing you and managing our relationship: performance of a contract.
Recruiting, screening and scheduling participants: our legitimate interests in running the research we have been asked to do.
Recording sessions and collecting eye-tracking data: your consent, which we ask for before the session starts.
Collecting health or disability information for a study: your explicit consent.
Sending you news and offers by email: your consent or, for existing clients, our legitimate interests in telling you about similar services. You can unsubscribe at any time.
Understanding how our website is used so we can improve it: your consent, given through our cookie banner.
Keeping financial records and meeting our other legal duties: legal obligation.
Keeping the lab safe and secure, including signing visitors in: our legitimate interests.

Where we rely on legitimate interests, we have weighed our interests against yours. You can ask us for more detail about this.

5. Session recordings and eye tracking

Recording sessions is central to usability testing. It lets the people building a product see where users struggle. This is how we handle recordings and eye-tracking data:

We tell you what will be recorded before the session and ask for your consent. You can ask us to stop recording, or end the session, at any time without giving a reason.
The client’s team may watch live from our viewing room or through a secure live stream.
We share recordings, clips and eye-tracking outputs (such as heatmaps) with the client who asked for the study, so they can understand the findings. Clients agree to use them only for internal research and to keep them secure.
We never publish recordings in which you can be identified without your separate, specific permission.
Eye-tracking data records where your eyes looked on screen. We use it to understand attention and usability, not to identify you.
Our reports use first names or participant numbers, never full names.

If a client hires the lab and runs their own sessions, they decide how the recordings are used and they are the controller of that information. We act as their processor for any recordings we store for them.

We do not sell your personal information. We only share it when we need to, with:

Clients who ask us to run research, as described in section 5.
Our participant recruitment partner, [partner name], who finds and screens participants and pays incentives.
Service providers who help us run our business, including HubSpot (customer records, forms and meeting booking), [Google Workspace] (email and file storage), [Google Analytics] (website analytics), [eye-tracking software provider], [live streaming tool] and [accounting software].
Professional advisers, such as our accountants, lawyers and insurers.
The police, regulators or other authorities, if the law requires it.

Our service providers act only on our instructions and must keep your information secure.

7. Transfers outside the UK

Some of our service providers store or process information outside the UK, for example in the European Economic Area or the United States. When this happens we make sure your information is protected. For example, we use providers in countries the UK Government has approved, or rely on the International Data Transfer Agreement or Addendum approved by the ICO.

8. How long we keep it

Enquiries that don’t lead to work: [24 months] after we were last in touch.
Client records and invoices: 6 years after the end of the financial year they relate to, to meet tax rules.
Screening answers from people who were not selected: [3 months] after the study ends.
Session recordings and eye-tracking data: [12 months] after the study ends, unless the client’s contract needs a shorter period.
Consent records: as long as we keep the information the consent relates to, plus [2 years].
Marketing preferences: until you unsubscribe. After that, we keep a note so we don’t contact you again.
Website analytics: see our Cookie policy.

At the end of each period, we delete the information or anonymise it so it can no longer be linked to you.

9. Keeping it safe

We protect your information with appropriate technical and organisational measures. These include access controls, [encrypted storage and transfer], strong passwords with multi-factor authentication, and only giving access to people who need it. Recordings are stored [on encrypted drives / in secure cloud storage] and are never kept on personal devices.

10. Your rights

Under UK data protection law, you have the right to:

ask for a copy of the information we hold about you
ask us to correct information that is wrong or incomplete
ask us to delete your information
ask us to limit how we use your information
object to us using your information, including for direct marketing
ask us to move your information to another organisation
withdraw your consent at any time, where we rely on it

If you took part in a study and want to withdraw, contact us as soon as you can. We can delete your recordings and data up to [30 days] after your session. After that, findings may already have been shared in an anonymised form that can’t be linked back to you.

To use any of these rights, email [privacy@uxlab.co.uk]. We will reply within one month, and there is usually no charge.

11. Cookies

Our website uses cookies. Some are essential to make the site work. Others, such as analytics and HubSpot tracking cookies, are only used if you agree. You can change your choice at any time using the cookie settings link in the footer. Full details are in our Cookie policy.

12. Children

Our services are for businesses and our website is not aimed at children. We do not usually include people under 18 in research. If a study needs participants under 18, we only involve them with the consent of a parent or guardian, and give them information written for their age.

13. Complaints

If you are unhappy with how we have used your information, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

14. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top. If we make significant changes, we will tell the clients and participants affected.