Your data, kept to what we need.

1. Who we are

Headroom Labs Ltd (“we”, “us”) is the company behind the Headroom website and product. For the purposes of data-protection law, we are the controller of the personal data described in this policy, unless we say otherwise.

Privacy questions can be sent to us using the contact details on our Contact page.

2. The data we collect

We collect the information you give us and the information generated when you use this site.

Information you give us. Your name, work email address, company, role and message when you book a demo or contact sales.

Information from your use of the site. Pages visited, referring page, approximate location derived from your IP address, device type, browser and language, collected through cookies and similar technologies described in our Cookie Policy.

Information from our customers’ workspaces. When a customer uses the Headroom product, we process bank balances, transactions and ERP data on that customer’s behalf. For that data we act as a processor, under the customer’s contract and data-processing agreement, and this policy does not apply to it.

3. How we use it, and on what basis

To reply to your demo or sales request, we use your name, email, company and message, because you asked us to take these steps before a contract.

To measure and improve this website, we use usage and device data: with your consent for analytics cookies, and on our legitimate interest for strictly necessary data.

To keep the site secure and prevent abuse, we use IP addresses and request logs, on our legitimate interest in the security of our services. To meet legal and accounting duties, we keep contract and invoice data because the law requires it.

4. Who we share it with, and where

We share personal data only with providers that help us run the website and the business, under written contracts: hosting and content delivery, form handling, email delivery, analytics (if you accept analytics cookies), customer-relationship management and professional advisers. We do not sell personal data. We may disclose data if the law requires it or to protect our rights, and in a merger or sale of the business, under the same protections as set out here.

Some of our providers are located outside the United Kingdom and the European Economic Area. Where that is the case, we rely on an adequacy decision or on standard contractual clauses approved by the relevant authority, together with additional safeguards where needed. You can ask us for a copy of the safeguards in place using the contact details on our Contact page.

5. How long we keep it

Demo and sales enquiries are kept for up to 24 months after our last exchange, then deleted. Website analytics are kept for up to 14 months.

Contract and invoice records are kept for the period the law requires, usually six years. When we no longer need data, we delete it or make it anonymous.

6. Your rights

You have the right to access the personal data we hold about you, to correct it, to have it deleted, to restrict or object to its processing, to receive a copy in a portable format, and to withdraw consent where we rely on it.

To use any of these rights, write to us using the contact details on our Contact page; we will reply within one month. You may also complain to your local data-protection authority; in the United Kingdom, that is the Information Commissioner’s Office.

7. Security

We protect personal data with encryption in transit, access limited to the staff who need it, and regular review of our providers.

No system is entirely free of risk. If a breach affects your data in a way that creates a risk for you, we will tell you and the relevant authority within the time the law sets.

8. Changes to this policy

We may update this policy as our services or the law change. The “Last updated” date at the top shows the latest version.

If a change is significant, we will say so on this page or by email before it takes effect.