Data Protection Policy (UK GDPR and Data Protection Act 2018)

1. Purpose

This policy explains how Unolabs Limited protects personal data. It sets out who is responsible, what we commit to, and how you can use your rights. It also tells you how to complain, to us or to the Information Commissioner's Office (ICO).

2. Scope

Who this covers. This policy applies to Unolabs Limited, the controller for the personal data described here.

Group company. Unolabs Technologies Private Limited, our group company in India, may support our work. Where it handles personal data for us, it acts as our processor, on our instructions.

Whose data. This policy covers personal data about:

• visitors to unolabs.com;
• people who contact us or ask about our services;
• contacts at our clients, partners and suppliers;
• job applicants and candidates;
• our own staff and contractors.

What is excluded. Where a client asks us to process personal data on its behalf, the client is normally the controller. In that case the client's instructions and our contract with the client apply first.

Where Unolabs Technologies Private Limited decides how and why it uses personal data in India, its Privacy Policy for India applies.

3. Legal framework

We follow:

• the UK General Data Protection Regulation (UK GDPR);
• the Data Protection Act 2018;
• the Data (Use and Access) Act 2025, which amends both of the above;
• the Privacy and Electronic Communications Regulations 2003 (PECR), for cookies and electronic marketing.

4. Roles and responsibilities

• Director: approves this policy and any change to it.
• Data protection lead: owns this policy and keeps it up to date. Handles rights requests, complaints and breach reports. We have not appointed a statutory Data Protection Officer.
• Everyone who works for us: handles personal data only as their role needs, and reports any concern straight away.
• Processors: act only on our written instructions. We will make sure our service providers' contracts include the terms UK GDPR requires, by 31 March 2027.

5. Our commitments

Lawful basis. We process personal data only when we have a lawful basis. For most business contact, that basis is our legitimate interests, a contract, or a legal obligation. Where we rely on consent, we ask for it clearly, and you can withdraw it at any time.

Transparency. We tell people how we use their data when we collect it, or as soon as we reasonably can.

Data minimisation. We collect only what we need for a stated purpose.

Cookies. Our website asks for your choice before it sets optional cookies. Optional cookies, such as Google Analytics, stay off until you allow them. You can change your choice at any time from the cookie settings on our website.

Retention. We keep personal data only as long as we need it for its purpose, or as long as the law or a contract requires. Then we delete it or make it anonymous. We will publish our retention periods by data type by 31 March 2027.

Security. We use technical and organisational measures that suit the risk. No system is completely secure, so we also plan for incidents (see section 7).

Processors and service providers. We use service providers, for example for email and office software. Each one may use personal data only to provide its service to us.

International transfers. Some personal data may be accessed from outside the UK, including by our group company in India. Where UK GDPR requires a safeguard for a transfer, we will put one in place before that transfer takes place.

Records. We will complete a record of our processing activities, as UK GDPR Article 30 requires, by 31 January 2027.

6. Your rights and how to use them

You have the right to:

• be told how we use your data;
• get a copy of your data;
• have inaccurate data corrected;
• have your data deleted, in some cases;
• restrict how we use your data, in some cases;
• object to our use of your data, including for direct marketing;
• receive your data in a portable format, in some cases;
• not be subject to some decisions made only by automated means.

How to ask. Email info@unolabs.com with the subject line "Data protection request". We may ask you to confirm your identity.

Response time. We reply within one month of receiving your request. For complex or repeated requests, we may extend this by up to two more months. If we do, we tell you why within the first month. There is no fee in most cases.

Complaints to us. If you are unhappy with how we use your data, please complain to us first. Use the same address, with the subject line "Data protection complaint". We will acknowledge your complaint within 30 days. We will look into it and tell you the outcome without undue delay. This follows the complaints duty added by the Data (Use and Access) Act 2025.

Complaints to the ICO. You can also complain to the Information Commissioner's Office at any time. Visit ico.org.uk/make-a-complaint (opens ico.org.uk) or call the ICO helpline on 0303 123 1113.

7. Personal data breaches

Anyone who works for us must report a suspected breach to the data protection lead straight away.

We assess every breach. We report a breach to the ICO within 72 hours of becoming aware of it, unless it is unlikely to put people at risk. If the risk to people is high, we also tell the people affected without undue delay. We record every breach, including those we do not need to report. Where a client is the controller, we tell the client as our contract requires.

To report a concern about our handling of personal data, email info@unolabs.com with the subject line "Data protection concern".

8. Training and awareness

We will give data protection training to everyone who handles personal data for us by 31 March 2027. We will refresh it each year.

9. Monitoring, review and change log

The data protection lead checks that this policy is followed. We review it every 12 months, and sooner if the law or our processing changes.

10. Contact