Privacy Policy

PrimeoLab is the software & AI engineering division of ECOM Global Investment Ltd, a company registered in England & Wales under Company Registration Number (CRN) 16154637, with its registered office at Bridgewater Court, Lancashire, United Kingdom. Our operations centre is in the Republic of Mauritius (Ground Floor, 1 Cybercity Tower C, Ebene 72201, Business Registration Number (BRN) C16135458).

For personal data we handle about enquiries, clients and visitors to www.primeolab.com and the PrimeoLab client portal, we are the data controller under the UK GDPR, the EU GDPR and the Mauritius Data Protection Act 2017. When we process data inside systems we build and host for a client, we act as a processor under a separate data processing agreement, and the client is the controller.

We only collect what we need to scope, deliver and support work:

• Enquiry & quote data — your name, company, work email, phone, a description of your project, and your indicative budget, so we can prepare a fixed quote.
• Client account data — portal logins, team member names and roles, billing details, invoices and records of the engagement.
• Usage data — pages viewed, country-level location and device/browser information, gathered only through analytics cookies you have consented to.
• Support data — tickets, emails and call notes raised while we help you.

We do not collect special-category data (such as health, ethnicity or political views), we do not run advertising profiles on you, and we do not buy marketing lists.

We use your data to:

• respond to your enquiry and return a fixed quote, typically within 48 hours;
• deliver, host, support and improve the services you have contracted;
• raise invoices, take payment and meet our statutory accounting duties;
• send the monthly PrimeoLab letter, but only if you have subscribed — every email carries a one-click unsubscribe;
• keep our site and your account secure, including logs that help us prevent fraud and abuse.

We rely on the following legal bases:

• Contract — Art. 6(1)(b): to provide a quote and deliver the services you ask for.
• Legitimate interests — Art. 6(1)(f): to run, secure and improve our business, where your rights do not override those interests.
• Consent — Art. 6(1)(a): for analytics and marketing cookies and for the newsletter. You can withdraw consent at any time.
• Legal obligation — Art. 6(1)(c): to keep tax and accounting records the law requires us to hold.

We never sell your personal data. We share it only with vetted processors who work under written agreements and may only use it on our instructions. These include Amazon Web Services and Microsoft Azure (hosting, in the region of your choice), Stripe (payments), plus email, error-monitoring and accounting providers.

A current list of our processors is available on request from [email protected].

Our teams sit in the United Kingdom and Mauritius, so some data is transferred between the two. Where data leaves the UK or EEA, we rely on the UK International Data Transfer Agreement and the EU Standard Contractual Clauses, backed by encryption in transit and at rest and least-privilege access.

Processing in Mauritius is also governed by the Mauritius Data Protection Act 2017, which the European Commission and the UK recognise as providing an adequate level of protection.

We keep data only as long as we have a reason to:

• Enquiry data — 24 months from your last contact, then deleted.
• Engagement records — 7 years, to meet statutory accounting and tax requirements.
• Analytics data — 14 months, in aggregated and IP-anonymised form.
• Backups — roll off within 35 days.

When a retention period ends we delete the data or irreversibly anonymise it.

You can ask us to give you access to your data, correct it, erase it, restrict or object to its use, or provide it in a portable format. Where we rely on consent, you can withdraw it at any time without affecting earlier processing.

We respond within one month and we do not charge for handling a genuine request. To exercise any right, email [email protected].

Essential cookies are always on, because the site cannot function without them. Analytics and marketing cookies stay off until you opt in. You can change your choice at any time through Cookie settings in the footer.

Full details of every cookie we set are in our Cookie Policy.

Our Data Protection Lead can be reached at [email protected] or by post to ECOM Global Investment Ltd, Bridgewater Court, Lancashire, United Kingdom.

If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office at ico.org.uk or to the Mauritius Data Protection Office. We would, of course, prefer the chance to put things right first.