Privacy Policy
This policy explains what personal data Deepside Labs collects, why, how it is kept safe, and the rights you have under UK data protection law (UK GDPR and the Data Protection Act 2018).
Who I am
Deepside Labs is the trading name of Meral Ince, a sole trader based in London. I help travel and adventure businesses use AI and automation. I am the data controller for the personal data in this policy, except where I process data on a client’s behalf (see “Client data I process for clients”).
Email: meral@deepsidelabs.com
ICO registration number: ZC264028
What I collect
I collect only what I need to talk to you, deliver work and run the business.
Website visitors: details you send through a contact form, and standard technical logs kept by my web host, such as IP address.
Prospects: name, job title, company, work email, phone number and notes from our conversations. This comes from you, your company website, LinkedIn or referrals.
Clients and their staff: contact and billing details, meeting notes and recordings, and information about how your business runs, gathered in audits and interviews.
Clients’ customers: messages and enquiry details captured by tools I build or run for a client, such as a website chatbot.
I don’t aim to collect special category data (such as health information). If it turns up in client material, I handle it only as the client instructs.
How I use it
Every use has a lawful basis under UK GDPR:
Replying to enquiries and discussing possible work: steps before a contract, and legitimate interests.
Delivering audits, builds and ongoing support: contract.
Invoicing, accounts and tax records: legal obligation.
Occasional relevant emails to business contacts: legitimate interests. You can opt out at any time.
I never sell personal data. I don’t make decisions about you by automated means that have legal or similarly significant effects.
Client data I process for clients
When I build or run a tool for a client, or review their data during an audit, the client is the data controller and I am their processor. In that role I:
process their data only on the client’s documented instructions, as set out in our agreement
keep it confidential and use it for no other purpose
use only trusted sub-processors (a current list is available on request), and tell the client before adding a new one
help the client respond to data subject requests and any data breach
delete or return the data when the work ends, as the client chooses
AI tools. Some work uses AI services. I use business or API accounts whose terms say client inputs are not used to train the provider’s models. I keep personal data out of AI prompts unless the task needs it.
Who I share it with
I share personal data only with the services I need to run the business:
business software for email, documents, notes and project management (for example Google Workspace and Notion)
accounting software for invoicing and bookkeeping (for example Xero)
website hosting (Hostinger)
AI and automation platforms for analysis and client builds (for example Anthropic’s Claude and Voiceflow)
A current list of named providers is available on request. I may also share data with my accountant, HMRC or other authorities where the law requires it.
International transfers. Some of these providers store data outside the UK, mainly in the US. Where they do, the transfer is protected by the UK-US Data Bridge, the UK International Data Transfer Agreement, or equivalent safeguards in the provider’s terms.
Security and retention
I’m the only person with access to the data I hold. Every account uses a strong, unique password and two-factor authentication, devices are encrypted, and data is kept with reputable providers. If a breach puts people at risk, I’ll tell the ICO within 72 hours where required, and tell affected clients without undue delay.
I keep personal data only for as long as I need it:
Enquiries that don’t lead to work: 2 years from last contact.
Client contact details and project records: the length of the engagement plus 2 years.
Client data processed for a client: deleted or returned within 30 days of the work ending.
Invoices and accounting records: 6 years, as required for tax.
Your rights
You can ask me to:
give you a copy of the personal data I hold about you
correct anything that’s wrong or incomplete
delete your data
restrict or stop using your data, including for marketing
send your data to you or another organisation in a portable format
withdraw consent you’ve given, at any time
Email meral@deepsidelabs.com to make a request. It’s free, and I’ll reply within one month. If your data came to me through one of my clients, I’ll pass your request to them and help them respond.
If you’re unhappy with how I’ve handled your data, please tell me first. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Cookies
My website may use cookies, including some set by my web host, to help it work. You can block or delete cookies in your browser settings.
Changes to this policy
I’ll update this policy when the way I handle data changes.
