Privacy Policy

This privacy policy explains what personal data Applied Consumer Neuroscience Labs Ltd collects through this website and when you work with us, why we collect it, how long we keep it, who we share it with, and the rights you have under UK data protection law.

Last updated: 30 September 2026.

1. Who we are

Applied Consumer Neuroscience Labs Ltd ("ACN Labs", "we", "us") is the controller of the personal data described in this policy. We are a private limited company registered in England and Wales, company number 10050864. Our registered office is 2 Old Bath Road, Newbury, Berkshire, RG14 1QL.

For any question about this policy or your personal data, email us at info@acnlabs.co.uk.

2. The personal data we collect

We only collect personal data that you give us, or that is needed to run and protect this website.

Enquiries. When you use the contact form we collect your name, your email address and your message. If you email us directly, we collect your email address and anything you include in your email.
Our free guide and email updates. When you enter your email address to download our guide, we send you an email asking you to confirm your subscription. We only store your email address once you click the confirmation link.
Clients. If you or your organisation work with us, we keep business contact details and the information needed to deliver our consulting services, as agreed in our contract with you.
Spam protection. When you submit a form, our security provider checks that the submission comes from a person rather than an automated program. This uses technical information such as your IP address and browser characteristics.
Website usage. We measure how many people visit our pages using Plausible Analytics and Google Analytics 4. Plausible does not use cookies and does not collect or store personal data. Google Analytics uses cookies and similar technologies and collects technical information such as your IP address, browser, device type and the pages you view. Google processes that information on our behalf.
Server logs. Like any website, our hosting provider briefly records technical details of each request, such as IP address, browser type and the page requested, to deliver the site securely.

This website does not collect special category data, such as health information. If you take part in one of our research studies, you will be given a separate participant information sheet and consent form that explain how your study data is handled.

3. How we use your data and our lawful basis

UK data protection law requires a lawful basis for each use of personal data. Ours are:

Replying to your enquiry: our legitimate interest in responding to people who contact us, or taking steps at your request before entering into a contract.
Sending you our guide and email updates: your consent, which you give by confirming your subscription. You can withdraw it at any time.
Delivering consulting services to clients: performance of our contract with you or your organisation.
Keeping business and financial records: our legal obligations, for example under tax and company law.
Protecting our forms from spam and abuse, and keeping the website secure: our legitimate interest in running a safe and reliable website.
Understanding which pages are useful: our legitimate interest in improving our website. Plausible counts visits in aggregate. Google Analytics 4 uses cookies and technical identifiers so we can see how people move through the site.

We do not sell your personal data, and we do not use it for automated decision-making or profiling.

4. How long we keep your data

Enquiries: up to 2 years after our last contact with you, unless the enquiry leads to work together.
Email updates: until you unsubscribe or ask us to remove you. If you don't confirm a subscription, we don't store your email address.
Client records: for the length of our relationship and then 6 years, to meet accounting and legal requirements.
Server logs and spam-protection checks: kept by our providers for short periods, typically days, for security purposes.

When data is no longer needed, we delete it or anonymise it.

5. Who we share your data with

We share personal data only with service providers that help us run this website and our business. They act on our instructions under contracts that require them to protect your data:

Vercel, which hosts this website.
Supabase, which stores form submissions on servers in London, UK.
Resend, which delivers the emails sent by our website forms.
Zoho, which provides our email inbox.
Cloudflare, which provides spam protection (Turnstile) on our forms.
Plausible Analytics, which provides cookie-free visitor statistics hosted in the EU.
Google Analytics 4 (Google Ireland Limited / Google LLC), which provides visitor statistics. Google may process that data in the United States.

We may also disclose personal data if the law requires it, or to establish, exercise or defend legal claims.

6. International transfers

Some of our providers are based in, or use servers in, countries outside the UK, including the United States. Where personal data is transferred outside the UK, we make sure it is protected by safeguards recognised under UK law, such as the UK–US Data Bridge or the International Data Transfer Agreement and Addendum issued by the Information Commissioner's Office (ICO).

7. Cookies and similar technologies

We do not use cookies for advertising.

Analytics: Plausible does not use cookies or similar tracking technologies. Google Analytics 4 does set cookies to distinguish visitors. We ask before we load Google Analytics. Choose Accept or Reject on the banner at the bottom of the page. You can change that choice at any time from the Cookies link in the footer.
Necessary: the site stores your Accept or Reject choice in your browser so we do not ask on every page. That record is not used for advertising.
Spam protection: Cloudflare Turnstile may use technologies strictly necessary to tell people and automated programs apart when you submit a form. These do not require consent.
Embedded videos: some pages include videos from YouTube and Vimeo. YouTube videos use privacy-enhanced mode, which does not store cookies until you play a video. The Vimeo player may set cookies when the page loads. When you play an embedded video, YouTube (Google) or Vimeo may collect data under their own privacy policies.

You can control and delete cookies through your browser settings. The ICO's guidance on cookies explains how.

8. Your rights

Under UK data protection law you have the right to:

be informed about how we use your personal data
access the personal data we hold about you
have inaccurate data corrected
have your data erased
restrict how we use your data
object to our use of your data, including for direct marketing
receive your data in a portable format
withdraw your consent at any time, where we rely on consent

To exercise any of these rights, email info@acnlabs.co.uk. We will respond within one month. There is normally no charge.

To stop receiving email updates, email info@acnlabs.co.uk or reply to any update we send, and we will remove you.

9. Complaints

If you have a concern about how we handle your personal data, please contact us first at info@acnlabs.co.uk so we can try to resolve it.

You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

10. Security

We use appropriate technical and organisational measures to protect personal data. These include encrypted connections to this website, access controls on the systems that store form submissions, and giving access only to the people who need it.

11. Changes to this policy

We may update this policy from time to time, for example when we change the services we use. The date at the top of this page shows when it was last updated. If we make a significant change to how we use personal data we already hold, we will tell the people affected.