Privacy Policy

Labrats ("we", "us", "our") is a brand operated by The Metavision Multimedia Limited, a company registered in England and Wales. This policy explains what personal data we collect when you visit labrats.uk, how we use it, who we share it with, and the rights you have under UK GDPR and the Data Protection Act 2018.

1. Who we are

The data controller is:

The Metavision Multimedia Limited Trading as: Labrats Website: labrats.uk Contact: contact@themetavision.co.uk

If you have any question about this policy or want to exercise your rights, email the address above and we will respond within 30 days.

2. What we collect

We collect different categories of personal data depending on how you use the site:

• Information you give us directly — your name, email address, postal address, billing address, telephone number (if provided) and any message content when you fill in a contact form, sign up to our newsletter, place an order, or comment on the site.
• Order and payment data — items purchased, order value, currency, billing/shipping addresses and partial card details (we never see or store your full card number; that is handled by Stripe).
• Account and login data — if we offer membership or accounts, your email, hashed password and account preferences.
• Technical data — IP address, browser type and version, device type, operating system, referring URL, pages requested and similar diagnostic information recorded in our hosting provider's server logs.
• Analytics data — only if you accept analytics cookies: the pages you view, the products you look at, add to your basket and buy, your device and browser type, approximate location (derived by Google from your IP address) and the random identifiers Google Analytics stores in its cookies. See "Analytics cookies" below.
• Cookies and similar technologies — see our separate Cookie Policy for details.

We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

3. Why we use it (legal bases)

We process personal data only where we have a lawful basis under UK GDPR Article 6:

• Contract — to take and fulfil orders, deliver products, process refunds and provide customer support.
• Legitimate interests — to keep the site secure, prevent fraud and respond to enquiries.
• Consent — for marketing emails. You can withdraw consent at any time.
• Consent — for Google Analytics cookies and the analytics data they produce. You can withdraw it at any time with the "Cookie settings" link at the bottom of every page.
• Legal obligation — for tax records, accounting, and complying with lawful requests from regulators or law enforcement.

4. Who we share it with

We use a small set of trusted processors. Each handles only the data needed to deliver its service and is bound by a written data-processing agreement.

• Stripe, Inc. — payment processing.
• Print-on-demand fulfilment partners — print-on-demand fulfilment and shipping of physical products.
• Netlify, Inc. — website hosting and serverless functions.
• Sanity.io — content management and image delivery.
• MailerLite — newsletter and marketing email delivery (only if you have subscribed).
• Web3Forms — secure handling of contact-form submissions.
• Google LLC — Google Workspace email, and Google Analytics (only if you accept analytics cookies). If you follow one of our links to watch a video on YouTube (a Google service), YouTube may set cookies under its own policy.
• Resend — transactional email (order confirmations, shipping updates).

We do not sell your personal data to third parties. We may disclose data if required by law, court order or to protect our legal rights.

5. International transfers

Some of our processors are based outside the UK, primarily in the United States and the European Economic Area. Where data is transferred outside the UK, we rely on appropriate safeguards such as the UK International Data Transfer Addendum, EU Standard Contractual Clauses or adequacy decisions made by the UK government.

6. How long we keep it

• Order data — six years from the end of the financial year in which the order was placed (UK tax law).
• Customer support correspondence — three years from the last contact.
• Newsletter subscribers — until you unsubscribe, after which we retain a suppression record so we do not contact you again.
• Server logs — typically 30 days, then aggregated or deleted.
• Google Analytics data — kept by Google for no longer than 14 months, then deleted.

We delete or anonymise personal data once the retention period expires.

7. Your rights

Under UK GDPR you have the right to:

• request access to the personal data we hold about you;
• ask us to correct inaccurate data;
• ask us to delete data we no longer need;
• object to or restrict processing in certain circumstances;
• request that we transfer your data to another provider (data portability);
• withdraw consent for marketing emails or analytics cookies at any time;
• complain to the Information Commissioner's Office (ico.org.uk) if you believe we have mishandled your data.

To exercise any of these rights, email contact@themetavision.co.uk. We may need to verify your identity before responding.

8. Security

We use HTTPS across the site, store passwords using one-way hashing, restrict access to personal data on a need-to-know basis, and review our processors' security practices regularly. No system is perfectly secure, so we encourage you to use a unique password and keep your account credentials private.

9. Analytics cookies

We use Google Analytics 4, provided by Google, to understand how visitors use labrats.uk: which pages are viewed and which products are looked at, added to the basket and bought. Google Analytics is only loaded, and its cookies (_ga and _ga_XSQX10PWDY) are only set, if you choose Accept on our cookie banner. If you choose Reject, or don't choose, nothing is loaded from Google.

You can change your mind at any time: the "Cookie settings" link at the bottom of every page reopens the banner. If you switch from Accept to Reject, we stop sending data to Google straight away and delete the Google Analytics cookies from your browser. Your choice itself is kept in your browser's local storage under the key labrats-consent; it is not sent to us.

Google's advertising features stay off. We tell Google that advertising storage, ad user data and ad personalisation are all denied, and we don't use Analytics data for advertising.

If you accepted, then when you pay for an order our server sends Google Analytics your anonymous Analytics identifiers (the random client and session IDs Google Analytics created in your browser) together with the order: its value, shipping, tax, currency, the items bought and our order reference. We never send Google your name, email address, postal address or payment details.

Google may process this data in the United States; see "International transfers" above. Our Cookie Policy lists every cookie and storage item the site uses.

10. Games and the Vent Runner leaderboard

You don't need to give us any personal information to play our games.

When a run of Vent Runner ends, the game sends us the distance, score, stage and runner, together with a randomly created racing name and a random code stored on your device. We use the device code only to recognise the winning device and show it the prize message. We don't use it to track anyone, and it isn't linked to any personal information. We keep each month's leaderboard for 24 months, then delete it. We keep a record of each month's winning racing name and distance as our prize history.

If a player wins, their parent or guardian gives us their name, email address and delivery address to claim the prize. We use these only to send the prize and to contact them about it. We don't add them to any mailing list unless they separately ask to join one, and we delete them once the prize has been sent (and within 90 days at most).

Our lawful basis for running the leaderboard is our legitimate interest in running a fair game. For prize claims it is to send the prize the parent or guardian has asked for. To ask about or delete leaderboard data, email contact@labrats.uk. The full rules are on our leaderboard rules page at labrats.uk/games/leaderboard-terms/.

11. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top will always reflect the most recent change. Material changes will be flagged on the site or by email where appropriate.

12. Contact

Questions, requests or complaints about this policy:

The Metavision Multimedia Limited Email: contact@themetavision.co.uk