Legal
Privacy Policy
Last updated 16 August 2026.
Who we are
Marzal Labs Ltd is a company registered in England & Wales. We are the data controller for personal data collected through this website. You can reach us at info@marzallabs.ai.
What we collect
We collect only what you give us. That means:
- Your name, work email and company when you submit an enquiry or request a case study.
- The content of any message you choose to send us.
- Standard server request data — IP address, user agent and referring page — retained by our hosting provider for security and diagnostics.
We do not run advertising trackers, we do not sell data, and we do not build marketing profiles from site visits.
Why we use it
To respond to your enquiry, to send you material you have explicitly asked for, and to keep the site secure and working. Our lawful basis is legitimate interest for responding to a business enquiry you initiated, and consent where you have asked to receive something specific.
How long we keep it
Enquiry correspondence is retained for up to 24 months from your last contact with us, then deleted. Server logs are retained for up to 90 days.
Who else sees it
Our email and hosting providers process data on our behalf under written terms. We do not transfer personal data outside the UK or EEA except where those providers operate under adequacy decisions or standard contractual clauses.
Your rights
Under UK GDPR you have the right to access, correct, delete, restrict or object to our processing of your personal data, and to data portability. To exercise any of these, email info@marzallabs.ai and we will respond within one calendar month.
If you are not satisfied with our response you may complain to the Information Commissioner’s Office at ico.org.uk.
Cookies
This site sets no advertising, analytics or profiling cookies. Fonts are currently served from Google Fonts, which receives your IP address as part of the request; we are moving to self-hosted fonts to remove that transfer. No other third-party requests are made from this site except image delivery from our image CDN.
Client engagement data
Personal data processed inside client systems during a delivery engagement is governed by the Data Processing Agreement for that engagement, not by this policy. In NHS engagements, patient data is processed exclusively within NHS-approved infrastructure and never leaves the approved boundary.
Changes
We will post any changes to this policy on this page and update the date above.