1. Who is responsible for your information?
Global Laboratories Ltd is the controller of personal information processed through TESTDOG. TESTDOG is a brand of Global Laboratories Ltd and is not a separate legal entity.
2. Scope of this notice
This notice applies to testdog.co.uk, the TESTDOG customer and staff portals, enquiries, quotations, orders, project messages, reports, invoices and service notifications. It does not cover an independent laboratory's own website or service where that organisation acts as a separate controller; we will identify that organisation where relevant.
3. Information we collect
Information you provide
- account and contact information, including your name, work email, organisation, telephone number and country;
- testing enquiries, project descriptions, messages and the answers you confirm in an AI-assisted summary;
- technical documents, images, drawings, spreadsheets, CAD files and other attachments you choose to upload;
- quotation responses, order information, report access activity and invoice information; and
- communications with our engineers, finance team and support contacts.
Information received from sign-in providers
If you sign in with Google, Microsoft or GitHub, we receive identifiers and basic profile information needed to authenticate you, normally including your verified email address. We do not receive your provider password.
Information collected automatically
Our hosting, authentication and security providers may process IP address, device/browser information, timestamps, request logs, security events and similar technical data needed to deliver and protect the service. For basic aggregate page measurement, our server derives a privacy-safe identifier that resets daily and records the public page and coarse country/region/city without placing an analytics identifier in the browser. If you accept optional analytics, we also use a persistent pseudonymous visitor identifier, 30-minute session identifier, page and service activity, privacy-screened searches, referral source, coarse country/region/city and a masked network signal. Network signals are auxiliary estimates and are not treated as a person or customer count.
4. How and why we use information
| Purpose | Typical information | UK GDPR lawful basis |
|---|---|---|
| Create and secure your account | Identity, email, authentication and security data | Contract and legitimate interests in secure access |
| Understand your requirements and prepare a quotation | Enquiry, messages, files and AI-confirmed summary | Steps at your request before entering a contract; legitimate interests |
| Deliver testing, modelling, manufacturing or data services | Project files, order updates, reports and communications | Contract |
| Issue and administer invoices and business records | Identity, company, order and invoice data | Contract and legal obligation |
| Protect, troubleshoot and improve the service | Technical logs, usage and security events | Legitimate interests in reliability, fraud prevention and security |
| Publish an approved customer testimonial | Written feedback and the name or initials and company name you approve | Consent, which you can withdraw |
| Measure advertising effectiveness | Advertising click identifiers, technical connection data, page address and a random successful-enquiry identifier | Consent, controlled separately from website analytics |
| Comply with law and resolve disputes | Relevant account, transaction and communication records | Legal obligation and legitimate interests |
With your separate consent, Google Ads measures advertising visits and successful enquiry submissions. Google receives technical information such as your IP address and browser information, advertising click identifiers, the page address and a random enquiry identifier used to prevent duplicate counting. Our conversion event does not include your name, email, telephone number, enquiry text, uploaded files or account credentials. We do not enable enhanced conversions, remarketing or ad personalisation in this integration. See Google's business privacy information. You can withdraw advertising consent through Cookie settings in the website footer.
4A. Feedback and testimonial permission
We use order feedback to respond to concerns and improve our services, based on our legitimate interests in service quality. Public testimonials are different: we publish your written feedback with your chosen name or initials and company name only with your separate, optional consent. Public material may be seen, copied or indexed by others worldwide. Uploaded images and confidential project information are not included in this permission.
We record the wording version, time of consent and the identity you approve. You can withdraw in My TESTDOG or email team@globallaboratories.co.uk. We stop new use and remove material from channels we control without undue delay. We keep a limited, restricted record of consent and withdrawal for accountability and to address legal claims, only for as long as necessary; it is not permission for further publicity.
4B. Feedback reward claims
When you request a feedback reward, we use your name, company or institution, verified registered email, project and feedback references, employer-permission confirmation, accepted terms version and submission time to administer your request and fulfil the promotion terms. We record manual review decisions and gift card delivery references for accountability, fraud prevention and accounting. Claiming does not grant permission to publish your feedback or subscribe you to marketing.
We may share your name and email with Amazon, including through Amazon Incentives, to deliver an approved Amazon.co.uk Gift Card. We do not send your laboratory results, private feedback or employer declaration to the gift card supplier. Our lawful bases are performance of the reward agreement, legitimate interests in preventing duplicate or fraudulent claims, and applicable accounting obligations. Reward and accounting records are normally retained for six years after the relevant transaction or financial period, with access restricted to authorised staff. Your rights and our contact details are described below.
5. AI-assisted enquiry intake
TESTDOG uses AI services to transcribe voice input and help structure a testing request. The AI output is preliminary: you are shown a summary and asked to confirm it before submission. Our engineers determine the final test method, standard, scope, price and delivery plan.
We do not use the AI intake tool to make a solely automated decision that produces legal or similarly significant effects. Voice audio is sent for transcription but is not intentionally saved as an audio file in your TESTDOG portal record; the resulting text and confirmed enquiry are retained as described below.
7. International transfers
Some providers or project partners may process information outside the United Kingdom. Where UK data protection law requires it, we use an applicable adequacy regulation or appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum, together with proportionate technical and organisational protections.
8. Security
We use access controls, encrypted connections, row-level database permissions, private file storage, expiring download links and role-based staff access. No online service is completely risk-free. You are responsible for protecting your login credentials and for notifying us promptly if you suspect unauthorised access.
9. How long we keep information
| Record | Typical retention approach |
|---|---|
| Unconverted enquiries and uploaded files | Normally up to 24 months after the last meaningful contact, unless needed for an active opportunity, dispute or legal requirement. |
| Orders, technical project records and reports | Normally up to 6 years after project completion, or longer where the contract, accreditation, safety requirements or applicable law requires. |
| Quotes, invoices and accounting records | Normally 6 years after the relevant financial period or transaction. |
| Account profile | While the account is active and normally up to 24 months after closure or last activity, subject to linked project records. |
| Detailed optional analytics events | Normally 90 days. Daily or monthly aggregate counts may be retained for at least 13 months. |
| Authentication security events | Normally 30 days. These records are kept separately from optional behaviour analytics. |
| Security and service logs | For a proportionate period determined by security, troubleshooting and provider retention settings. |
We may retain a limited record for longer where necessary to establish, exercise or defend legal claims. When information is no longer required, we delete, anonymise or securely restrict it.
10. Your data protection rights
Depending on the circumstances, you may ask us to access, correct, erase or restrict your personal information; object to processing; receive portable data; or withdraw consent where consent is the basis used. These rights are not absolute and exemptions may apply.
Send requests to team@globallaboratories.co.uk. We may need to verify your identity. We normally respond within one month.
11. Questions and complaints
Please contact us first so we can try to resolve your concern. You also have the right to complain to the UK Information Commissioner's Office. See the ICO complaint guidance or call 0303 123 1113.
12. Children
TESTDOG is a business and professional engineering service and is not directed to children. Customers must be at least 18 years old and authorised to act for themselves or their organisation.
13. Changes to this notice
We may update this notice as the service, providers or law changes. We will post the updated version here and, where a change is material, provide a prominent portal or email notice.
14. Contact
Global Laboratories Ltd, 124 City Road, London, England, EC1V 2NX. Email: team@globallaboratories.co.uk.