Effective September 29, 2026
Devence Lab, Inc. and its subsidiaries and affiliates (collectively, "Devence Lab", "we", "our", or "us") respect your privacy. This Privacy Policy ("Policy") describes how Devence Lab collects, stores, uses, and discloses your Personal Data collected from the sources listed below. You are encouraged to read this Policy carefully before visiting our website or using our services (collectively, the "Services"), as it describes your rights and choices with respect to your Personal Data.
This Policy does not apply to Personal Data we process in our role as a data processor or service provider on behalf of our customers and partners. Devence Lab does not control how customers and partners use information we process on their behalf, and you should consult the applicable customer or partner to understand how they use information they receive from us.
By accessing or using the Services or otherwise providing us with information, you acknowledge the applicability of this Policy. If you do not agree to this Policy, please do not access or use the Services or provide us with information.
1. Who we are and how to reach us
The controller responsible for your Personal Data is Devence Lab. Our corporate identification and contact addresses are set out in our Legal Notice.
For any question about this Policy, or to exercise any of the rights described in Section 10, contact us at privacy@devencelab.com. We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 of the General Data Protection Regulation ("GDPR"); privacy requests are handled by our privacy contact at the address above.
2. Scope of this Policy
This Policy applies to Personal Data we collect through devencelab.com and any subdomain we operate, through the forms and communication channels we make available on those sites, and through direct correspondence with us by email.
This Policy does not apply to the practices of third parties we do not own or control, including any website you reach by following a link from ours. Section 7 identifies the service providers we use and the limited purposes for which they process data on our behalf.
3. The Personal Data we collect
We collect only what a research and engineering organisation needs in order to answer enquiries, evaluate applications, and understand which of its published work is read. We do not build advertising profiles, and we do not acquire Personal Data from data brokers.
3.1 Information you provide to us
Enquiry and waitlist forms. Our contact form, waitlist form, home-page email capture, and product brochure request collect the fields presented on the relevant form. Depending on the form, these may include your first name, last name, email address, organisation, company website, industry, and the message you write. Only your email address is mandatory; every other field may be left blank.
Job applications. If you apply for a role through our careers pages, we collect your first name, last name, email address, current role, the biographical and motivational statements you write, and the curriculum vitae or résumé you attach. Your application file may contain any further Personal Data you choose to include in it; we ask that you do not include special categories of data (Section 3.4).
Correspondence. If you write to us, we retain your message, your address, and our reply, so that we have a record of the exchange.
3.2 Information collected automatically
Server logs. Our web server records, for each request, the requesting IP address, the date and time, the resource requested, the HTTP status and response size, the referring URL, and the user-agent string. These records are generated by the web server itself and are necessary to operate the site, investigate faults, and detect abuse.
Analytics. We use Google Analytics 4 to count visits and understand which pages are read. It sets first-party cookies in your browser and transmits to Google your IP address, the pages you view, and standard request metadata. We have not enabled Google Signals, advertising features, remarketing, or cross-device identification. We do not combine analytics data with anything you send us through a form. Section 5 and our Cookie Policy describe your choices.
Abuse prevention. Our submission endpoints keep a short-lived count of requests per source address to enforce the rate limits described in Section 9. The record is stored in a form from which the address cannot be read back, and it is discarded within 24 hours.
3.3 Information from third parties
We may receive your Personal Data from a recruitment intermediary who refers you to us, from a colleague who introduces you, or from a publicly available professional profile you have chosen to publish. We do not purchase contact lists.
3.4 Special categories of data
We do not seek, and ask that you do not send us, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data concerning your sex life or sexual orientation. Where such data reaches us unsolicited — most often in a curriculum vitae — we delete it where practicable and do not use it in any decision.
4. Why we use your Personal Data, and our legal bases
For individuals in the European Economic Area, the United Kingdom, and Switzerland, we must identify a legal basis under Article 6 GDPR for each purpose. The table below sets out each purpose, the data used, and the basis relied on.
| Purpose | Data used | Legal basis |
|---|---|---|
| Responding to an enquiry, brochure request, or waitlist sign-up | Form fields, correspondence | Art. 6(1)(b) — steps at your request prior to a contract; or Art. 6(1)(f) — our legitimate interest in answering people who contact us |
| Evaluating a job application | Application fields, curriculum vitae | Art. 6(1)(b) — steps at your request prior to a contract of employment |
| Keeping an application on file for future roles | Application fields, curriculum vitae | Art. 6(1)(a) — your consent, which you may withdraw at any time |
| Operating, securing, and debugging the Services | Server logs, hashed IP counters | Art. 6(1)(f) — our legitimate interest in a functioning and secure service |
| Measuring which published work is read | Analytics cookies and identifiers | Art. 6(1)(a) — your consent, given through our cookie banner |
| Sending you updates you have asked for | Email address | Art. 6(1)(a) — your consent, withdrawable at any time |
| Establishing, exercising, or defending legal claims | Any of the above, as relevant | Art. 6(1)(f) — our legitimate interest in defending our rights |
| Complying with a legal obligation | Any of the above, as relevant | Art. 6(1)(c) — compliance with a legal obligation |
Where we rely on legitimate interests, we have carried out a balancing assessment and concluded that our interest is not overridden by your interests or fundamental rights, principally because the data involved is limited, the processing is expected in the context, and you may object at any time under Section 10.
5. Cookies and similar technologies
We use a small number of cookies. Strictly necessary cookies are set without consent because the site cannot function without them. Analytics cookies are non-essential and are set only after you consent through our cookie banner; if you decline, or take no action, they are not set.
Our support assistant is an exception, and we would rather name it than let you discover it. It loads for every visitor and stores a conversation identifier on your device without waiting for the banner, so that anyone who needs help can ask for it. Our Cookie Policy explains what it stores, the basis we rely on, and how to avoid it.
Our Cookie Policy lists each cookie, its purpose, its provider, and its duration, and explains how to change your choice at any time.
6. What we do not do
We state the following plainly because it materially affects your rights:
- We do not sell your Personal Data, and we have never done so.
- We do not share your Personal Data for cross-context behavioural advertising.
- We do not use your Personal Data to train machine learning models.
- We do not carry out automated decision-making producing legal or similarly significant effects concerning you, within the meaning of Article 22 GDPR. Job applications are reviewed by people.
- We do not knowingly collect Personal Data from children (Section 13).
7. Disclosure of your Personal Data
We disclose Personal Data only in the circumstances described here.
Service providers. We use a small number of vendors to host the site, process form submissions, deliver email, and measure readership. Each processes Personal Data only on our documented instructions and under a written contract meeting the requirements of Article 28 GDPR. Our Subprocessors page lists every such provider, what it does, what data it receives, and where it processes that data.
Professional advisers. We may disclose Personal Data to our lawyers, auditors, insurers, and accountants where necessary for them to advise us.
Corporate transactions. If we are involved in a merger, acquisition, financing, reorganisation, or sale of assets, Personal Data may be transferred as part of that transaction. We will require the recipient to honour commitments we have made in this Policy, and will notify you of any material change through the mechanism in Section 15.
Legal requirements. We may disclose Personal Data where we believe in good faith that disclosure is required to comply with a legal obligation, a court order, or a lawful request from a public authority; to enforce our Terms of Use or Acceptable Use Policy; or to protect the rights, property, or safety of Devence Lab, our users, or the public. Where we are permitted to do so by law, we will inform you of such a request before responding to it.
We do not otherwise disclose, rent, trade, or sell your Personal Data.
8. International transfers
Certain of our service providers are established in the United States, and Personal Data you provide may therefore be transferred outside the European Economic Area.
Where we transfer Personal Data out of the EEA, the United Kingdom, or Switzerland to a country that has not been the subject of an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914), supplemented where necessary by additional technical and organisational measures, or on the recipient's certification under the EU–US Data Privacy Framework where applicable. Our Subprocessors page identifies the transfer mechanism relied on for each provider.
You may request a copy of the safeguards we rely on by writing to privacy@devencelab.com.
9. Security
We protect Personal Data using measures appropriate to the risk, described in detail on our Security page. In summary: the site is served exclusively over TLS with HTTP Strict Transport Security; credentials for third-party services are held server-side, outside the document root, and are never transmitted to your browser; form submissions are validated, size-limited, and rate-limited; and administrative access to our infrastructure is restricted to named individuals using key-based authentication.
No method of transmission or storage is completely secure. While we take the measures described above, we cannot guarantee absolute security, and any transmission is at your own risk. If we become aware of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours as required by Article 33 GDPR, and will notify you directly where Article 34 requires it.
10. Your rights
Subject to the conditions and exceptions in applicable law, you have the following rights.
Access. To obtain confirmation of whether we process Personal Data about you and, if so, a copy of it together with information about the processing.
Rectification. To have inaccurate Personal Data corrected and incomplete data completed.
Erasure. To have Personal Data deleted where it is no longer necessary, where you withdraw the consent on which processing was based, where you object and no overriding grounds exist, or where it has been processed unlawfully.
Restriction. To have processing restricted while an inaccuracy is verified, in place of erasure, or while an objection is considered.
Portability. To receive Personal Data you provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible. This applies where processing is based on consent or contract and is carried out by automated means.
Objection. To object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. Where you object to processing for direct marketing, we will stop without needing to weigh your grounds.
Withdrawal of consent. To withdraw consent at any time where processing is based on it. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Complaint. To lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement. We would be grateful for the opportunity to address your concern before you do so.
How to exercise your rights
Write to privacy@devencelab.com. We will respond within one month of receipt, and will tell you if we need to extend that period by up to two further months because of the complexity or number of requests. We do not charge a fee unless a request is manifestly unfounded or excessive.
Where we cannot identify you from the information in the request, we may ask for further information solely to confirm your identity. We will not use that information for any other purpose.
Residents of California have additional rights, described in our California Privacy Notice.
11. Retention
We keep Personal Data only for as long as necessary for the purpose for which it was collected, and then delete it or irreversibly anonymise it.
| Category | Retention period |
|---|---|
| Enquiry and waitlist submissions | 24 months from the last substantive contact |
| Email correspondence | 24 months from the last substantive contact |
| Unsuccessful job applications | 6 months from the conclusion of the process, unless you consent to a longer period |
| Job applications kept on file with consent | 24 months from the date of consent, or until you withdraw it |
| Curriculum vitae attachments | Deleted from our systems on the retention date applicable to the application |
| Server access and error logs | 10 days, after which logs are rotated and compressed archives are deleted within 12 months |
| Rate-limit counters (hashed) | 24 hours |
| Analytics data | 14 months, the shortest period Google Analytics 4 permits |
Where we are required by law to keep a record for longer — for example to meet a tax, accounting, or limitation-period obligation — we keep only what that obligation requires, and only for as long as it requires.
12. Third-party links and embedded content
Our Services contain links to third-party websites and may embed third-party content. We do not control those third parties, and this Policy does not apply to them. Following a link means the destination site receives your request directly, including your IP address. We encourage you to read the privacy policy of any site you visit. Our Editorial Policy explains that a link is a reference and not an endorsement.
13. Children
The Services are directed to professionals and are not intended for children. We do not knowingly collect Personal Data from anyone under 16 years of age, or under the age of digital consent in your jurisdiction if that age is higher. If you believe a child has provided us with Personal Data, write to privacy@devencelab.com and we will delete it.
14. Jurisdiction-specific disclosures
United Kingdom. Where the UK GDPR applies, references to the GDPR should be read as references to the UK GDPR and the Data Protection Act 2018, and references to a supervisory authority as references to the Information Commissioner's Office.
Switzerland. Where the Swiss Federal Act on Data Protection applies, references to a supervisory authority should be read as references to the Federal Data Protection and Information Commissioner.
California. See our California Privacy Notice.
15. Changes to this Policy
We may update this Policy to reflect changes in our practices or in the law. When we do, we will revise the effective date at the top of this page. Where a change materially affects how we use Personal Data we already hold, we will provide prominent notice on the Services and, where required, seek your consent before the change takes effect.
The version identifier and the document it supersedes are recorded in the header of this page, so that you can establish which version applied at any given time.
16. Contact
| Purpose | Address |
|---|---|
| Privacy questions and rights requests | privacy@devencelab.com |
| General enquiries | contact@devencelab.com |
| Security vulnerability reports | security@devencelab.com |