Privacy Notice & Data Governance

1. Data Controller Information

This Privacy Notice governs how Lab XIII Ltd ("we", "us", "our") collects, uses, protects, and discloses personal data obtained through our website (labxiii.org), our cloud services (lobby.labxiii.org), and during the purchase and operation of our Semantic Remote Control (SRC) hardware appliances.

2. What Data We Collect

• Account & Contact Details: Name, corporate email address, billing address, phone number, and organization details when registering for accounts or pre-ordering hardware appliances.
• Commercial & Billing Data: Payment transaction identifiers processed securely via our Level 1 PCI-DSS compliant payment provider (Stripe). We never store raw credit card credentials on our servers.
• Telephony Data: Inbound call logs, timestamps, caller ID metadata, and audio transcripts processed by our AI telephony receptionist to respond to inquiries and direct callers.
• Technical & Telemetry Data: IP address, browser user-agent, operating system details, and system diagnostic logs for security verification, load balancing, and anomaly detection.
• SRC Appliance Isolation Notice: Physical appliance video capture (HDMI) and peripheral simulation (USB HID) operate out-of-band. Raw target video frames and keystrokes are transmitted only across the client’s designated end-to-end encrypted session and are not mined, stored, or used for model training by Lab XIII Ltd.

3. Lawful Basis for Processing

Under Article 6 of the UK GDPR, we process your personal data based on the following legal grounds:

• Contractual Necessity: To fulfill pre-order reservations, dispatch physical hardware kits, provide AI console access, and issue billing invoices.
• Legitimate Interests: To protect our network and appliances against abuse, detect fraudulent transactions, and maintain 99.9% service uptime.
• Legal Obligation: To maintain VAT, corporate accounting, and regulatory tax records as required under UK statutory law.

4. Your Statutory Data Protection Rights

As a data subject under UK and European privacy laws, you have specific rights, including:

• Right of Access: Request a full copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal records.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data where no statutory retention obligations apply.
• Right to Data Portability: Obtain your telemetry and session data in a structured, machine-readable format.
• Right to Lodge a Complaint: You have the right to lodge a complaint directly with the UK Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, please email our Data Protection team directly at compliance@labxiii.org.

5. Security & Encryption Standards

We enforce strict defense-in-depth security architectures:

• All transport traffic is enforced over TLS 1.3 with HSTS preloading.
• Appliance communications utilize cryptographic mutual authentication and Zero Trust principles inspired by NIST SP 800-207 guidelines.
• Physical hardware shipments undergo tamper-evident packaging and firmware cryptographic checksum verification.