Legal

Privacy notice

How Arieta Labs Ltd handles personal data for the data.arietalabs.com website, enquiries, B2B prospecting and customers, under the UK GDPR and, where it applies, the EU GDPR.

Last updated 13 November 2026

1. Who we are

Arieta Data is the dataset business of Arieta Labs Ltd, a company registered in England and Wales (company no. 16629785), registered office 128 City Road, London, EC1V 2NX, United Kingdom. Arieta Labs Ltd is the controller of the personal data described in this notice (“we”, “us”).

Contact: [email protected], or by post to the registered office above.

Data protection officer: we have not appointed one. Nejc Fošnarič, our founder, is responsible for data protection; write to [email protected] and your message will reach him.

EU representative: we have not appointed a representative in the EU under Article 27 of the EU GDPR, and we are reviewing whether our activities require one. Until then, people in the EU can contact us directly at the address above.

2. Scope of this notice

This notice covers personal data we process about:

visitors to the data.arietalabs.com website;
people who request access or otherwise contact us;
people at businesses we contact about our datasets (B2B prospecting); and
the people we deal with at our customers and licensees.

Personal data in our datasets

This notice does not cover the contents of our legal datasets. Court decisions and other public legal documents can contain personal data, such as the names of parties, judges or lawyers. That data is handled under the dataset terms and our sourcing rules, described on the provenance page. In brief:

National case law is delivered only after personal-data masking.
When a source withdraws a document, for example after a personal-data takedown, the next monthly update carries a withdrawal notice (a “tombstone”), and licensees must delete the record.
We export only parsed fields, never the raw source pages.
Each licensee is responsible, as its own controller, for its use of the data, and the licence passes the sources’ restrictions on.

If you appear in a document in our datasets and have a question or request, write to [email protected]. Your rights under data protection law (see Your rights) apply to that data too.

3. What we collect, why, and for how long

Each table below covers one processing activity. Article references are to the UK GDPR and, where it applies, the EU GDPR, which are numbered the same way. Where we rely on legitimate interests, the table summarises how we balanced our interest against yours; you can ask us for more detail.

Delivering and protecting the website

Every visit to data.arietalabs.com passes through Cloudflare and reaches our server at Hetzner.

Delivering and protecting the website: personal data, source, purpose, lawful basis and retention
Personal data	Connection data: IP address, date and time, requested URL, referring page, browser user agent and approximate location derived from the IP address.
Source	Your browser, automatically, when you load a page.
Purpose	To deliver the pages, route traffic, and detect and block attacks and abuse.
Lawful basis	Legitimate interests (Art. 6(1)(f)): running a secure, working website. Balancing: the data is technical, is needed for any web page to load, and is not used to identify or profile visitors.
Retention	Our application does not keep a log of individual page requests. Cloudflare keeps limited connection and security-event data for a short period under its terms as our processor.

Website analytics

We count visits with Cloudflare Web Analytics, a cookie-free script loaded from static.cloudflareinsights.com.

Website analytics: personal data, source, purpose, lawful basis and retention
Personal data	Page URL, referring page, browser and device type, country, and page-load performance timings. No cookies are set and nothing is stored on your device for analytics.
Source	Your browser, through the analytics script.
Purpose	To understand which pages are used and how fast they load, in aggregate.
Lawful basis	Legitimate interests (Art. 6(1)(f)): improving the website. Balancing: reports are aggregated; the script sets no cookies, does not follow you across sites and is not used to identify you. You can block it with a content blocker and the site works fully without it.
Retention	We see only aggregated reports in our Cloudflare account, not data about individual visitors. Cloudflare processes the underlying data under its terms as our processor.

Access requests and enquiries

When you use the request-access form or email us.

Access requests and enquiries: personal data, source, purpose, lawful basis and retention
Personal data	Form: name, work email address, company, role (optional), intended use, tier of interest, jurisdictions of interest and your message. Email: your address, name and whatever you choose to write. Our replies and any follow-up correspondence.
Source	You.
Purpose	To answer your request, prepare samples or quotes, and arrange a licence if you want one.
Lawful basis	Legitimate interests (Art. 6(1)(f)): responding to business enquiries. Where you act for yourself rather than an organisation: steps taken at your request before entering into a contract (Art. 6(1)(b)). Balancing: you contacted us and expect a reply; we use the details only for that conversation.
Retention	Up to 24 months after our last exchange, then deleted, unless you become a customer (see Customers and licensees).

Form protection and service logs

Measures that keep the request-access form free of spam and abuse.

Form protection and service logs: personal data, source, purpose, lawful basis and retention
Personal data	Rate limiting: your IP address (an IPv4 address in full; for IPv6, only the first 64 bits, which identify the network) and a count of form submissions. Spam checks: a hidden “honeypot” field that people do not see, and the time taken to fill in the form, measured in your browser. Service logs: when a submission is blocked as spam or flagged as unusually fast, the domain of the email address (not the full address) and the time; when a submission cannot be delivered by email, the full submission, so that the request is not lost.
Source	Your browser and the form submission.
Purpose	To prevent spam and abuse of the form, and to make sure no genuine request is lost if email delivery fails.
Lawful basis	Legitimate interests (Art. 6(1)(f)): protecting the service and answering every genuine request. Balancing: the data is minimal, held briefly, and used only for these checks.
Retention	Rate-limit entries: in server memory only, for the 10-minute rate-limit window, removed within a minute after it ends and lost on any restart. Never written to disk. Service logs: rotated automatically and capped at 15 MB per service (3 files of 5 MB), so older lines are overwritten as new ones arrive; all logs are also deleted whenever the service is redeployed, which happens with every release.

B2B prospecting

We sometimes contact people at companies that may want to license our datasets, without them having contacted us first. This applies if you received such a message.

B2B prospecting: personal data, source, purpose, lawful basis and retention
Personal data	Name, work email address, job title or role, company, country or location, and LinkedIn profile URL. A record of our contact: dates, messages sent, your replies and the outcome, including any objection.
Source	Apollo.io, a B2B contact database operated by Apollo.io, Inc. (USA), and public company websites. Our first message tells you which source we used for you.
Purpose	To offer our datasets to people whose job makes them relevant, and to honour objections.
Lawful basis	Legitimate interests (Art. 6(1)(f)): marketing our services to businesses. Balancing: we write only to corporate work addresses, about matters relevant to your role; at most three plain-text emails in one thread (no tracking pixels), then we stop; every message identifies us, says where your address came from and how to object, and an objection is honoured at once. Where the law of your country requires prior consent for business email, we do not send you unsolicited email.
Retention	Up to 12 months after our last contact, unless a business relationship starts. If you object: your email address only, on a suppression list, kept indefinitely so that we never contact you again. The list covers all Arieta Labs outreach, including LexAPI.

Your right to object. You can object at any time, free of charge, by replying to any of our messages (for example “no thanks”) or by writing to [email protected]. We then stop contacting you, the same day, and do not use your data for marketing again. We keep only your email address on our suppression list, so that the objection is honoured.

Customers and licensees

When your organisation licenses our datasets.

Customers and licensees: personal data, source, purpose, lawful basis and retention
Personal data	Names, work contact details and roles of the people we deal with, including signatories. Licence agreement, order and delivery records. Invoicing and payment records, billing address and VAT number. Correspondence about the licence.
Source	You and your organisation.
Purpose	To enter into and perform the licence agreement, deliver snapshots and updates (including withdrawal notices), invoice, and meet our legal obligations.
Lawful basis	Contract (Art. 6(1)(b)) where you are the contracting party. Otherwise, legitimate interests (Art. 6(1)(f)) in performing our contract with your organisation; you deal with us in your professional role and would expect this use. Legal obligation (Art. 6(1)(c)) for accounting and tax records.
Retention	Contract and relationship records: six years after the contract ends (the limitation period for contract claims in England and Wales). Accounting and tax records: six years from the end of the financial year they relate to, as UK law requires.

Giving us personal data through the form or by email is voluntary. Without a name, a work email address and a company, we cannot answer an access request.

4. Who receives personal data

We do not sell personal data. We share it only with the providers below, who process it on our instructions under data processing terms, or where the law requires it.

Recipients of personal data
Recipient	Role	What they do	Location
Cloudflare, Inc.	Processor	Content delivery, proxy, DNS, protection against attacks, and Web Analytics for the website.	USA; served from Cloudflare’s global network, usually the location nearest to you
Hetzner Online GmbH	Processor	Hosting of the server that runs the website and the request-access form. We manage it with Coolify, which we run ourselves on our own servers.	Germany
Twilio Inc. (SendGrid)	Processor	Delivery of request-access form submissions to our business mailbox. Open and click tracking are switched off.	USA
Our business email provider	Processor	Hosting of our mailboxes, including [email protected], which hold enquiries and correspondence.	Named on request
Apollo.io, Inc.	Source (independent controller of its own database) and processor (for the prospecting records we keep in our account)	Business contact details for prospecting, and our prospecting records and contact log.	USA
Professional advisers and authorities	Independent controllers	Our solicitors and accountants where needed, bound by confidentiality; regulators, courts or law enforcement where the law requires it.	United Kingdom, unless stated otherwise

5. International transfers

We are based in the UK. Some of our providers process personal data outside the UK. Where that is a restricted transfer, we rely on the safeguards below.

International transfers and the safeguards relied on
Provider	Country	Safeguard relied on
Hetzner Online GmbH	Germany	No additional safeguard needed: the UK recognises the EEA as providing adequate protection.
Cloudflare, Inc.	USA and other countries in its network	The UK–US Data Bridge where the provider is certified under it; otherwise the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, in the provider’s data processing terms.
Twilio Inc. (SendGrid)	USA	The UK–US Data Bridge where the provider is certified under it; otherwise the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, in the provider’s data processing terms.
Apollo.io, Inc.	USA	The UK–US Data Bridge where the provider is certified under it; otherwise the UK International Data Transfer Agreement or Addendum, in the provider’s data processing terms.

For personal data that comes to us from the EU or EEA, transfers to us in the UK are covered by the European Commission’s adequacy decision for the UK. Onward transfers of that data to the USA rely on the EU–US Data Privacy Framework where the provider is certified under it, or otherwise on the EU Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards at [email protected].

6. Cookies and similar technologies

Cookies: none. The website sets no cookies, first-party or third-party.
Local storage: if you use the colour-theme toggle, your choice (light or dark) is saved in your browser’s local storage under the key theme. It never leaves your device, and you can clear it in your browser settings. Nothing else is stored on your device.
Analytics: the Cloudflare Web Analytics script is cookie-free and stores nothing on your device (see Website analytics).
Third-party content: fonts and all other page assets are served from our own server. The only third-party requests are the analytics script and its reports to Cloudflare.

7. Automated decision-making

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects. The automatic spam checks on the form only decide whether a submission is delivered or flagged for review; you can always email us directly instead.

8. Your rights

Subject to the conditions and exceptions in data protection law, you have the right to:

Access: get a copy of the personal data we hold about you, and information about how we use it.
Rectification: have inaccurate data corrected and incomplete data completed.
Erasure: have your data deleted, for example when we no longer need it or you have objected.
Restriction: ask us to limit how we use your data, for example while we check its accuracy.
Portability: receive data you gave us in a structured, machine-readable format, or have it sent to another organisation, where we process it by automated means on the basis of a contract or consent.
Objection: object to processing based on legitimate interests, on grounds relating to your situation. Your right to object to direct marketing is absolute: if you object, we stop, without exception.
Withdraw consent: where we rely on your consent, withdraw it at any time, without affecting processing that took place before.

How to exercise them. Write to [email protected], or by post to our registered office. It is free. We may ask you for information to confirm your identity before we act. We reply within one month of receiving your request. If a request is complex, or you send several, we may extend this by up to two further months; if so, we tell you within the first month and explain why.

9. Complaints

If you have a concern, please contact us first and we will try to resolve it. You also have the right to complain to the UK supervisory authority:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom. Helpline: 0303 123 1113. Online: ico.org.uk/make-a-complaint.

If you are in the EU or EEA, you can also complain to the data protection authority in the country where you live or work, or where you believe the infringement took place. The European Data Protection Board lists them at edpb.europa.eu.

10. Security

We use technical and organisational measures appropriate to the data we hold, including:

Encryption in transit: the website is served only over HTTPS (TLS), with HTTP Strict Transport Security.
Browser protections: a strict Content Security Policy, protection against framing, and restrictive referrer and permissions policies.
Form protection: origin checks, a size limit on submissions, input validation, rate limiting per IP address and overall, and spam checks.
Access control: servers, provider accounts and mailboxes are accessible only to authorised people. The website runs as an unprivileged process in a container, and secrets such as API keys are supplied at runtime, never built into the site.
Data minimisation: we collect only the fields listed above, hold rate-limit data in memory only, switch off email open and click tracking, and keep no log of individual page requests in our application.

No system is completely secure. If a personal data breach is likely to result in a high risk to you, we will tell you without undue delay.

11. Children

Our website and services are for businesses and professionals. They are not directed at children, and we do not knowingly collect personal data from children. If you believe a child has sent us personal data, contact us and we will delete it.

12. Changes to this notice

We update this notice when our processing changes. The “Last updated” date at the top shows the current version. If a change materially affects how we use data we already hold about you, we will tell you directly where we can, for example by email to customers.