Privacy policy

Last updated: 13 July 2026

Lupe is a TDS company
Lupe is a product of Transparent Digital Services Limited, and this policy covers both. It is also published at transparentdigitalservices.com/privacy-policy.

Thank you for choosing to be part of our community at Transparent Digital Services Limited (the "Company", "we", "us", "our"). We are committed to protecting your personal information and your right to privacy. If you have any questions or concerns about this privacy notice, or our practices with regards to your personal information, please contact us at contact@transparentdigitalservices.com.

When you visit our website transparentdigitalservices.com (the "Website"), or use the Lupe client portal at lupe.transparentdigitalservices.com or the dedicated branding workspace at lupedata.com (the "Portal"), and more generally, use any of our services (the "Services"), we appreciate that you are trusting us with your personal information. We take your privacy very seriously.

This privacy notice has been updated to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025 (DUAA), key provisions of which came into force on 5 February 2026. If there are any terms in this notice that you do not agree with, please discontinue use of our Services immediately.

1. What information do we collect?

In short: We collect personal information that you provide to us, and some information collected automatically when you use our services.

Personal information you provide

We collect personal information that you voluntarily provide to us when you express an interest in obtaining information about us or our Services, when you use our Website or Portal, or when you contact us directly. This may include:

• Email addresses and phone numbers
• Login credentials for the Portal (stored securely — passwords are hashed and never stored in plain text)
• Two-factor authentication data (encrypted TOTP secrets stored at rest)
• Company name and account details for Portal clients
• Tracking platform configuration data entered into the Portal (GTM container IDs, platform IDs, API keys — API keys are encrypted at rest)
• Any other information you choose to provide when contacting us

All personal information you provide must be true, complete and accurate. Please notify us of any changes to such information.

Information automatically collected

We automatically collect certain information when you visit, use or navigate our Website. This information does not directly reveal your identity but may include device and usage data:

• Log and usage data: IP address, browser type and settings, pages and files viewed, date/time stamps, and other activity information
• Device data: Device type, operating system, browser, and hardware information
• Location data: Approximate location based on IP address. You may opt out by disabling location settings on your device

We also collect information through cookies and similar technologies. Please see our Cookie Policy for full details.

Portal-specific data

For registered Portal users (clients and employees), we additionally collect and process:

• Account login history and session data for security purposes
• Failed login attempts and account lockout events
• Two-factor authentication setup and backup code usage records
• Password reset request logs (tokens stored as hashed values only)
• Client tracking configuration data including domain names, GTM container references, and platform identifiers
• API keys for Stape and CookieYes integrations (encrypted at rest using AES-256)
• Container health status data retrieved from third-party APIs on behalf of clients

2. How do we use your information?

In short: We process your information to provide our services, fulfil contractual obligations, ensure security, and where you have given consent, for marketing.

We use the information we collect or receive for the following purposes:

• To operate and maintain the Portal — managing client accounts, processing logins, maintaining secure sessions, and delivering tracking infrastructure data to authorised users
• To fulfil our service contract with you — providing the tag management and tracking dashboard services you have engaged us to deliver
• To ensure the security of our services — monitoring for suspicious login activity, enforcing account lockouts, managing 2FA, and protecting against unauthorised access
• To communicate with you — responding to enquiries, sending password reset emails, and sending service notifications
• To send marketing communications — where you have opted in, or where we have a legitimate interest in doing so. You may opt out at any time
• For analytics and service improvement — understanding how visitors use our Website using aggregated, anonymised data
• To comply with legal obligations — retaining records as required by applicable law

3. What is our lawful basis for processing?

In short: We rely on contract, legitimate interests, legal obligation, and consent — depending on the type of processing.

Under the UK GDPR (as updated by the DUAA 2025), we must have a lawful basis for processing your personal data. We rely on the following:

• Performance of a contract: Processing necessary to deliver the Portal services you have contracted with us for — including authentication, session management, and tracking data management
• Legitimate interests: Processing for security monitoring, fraud prevention, service improvement, and direct marketing to existing clients where our interests are not overridden by your rights
• Legal obligation: Where we are required to process data to comply with applicable law, including responding to lawful requests from authorities
• Consent: For non-essential cookies, marketing to new contacts, and any processing where we have specifically asked for your consent. You may withdraw consent at any time without affecting the lawfulness of prior processing

4. Will your information be shared with anyone?

In short: We only share information with your consent, to comply with laws, to provide our services, or to fulfil business obligations.

We may share your data in the following circumstances:

• Service providers and processors: Third-party vendors who assist us in operating our services (hosting, email delivery, analytics). These parties are contractually bound to process data only on our instructions and to maintain appropriate security
• Business transfers: In connection with any merger, sale, or acquisition of all or part of our business, your data may be transferred as part of that transaction
• Legal requirements: Where we are required by law, court order, or governmental authority to disclose your information
• Vital interests: Where necessary to prevent fraud, protect safety, or investigate suspected policy violations

We do not sell, rent or trade your personal information to third parties for their own promotional purposes.

5. Who will your information be shared with?

In short: We share data only with infrastructure providers and, where applicable, advertising platforms where you have consented.

6. Cookies and tracking technologies

In short: We use cookies and similar technologies. Full details are in our Cookie Policy.

We use cookies and similar storage and access technologies on our Website and Portal. Specific information about which technologies we use, why, and how you can manage or refuse them is set out in our Cookie Policy, which has been updated to reflect the requirements of the DUAA 2025 and the ICO's finalised guidance published on 29 April 2026.

7. International data transfers

In short: Some data may be transferred outside the UK. We ensure appropriate safeguards are in place.

Where we transfer personal data to countries outside the United Kingdom, we do so in accordance with the UK GDPR international transfer requirements as updated by the DUAA 2025. The DUAA introduced a new data protection test requiring that the destination country provides protection that is "not materially lower" than UK standards.

For transfers to the United States (such as to Facebook and Google for advertising purposes, where consent has been given), we rely on Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms. Our primary hosting and database infrastructure is located in the United Kingdom (DigitalOcean, London).

The ICO published updated guidance on international transfers on 15 January 2026, which we have taken into account in our transfer practices.

8. How long do we keep your information?

In short: We keep your information for as long as necessary for the purposes set out in this notice, and no longer than required by law.

We retain personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by law (for example, for tax or accounting purposes). Our general retention periods are:

When retention periods expire, we securely delete or anonymise the data. Where immediate deletion is not possible (for example, in backup archives), we isolate the data from further processing until it can be deleted.

9. How do we keep your information safe?

In short: We implement appropriate technical and organisational security measures to protect your data.

We have implemented the following technical and organisational security measures:

• All Portal communications are encrypted in transit using TLS (HTTPS)
• Passwords are hashed using bcrypt with a high cost factor — never stored in plain text
• Sensitive API keys are encrypted at rest using AES-256 encryption
• The Portal database is accessible only via a private VPC network — not exposed to the public internet
• Two-factor authentication (TOTP) is available for all Portal accounts
• Account lockout after 3 failed login attempts, with a 20-minute lockout period
• Session tokens stored in httpOnly cookies, inaccessible to client-side JavaScript
• Automatic session expiry after 90 minutes of inactivity

Despite our safeguards, no electronic transmission over the internet can be guaranteed to be 100% secure. You should only access the Portal and Website within a secure environment. We will notify you of any data breach affecting your personal data as required by UK GDPR.

10. What are your privacy rights?

In short: Under the UK GDPR, you have significant rights over your personal data. These are set out below.

As a UK resident, you have the following rights under the UK GDPR and the Data (Use and Access) Act 2025:

| Right to complain (DUAA 2025) | Lodge a complaint directly with us before escalating to the ICO. We must acknowledge within 30 days and respond