Privacy Policy

Last updated: March 2026

This privacy policy explains how Plexal (City) Limited (“we”, “us”, “our”) uses the personal data we collect from you or that you provide when you use the LASR website (https://www.lasr.ac.uk). We operate this website on behalf of the Laboratory for AI Security Research (“LASR”).

We are committed to protecting your personal information and complying with UK data protection laws, including the UK GDPR and Data Protection Act 2018.

1. Who we are

Plexal (City) Limited 
Company number: 10012478 
Registered office: 2 Fitzroy Place, 8 Mortimer Street, London, W1T 3JJ

If you have any questions about this policy or your personal data, you can contact us at: aisecurity@plexal.com

2. What personal data we collect

We collect limited personal data through the LASR website, including:

Information you provide directly

We collect limited personal data through the LASR website, including:
We collect limited personal data through the LASR website, including:

Information collected automatically

When you visit our website, we may collect:

Technical information such as your IP address, browser type, device type, and operating system
Information about how you interact with our website, such as pages visited and time spent on the site

This information is collected via cookies or similar technologies. For more detail, see our Cookie Policy.

3. How we use your personal data

We use your personal data for the following purposes:

To respond to enquiries submitted through the website
To operate, maintain, and improve our website
To ensure website security and protect against misuse
To understand website usage patterns to help inform improvements

We do not use your data for direct marketing unless you explicitly opt in to receive updates.

4. Legal basis for processing

We process your personal data on the following lawful bases:

Legitimate interests
To operate and improve the website, ensure security, and respond to enquiries.
Consent
Where you have opted in to receiving updates from us (if applicable).

5. Sharing your personal data

We may share your data with:

Technology providers who support the operation and security of the website
LASR, where necessary to respond to your enquiry

We do not sell your personal data.

Any third parties we use must comply with UK data protection law and only process your data in accordance with our instructions.

6. Transfers outside the UK

If any technical service providers store or process data outside the UK, we will ensure appropriate safeguards (e.g., adequacy decisions or standard contractual clauses) are in place.

7. How we keep your data secure

We take appropriate technical and organisational measures to protect your data, including secure hosting, access controls, and monitoring systems.

However, transmission of data over the internet is never completely secure, and we cannot guarantee absolute security.

8. How long we keep your data

We retain your personal data only for as long as necessary for the purposes described in this policy. Typically:

Enquiry form submissions: retained for up to 12 months, unless follow‑up activity requires longer retention
Technical logs: typically retained for up to 12 months

9. Your data protection rights

You have the right to:

Access your personal data
Request correction of inaccurate data
Request deletion of your data
Object to processing based on legitimate interests
Withdraw consent (where consent is the legal basis)

If you wish to exercise these rights, please contact us at aisecurity@plexal.com.

You may also lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

10. Changes to this policy

We may update this policy occasionally to reflect changes to our practices or legal requirements. Any changes will be posted on this page with an updated “Last updated” date.