PasLens Privacy Notice

Retrolab Technologies Limited

Version: 1.0
Last updated: 14 November 2026

1. Introduction

Retrolab Technologies Limited ("Retrolab", "we", "us" or "our") is committed to protecting personal information and handling it responsibly, securely and transparently.

This Privacy Notice explains how we collect, use, store, disclose and protect personal information when individuals use:

• The PasLens mobile application for iOS and Android;
• The PasLens website at https://paslens.co.uk;
• Our registration, enquiry and customer support services; and
• Other services and communications associated with PasLens.

PasLens is a digital photographic evidence management platform designed for professionals working in the UK retrofit and construction sectors.

The platform enables authorised users to capture, organise, manage and share photographic evidence associated with retrofit projects, including installation stages, project details and supporting location information.

We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where applicable, the Privacy and Electronic Communications Regulations 2003 (PECR).

2. Who We Are

PasLens is developed and operated by Retrolab Technologies Limited.

Registered company name: Retrolab Technologies Limited
Company registration number: 16389113
Registered office: M&M Chartered Accountants, 10 Northwood Gardens, London, England, N12 9DR
ICO registration number: ZB913560

General enquiries and customer support:

Data protection enquiries and individual rights requests:

Account deletion requests:

For questions concerning this Privacy Notice or our handling of personal information, please contact us using the data protection email address above.

3. Our Role as Data Controller or Data Processor

Our responsibilities under data protection law depend on the circumstances in which personal information is processed.

3.1 When Retrolab acts as a data controller

Retrolab generally acts as a data controller when determining why and how personal information is used for its own business activities, including:

• Managing PasLens user accounts and authentication;
• Responding to website enquiries and registration requests;
• Managing customer relationships and providing support;
• Administering contracts, invoicing and business communications;
• Maintaining the security and performance of our services;
• Conducting lawful marketing activities; and
• Meeting legal and regulatory obligations.

3.2 When Retrolab acts as a data processor

Where a customer organisation uses PasLens to manage its own retrofit projects, that organisation may act as the data controller for personal information contained within project records and photographic evidence.

In those circumstances, Retrolab may act as a data processor, providing the platform and processing relevant information on the customer's documented instructions.

This may include information relating to property occupants, installers, subcontractors and other individuals associated with a retrofit project.

Where Retrolab acts as a processor, the customer organisation is generally responsible for determining the lawful basis for collecting and using the relevant project information and for providing appropriate privacy information to affected individuals.

The allocation of responsibilities will be governed by the applicable customer agreement and data processing arrangements.

4. Personal Information We Collect

The information processed through PasLens depends on how an individual interacts with our services.

4.1 User account and professional information

We may collect and process:

• Full name;
• Email address;
• Telephone number;
• Employer or organisation;
• Job title and professional role;
• Account identification and authentication information;
• Assigned projects, measures and team memberships;
• User permissions and access roles; and
• Records associated with account administration and support.

Authentication credentials are handled through our authentication provider. Retrolab does not require access to users' readable passwords.

4.2 Project and property information

PasLens may process information associated with retrofit and construction projects, including:

• Property address and postcode;
• Project name and reference number;
• Customer or delivery organisation;
• Retrofit measures and ventilation works;
• Installation stages, including Pre-Stage, Mid-Stage, Post-Stage and Query-Stage;
• Product, system and manufacturer information;
• Photograph descriptions and room or location references;
• Date and time information;
• Assigned delivery-team members;
• Identity of the user capturing or uploading evidence; and
• Project-related comments, queries and supporting records.

Some project information may identify individuals directly or indirectly, particularly where it relates to occupied residential properties.

4.3 Photographic evidence

PasLens enables authorised users to capture and store photographic evidence associated with installation works.

Photographs may contain personal information, including:

• Images of installers, residents or other individuals;
• Property interiors and identifying features;
• Personal possessions;
• Vehicle registration numbers;
• Documents, labels or paperwork;
• Property addresses and other identifying information; and
• Information associated with installation activities.

Such information may be captured incidentally as part of legitimate project evidence.

Users and customer organisations should take reasonable steps to avoid capturing unnecessary personal or sensitive information.

4.4 Location and photographic metadata

PasLens uses location information to support the authenticity, identification and traceability of photographic evidence.

When an authorised user captures photographic evidence, the application may process:

• Latitude;
• Longitude;
• Altitude;
• Device heading or compass direction; and
• Date and time information.

Location information is collected in connection with active use of the application's evidence-capture functionality.

PasLens does not undertake continuous or background location tracking.

Location permissions are requested through the device operating system. Users can manage these permissions through their device settings, although restricting location access may affect evidence-capture functionality.

4.5 Device and technical information

Our technology providers may process limited technical information necessary for authentication, service delivery, security and performance monitoring.

Depending on the services enabled, this may include:

• Internet Protocol (IP) address;
• Device type;
• Operating system;
• Application version;
• Technical identifiers;
• Connection and authentication information; and
• Application performance information.

PasLens uses Firebase Authentication, Cloud Firestore and Cloud Storage.

Firebase Performance Monitoring is also included in the application and may process technical performance information if enabled.

4.6 Website enquiries and registration of interest

When an individual contacts us through the PasLens website, we may collect:

• Name;
• Email address;
• Contact telephone number;
• Job title or professional role, where requested;
• Organisation details;
• Enquiry type;
• Message content; and
• Information necessary to respond to the enquiry.

We use this information to manage enquiries, communicate with prospective customers and respond to requests for information.

4.7 Invoicing and business administration

PasLens operates using an invoicing arrangement.

We may process customer and business contact details, invoice references, payment status and related accounting information.

PasLens does not currently require users to provide payment-card details directly through the mobile application.

5. How We Use Personal Information

We process personal information for the following purposes:

Providing the PasLens service

To establish accounts, authenticate users, manage access permissions, create projects, store evidence and make authorised project information available to relevant users.

Managing photographic evidence

To associate photographs with projects, retrofit measures, installation stages, timestamps and location information, and to enable authorised viewing, sharing and export.

Supporting retrofit compliance and assurance

To enable customer organisations and authorised stakeholders to review project evidence, identify missing information, investigate queries and support relevant compliance and audit processes.

Communicating with users

To send account invitations, authentication communications, project assignments, project updates, operational notifications and customer support responses.

Managing our business

To administer contracts, customer relationships, invoicing, service enquiries and internal business records.

Protecting our systems

To maintain service availability, investigate security incidents, prevent unauthorised access and identify technical problems.

Improving our services

To understand service performance, investigate errors and make appropriate improvements to the platform.

Marketing our services

To communicate relevant information about PasLens and related services where permitted by applicable law.

Meeting legal obligations

To comply with applicable legal, regulatory, accounting and lawful disclosure requirements.

6. Our Lawful Bases for Processing

Where Retrolab acts as a data controller, we rely on one or more of the following lawful bases under UK GDPR.

Our legitimate interests include operating and improving PasLens, maintaining customer relationships, protecting our services and supporting efficient project evidence management.

Where we rely on legitimate interests, we consider the necessity of the processing and the potential impact on individuals.

Where a customer organisation controls project evidence and Retrolab acts as its processor, the customer organisation is responsible for identifying the applicable lawful basis for that project processing.

7. Access to Project Information

PasLens uses role-based access controls to restrict project information to authorised users.

Depending on their responsibilities and assigned permissions, authorised users may include:

• Project Administrators;
• Retrofit Assessors;
• Retrofit Coordinators;
• Technical Monitoring personnel;
• Compliance Support personnel;
• Installers and operatives; and
• Other authorised project delivery or assurance personnel.

Access may be limited according to assigned projects, retrofit measures and user roles.

Customer organisations are responsible for ensuring that access is granted only to appropriate personnel and that user permissions remain accurate.

8. Sharing Personal Information

We do not sell personal information.

We may disclose personal information where reasonably necessary for service delivery, lawful project operations, technical support or compliance with legal obligations.

8.1 Authorised retrofit and construction stakeholders

Project information may be made available to appropriately authorised organisations and personnel involved in delivering, managing, reviewing or assuring the relevant project.

These may include:

• Installers and subcontractors;
• Retrofit Coordinators and Retrofit Assessors;
• Technical monitoring providers;
• Compliance and quality assurance teams;
• Management agents;
• Principal contractors;
• Local authorities;
• Scheme administrators; and
• Other authorised project stakeholders.

Such access or disclosure must be consistent with the relevant permissions, contractual arrangements and lawful purposes.

8.2 Government, regulatory and scheme bodies

Where appropriate, information may be disclosed to relevant public bodies, including local authorities, the Department for Energy Security and Net Zero (DESNZ), Ofgem and other authorised regulatory or scheme organisations.

Disclosure may take place where required or permitted for:

• Scheme administration;
• Compliance and quality assurance;
• Audits and technical monitoring;
• Investigations;
• Legal or regulatory obligations; or
• Lawful instructions from the relevant customer organisation.

8.3 Technology and service providers

We use third-party providers to support the operation and security of our services.

These include Google Firebase services used for authentication, database functionality and photographic evidence storage.

Relevant providers may process information on our behalf or under their own applicable terms and privacy arrangements.

We seek to use appropriate contractual and technical safeguards when engaging providers that process personal information.

8.4 Professional advisers and legal disclosures

We may disclose information to professional advisers, accountants, insurers, legal representatives or competent authorities where necessary and lawful.

We may also disclose information where required by a court order, legal obligation or other lawful process.

9. International Data Processing and Transfers

PasLens is designed for professional use within the United Kingdom.

Firebase Authentication operates using Google's global infrastructure, and certain information may be processed outside the United Kingdom.

Where personal information is transferred internationally, we will ensure that an appropriate legal mechanism is in place where required under UK data protection law.

Depending on the destination and circumstances, this may include applicable UK adequacy regulations or approved contractual safeguards and supplementary protections where necessary.

Individuals may contact to request further information about applicable international transfer safeguards.

10. Data Security

We take the security of personal information seriously and seek to implement appropriate technical and organisational measures proportionate to the risks involved.

Our security arrangements include the use of authentication and role-based access permissions to control access to relevant project information.

We also use technology infrastructure intended to support secure storage and controlled access to project records.

We seek to ensure that personal information is accessed only by individuals or service providers who have an appropriate reason to do so.

No internet-based system can be guaranteed to be completely secure. We therefore review security arrangements and respond to identified risks as appropriate.

Users are responsible for protecting their account credentials, maintaining appropriate device security and notifying us promptly if they suspect unauthorised account access.

11. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including relevant operational, contractual, regulatory, audit and legal requirements.

The appropriate retention period depends on the type of information and the circumstances in which it is processed.

In determining retention periods, we consider:

• The nature and sensitivity of the information;
• Whether the relevant customer account or project remains active;
• Contractual obligations and customer instructions;
• Applicable retrofit scheme requirements;
• Audit, compliance and evidence-preservation needs;
• Statutory accounting and record-keeping obligations;
• Potential legal claims or disputes;
• The need to investigate security incidents; and
• Whether continued retention remains necessary and proportionate.

Project evidence may need to be retained after installation works have been completed, particularly where it is required for audit, assurance, contractual or regulatory purposes.

Where Retrolab acts as a processor, retention and deletion of project information will also be governed by the relevant customer instructions and contractual arrangements.

Information that is no longer required will be deleted, anonymised or otherwise handled in accordance with the applicable retention and deletion arrangements.

Backup information may remain temporarily within controlled backup systems until it is overwritten or deleted in accordance with the relevant backup retention arrangements.

12. Account Deletion and Project Evidence

Users may request deletion of their PasLens account by emailing:

accounts@paslens.co.uk

Requests should identify the account concerned so that we can verify the request and determine the appropriate action.

Where a user account is associated with an employer or customer organisation, we may need to consult the relevant organisation before removing information that forms part of its project records.

Deleting an individual user's account does not necessarily require deletion of photographic evidence or other project information belonging to that user's employer or customer organisation.

Such project information may need to be preserved where there is an appropriate lawful basis, contractual requirement or continuing operational or regulatory need.

We will assess deletion requests in accordance with applicable data protection law, including any relevant exceptions to the right to erasure.

Where information must be retained, we will explain the relevant reasons where appropriate.

Account deletion and project evidence retention will be handled as distinct processes.

13. Camera, Location and Device Permissions

PasLens requires access to certain device functions to provide its evidence-capture features.

Camera access

The camera is used to capture photographic evidence directly within PasLens.

Location access

Location permissions enable relevant geographic information to be associated with photographic evidence while the application is actively being used.

PasLens does not continuously monitor a user's location in the background.

Notifications

Where enabled, device notification permissions may be used to deliver relevant account, project and operational communications.

Users can manage applicable permissions through their device operating system.

Disabling certain permissions may prevent associated PasLens functions from operating as intended.

PasLens does not currently provide audio or video recording functionality and does not require microphone access for its stated evidence-capture features.

14. Operational Notifications

PasLens may send operational communications relating to account access and project activities.

Depending on the functionality enabled, these may include:

• Account invitations and registration communications;
• Project assignments and assignment changes;
• Project-related queries;
• Evidence-related requests;
• Team or permission changes;
• Service and security information; and
• Other relevant operational updates.

Notifications may be delivered through the application, email or supported device notification services.

These communications are intended to support the provision and administration of PasLens and are separate from promotional marketing communications.

15. Marketing Communications

We may contact existing customers and relevant business contacts with information about PasLens, product updates and related services.

Where permitted by the Privacy and Electronic Communications Regulations, we may rely on the existing-customer soft opt-in for marketing our own similar products or services.

We will use this approach only where the applicable requirements are met, including providing an appropriate opportunity to opt out when contact details are collected and in each subsequent marketing communication.

Where the soft opt-in does not apply and consent is required, we will seek the necessary consent before sending marketing communications.

Recipients may object to direct marketing or unsubscribe at any time using the instructions provided in the relevant communication or by contacting:

accounts@paslens.co.uk

We will respect valid marketing objections and maintain appropriate suppression records to avoid sending further unwanted marketing.

16. Website Cookies and Analytics

The PasLens website uses cookies and similar technologies to support website operation and, where permitted, understand how visitors interact with the website.

These may include:

• Essential cookies required for website functionality;
• Cookies associated with security or user preferences; and
• Analytics technologies, including Google Analytics 4 (GA4), where enabled.

Non-essential cookies and similar tracking technologies will be subject to the applicable consent requirements.

Visitors can manage their preferences through the cookie consent controls provided on the website.

Further information about the cookies used, their purposes and relevant retention periods is available in our separate Cookie Policy.

Cookie Policy: Available through the PasLens website footer and cookie preferences panel.

17. Children's Privacy

PasLens is intended for business and professional users aged 18 and over.

We do not knowingly permit individuals under the age of 18 to register for a PasLens account.

If we become aware that an account has been created by an individual under 18, we will take appropriate steps to review and address the situation.

18. Automated Decision-Making and Profiling

PasLens does not currently use automated decision-making that produces legal or similarly significant effects on individuals.

The platform does not currently undertake facial recognition, automated installer scoring or AI-based compliance decision-making.

Photographic evidence and project records are made available to authorised personnel for review and management.

Responsibility for professional assessments, compliance decisions and project assurance remains with the relevant authorised individuals and organisations.

19. Your Data Protection Rights

Subject to applicable law and relevant exceptions, individuals have rights concerning their personal information.

These may include:

Right of access: To request information about personal data held about them and obtain a copy where applicable.

Right to rectification: To request correction of inaccurate personal information.

Right to erasure: To request deletion of personal information in circumstances where the law provides this right.

Right to restriction: To request that certain processing be restricted.

Right to data portability: To receive certain personal information in a structured, commonly used and machine-readable format where the relevant conditions apply.

Right to object: To object to certain processing carried out on the basis of legitimate interests.

Right to withdraw consent: Where processing relies on consent, to withdraw that consent at any time without affecting the lawfulness of processing undertaken before withdrawal.

Rights relating to automated decision-making: To exercise applicable protections where relevant automated decision-making takes place.

Your right to object to direct marketing

You have the right to object to the processing of your personal information for direct marketing at any time.

Where a valid objection is made, we will stop processing the relevant personal information for direct marketing purposes.

How to exercise your rights

Requests should be sent to:

accounts@paslens.co.uk

We may request information reasonably necessary to verify identity and protect personal information against unauthorised disclosure.

Where Retrolab processes project information on behalf of another data controller, we may refer the request to that organisation or assist it in responding as appropriate.

We will respond to requests within the time limits required by applicable data protection law.

20. Information About Other Individuals

Customer organisations and authorised users may upload information that relates to individuals who do not themselves use PasLens.

Examples include residents, property owners, installers, subcontractors and other individuals appearing in project photographs or associated documentation.

Customer organisations are responsible for ensuring that they have an appropriate lawful basis for collecting and using such information and that affected individuals receive the privacy information required by law.

Users should avoid collecting unnecessary personal information and should exercise particular care where photographs could reveal sensitive or private information.

21. Information Required to Use PasLens

Certain information is necessary to create and administer an account or provide the relevant service.

For example, account identification and authentication information may be required to establish access, while project and photographic information may be necessary to perform evidence-management functions.

Where required information is not provided, some services or features may be unavailable.

Other information may be optional, depending on the relevant function and circumstances.

22. Changes to This Privacy Notice

We may update this Privacy Notice to reflect changes in our services, technology, legal requirements or data protection practices.

The current version will be made available through the PasLens website and, where appropriate, the mobile application.

Where changes materially affect how personal information is processed, we will take appropriate steps to notify affected individuals where required.

The date at the beginning of this notice indicates when it was last updated.

23. Complaints and Contacting the ICO

We encourage individuals to contact us first if they have concerns about how their personal information is handled.

Data protection enquiries:

Individuals also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

Information Commissioner's Office
Website: https://ico.org.uk
Telephone: 0303 123 1113

Retrolab Technologies Limited is registered with the ICO under registration number ZB913560.

24. Contact Information

For general enquiries about PasLens:

support@paslens.co.uk

For privacy matters, data protection rights, account deletion requests or concerns about personal information:

accounts@paslens.co.uk

Retrolab Technologies Limited
M&M Chartered Accountants
10 Northwood Gardens
London
England
N12 9DR

Company registration number: 16389113
ICO registration number: ZB913560

End of Privacy Notice