Last updated 27th October 2026
Market Access Lab ("we", "us") operates marketaccesslab.com. This page explains what happens to your data if you visit the site, email us, or are a business whose contact details we found and used to get in touch. We keep this simple because the site itself is simple. If we emailed you first, go straight to how we use business contact details for outreach.
marketaccesslab.com is a static site with no account system. It has two forms, a contact form and a sign-up form for regulatory updates (see Forms on this site), and it measures how visitors use it, using PostHog (see the next sections). Separately, the site stores one value in your browser's local storage recording whether you last chose the light or dark theme, so the page opens in the theme you picked; that value stays on your device. Cloudflare, our host, may also set one strictly necessary security cookie (cf_clearance) when its security checks run. Everything the site stores in your browser is listed in our Cookie Policy.
The site is hosted on Cloudflare Pages. Like virtually any web host, Cloudflare's infrastructure processes standard connection data (such as IP address and browser type) as part of serving the page and protecting it from abuse. We do not access that connection data ourselves. See Cloudflare's privacy policy for how they handle it. We run no advertising script and no Google Analytics or Meta Pixel on this site.
We use PostHog, hosted in its EU data centre, to understand how the site is used and to improve it. When you load a page, PostHog's script records page views, the page you came from, clicks and scrolling (shown to us as heatmaps), when you leave a page, page performance, clicks that appear to do nothing, and browser errors on the page. To tell real visitors from automated traffic, we also record once per visit whether there was mouse movement, whether the visitor scrolled past halfway, whether they clicked on a page element, and how many seconds the page was open; we use these four values only to count real visitors, not to review any individual visit. We do not record session replays of your visits. It assigns your browser an anonymous identifier, held in your browser's storage, so repeat visits can be counted. The cookies involved are listed in our Cookie Policy. We do not use these page analytics to identify you by name. What you type into one of the two forms is handled as described under Forms on this site. Our lawful basis is our legitimate interest in running and improving the site. PostHog deletes this data automatically 12 months after it is recorded. To opt out, use the switch below, which stops PostHog recording your visits from this browser. You can also block the PostHog script with a content blocker or your browser's tracking protection, or email hello@marketaccesslab.com and we will delete the data we hold tied to your browser.
Analytics on this browser: on
This stores one setting in your browser so that PostHog is not loaded on later visits. Clearing your browser storage removes it and turns analytics back on.
When you send the contact form, we receive the name, email address and message you enter. When you sign up for regulatory updates, we receive your email address and, if you give them, your name, company, the markets you chose and your type of product. Either form passes what you enter to PostHog (EU data centre) as a single record, from which we copy it into our own customer records so we can answer you or send the updates you asked for. PostHog keeps that record under the same 12-month automatic deletion as the site analytics. Our lawful basis is our legitimate interest in answering an enquiry you sent us, and, for regulatory updates, your request to receive them. To stop the updates or have these details deleted, email hello@marketaccesslab.com.
Every contact link on this site opens your own email client addressed to hello@marketaccesslab.com. If you send us an email, we receive whatever you choose to include — typically your name, email address, and details about your product or query — so that we can reply and, if it goes further, scope and deliver certification and market-access work for you. We use this only to respond to you and, if you become a client, to carry out that engagement. We do not sell, rent, or share it with anyone outside that purpose, other than the testing, certification and regulatory bodies directly involved in delivering work you've asked for.
This section is the information UK GDPR Article 14 requires us to give people whose details we did not collect from them directly. It applies if we emailed or messaged you about certification or market-access work and you had not contacted us first.
Who we are. Market Access Lab Ltd is the controller; our details are under Contact below.
What we use and why. We use your business contact details to write to you about product certification and market-access work relevant to what your company makes or sells, and to keep a record of whether and how you replied.
The details. Your name, work email address, job title, company name and, where you have one, your business LinkedIn profile, together with a note of the product or filing that made us think we could help.
Where we got them. From public sources: your company's own website, US FCC equipment-authorisation filings, crowdfunding campaign pages, public posts on Reddit, EU Safety Gate product-alert notices, public lists of hardware accelerators and incubators, and your public LinkedIn profile. Public Reddit threads: where a public post or comment in a hardware forum says you make a product or run a company, we may keep your Reddit username, the sentence in which you said so, your name if the post gives it, the company and product you named and its website. We read only the thread itself, not your profile or other posts. We contact you on Reddit only if you asked publicly for help, by a private message from our director's own account that answers your question. We also use contact-finding and email-checking services that look up a business email address for a named person at a company, or work one out from the format a company's other addresses use and then check it with an email-checking service, all listed below. We do not buy lists of consumers. We write to business addresses; if an address we hold is a personal one, tell us and we will remove it.
Our legal basis. Legitimate interests (UK GDPR Article 6(1)(f)). Our interest is finding businesses that need certification help and telling them about it. We have weighed that against your interests: we write to you in your business role, about something directly connected to your company's products, we send a small number of messages, we say clearly who we are, and we stop as soon as you tell us to. If you would not reasonably expect this, tell us and we will stop.
Who sees it. Only the people at Market Access Lab working on outreach and the service providers that help us with it. Those providers are: Zoho (email sending, EU data centre), Google (our records and documents), Apollo, Hunter, Datagma and Tomba (finding a business email address), Reoon and ZeroBounce (checking that an address works), and PostHog (EU data centre; it records when someone clicks the unsubscribe link). Our AI drafting tools are covered on the sub-processors page. We do not sell or share outreach contact details with anyone else.
Transfers outside the UK. Zoho and PostHog hold outreach data in EU data centres, and the UK recognises the EU as providing adequate protection. Google and PostHog also rely on standard contractual clauses with the UK addendum in their data processing terms. Where other providers process data outside the UK, the safeguard depends on the provider: Apollo's data processing agreement relies on the UK extension to the EU-US Data Privacy Framework (the UK-US data bridge) and, where that does not cover a transfer, applies standard contractual clauses with the UK addendum; ZeroBounce states that it is certified under the UK extension and also offers standard contractual clauses with the UK addendum; Hunter, Tomba and PostHog transfer under the European Commission's standard contractual clauses with the UK International Data Transfer Addendum in their data processing agreements; Datagma is based in France and its data processing agreement applies the European Commission's standard contractual clauses to any transfer outside the European Economic Area. You can ask us for a copy of the safeguard that applies to any provider, at hello@marketaccesslab.com.
How long we keep it. We keep a record of our outreach to you and of any reply you send in our customer records for up to 24 months after our last contact with you, or until the details stop being accurate or relevant if that is sooner, and then we delete it. If we are in conversation with you, or you become a client, the record is kept as set out under “How long we keep it” below instead. If you ask us to stop, we add your email address to a do-not-contact list and keep it there for as long as we are in business, so that we do not write to you again.
Reddit-sourced details. We keep your Reddit username and the quoted sentence for up to 28 days. If we have not written to you in that time, we delete them and your name and keep only your company's details; where the company name is your own name, we remove the whole record. If we write to you, the record then follows the retention above. If we never write to you and you never reply, we remove what is left that could identify you 12 months after we found it. You can object at any time and we will keep your username on a do-not-contact list so that we do not look you up again. Our legal basis and your rights are as set out above.
Your right to object, and other rights. You can object to us using your details for marketing at any time and we will stop; this right is absolute. Use the unsubscribe link at the foot of our email, reply to the email, or write to hello@marketaccesslab.com. You can also ask what we hold about you, ask us to correct or delete it, and ask us to restrict how we use it, at the same address. You can complain to us first at that address and we will respond directly. You also have the right to complain to the Information Commission (the ICO) at ico.org.uk.
Automated decisions. We make no decision about you based solely on automated processing.
The third-party providers we use to process client data, what each does and where, are listed on our sub-processors page.
Enquiry correspondence is kept for as long as reasonably useful for following up or for our own records, and deleted or anonymised once it clearly no longer is. Client engagement records are kept for as long as needed to deliver the work and meet any applicable legal, accounting or regulatory retention requirements. Call recordings and transcripts are kept for 12 months (see Calls and video meetings).
We may record and transcribe calls and video meetings with you so we have an accurate record of what we discuss and agree. Google Meet shows an indicator whenever recording is on, and our invitations and booking page say the same before the call.
If you're in the UK or EU, you can ask us what personal data we hold about you, ask us to correct or delete it, or object to how we're using it. Email hello@marketaccesslab.com and we'll respond directly — there's no automated system to route this through.
If what the site collects or how we handle enquiries changes, we'll update this page and the date at the top.
The data controller for this site and for enquiries sent to us is
Market Access Lab Ltd, registered in England and Wales, company number 14394526.
Registered office: 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE
hello@marketaccesslab.com