Privacy Policy
1. Data Controller
The data controller responsible for your personal data in connection with this campaign is:
- Name: Unime Labs Ltd
- Website: unimelabs.com
- Campaign site: exxysmartpen.unimelabs.com
- Contact: privacy@unimelabs.com
2. Personal Data We Collect
2.1 Data you provide directly
| Data field | Collected for | Required? |
|---|---|---|
| Full name | Reservation / Expression of Interest | Yes |
| Email address | Reservation / Expression of Interest | Yes |
| Country | Shipping logistics, tax compliance | No |
| Phone / WhatsApp number | Reservation fulfilment communications | No |
| Shipping address | Delivery planning | No |
| Quantity of pens reserved | Production planning | Yes (default: 1) |
| Social media platform and username | Sending launch and product updates on your preferred network (Expression of Interest only) | No |
2.2 Payment data
Reservation payments are processed by Airwallex (Airwallex Pte Ltd). We do not receive or store full card numbers or bank account numbers. Registering an Expression of Interest is free and involves no payment data at all. For reservations we receive and store:
- A transaction/order ID from the payment provider.
- Payment status (confirmed / pending / refunded).
- The amount and currency paid.
2.3 Technical data collected automatically
Our servers and third-party services may automatically collect:
- IP address (used for geolocation to pre-select country, then discarded).
- Browser type, device type, and operating system (for analytics and compatibility).
- Referring URL.
- Timestamp of submission.
3. Legal Basis for Processing (UK/EU GDPR)
| Processing activity | Legal basis |
|---|---|
| Fulfilling your reservation or expression of interest | Contract performance (Art. 6(1)(b) GDPR) |
| Sending confirmation and reminder emails | Contract performance (Art. 6(1)(b) GDPR) |
| Processing refunds where applicable | Contract performance (Art. 6(1)(b) GDPR) |
| Fraud prevention and compliance | Legitimate interest (Art. 6(1)(f) GDPR) |
| Analytics and marketing cookies | Consent (Art. 6(1)(a) GDPR) — given via the cookie banner, withdrawable at any time |
| Server-side campaign metrics (aggregated, no cookies) | Legitimate interest (Art. 6(1)(f) GDPR) |
| Marketing updates about the Indiegogo launch | Legitimate interest (Art. 6(1)(f) GDPR) / Consent |
4. How We Use Your Personal Data
- To issue your reservation or expression of interest confirmation.
- To send reminder emails before the Cutoff Date.
- To notify you when the Indiegogo campaign launches.
- To send launch notifications and product updates to people who registered an Expression of Interest.
- To process refunds where applicable.
- To plan production quantities and shipping logistics.
- To comply with applicable financial and tax regulations.
- To prevent fraud and abuse.
5. Marketing Communications
We will send you transactional emails related to your reservation or expression of interest. We may also send campaign updates, launch notifications, and related product announcements based on your participation. These communications are sent under legitimate interest where directly related to your reservation or expression of interest. You may opt out at any time by clicking the unsubscribe link in any email or by emailing privacy@unimelabs.com.
We will not sell, rent, or trade your email address or personal data to third-party marketing companies.
6. Data Sharing and Third Parties
6.1 Payment processors
Your payment data is processed by Airwallex (Airwallex Pte Ltd). Airwallex has its own privacy policy:
6.2 Cloud infrastructure
Our platform is hosted on Microsoft Azure (EU/East US 2 region). All data is stored within Azure-managed infrastructure subject to Microsoft's data protection agreements. We have a Data Processing Agreement in place with Microsoft.
6.3 Analytics
We use Microsoft Application Insights for server-side performance monitoring; that data is aggregated and contains no personally identifiable information. Separately, this page can load Google Tag Manager and Google Analytics — but only after you accept analytics cookies in the banner described in §9. If you do not accept, no analytics or advertising identifiers are read or written.
6.4 No sale of data
We do not sell, rent, or trade your personal data to any third party.
6.5 Legal disclosure
We may disclose personal data if required by law, court order, or regulatory authority.
7. Data Retention
| Data | Retention period |
|---|---|
| Reservation records (confirmed + refunded) | 7 years from pledge date (financial record-keeping) |
| Expression of Interest records | 2 years from registration, or until you unsubscribe |
| Email address (for launch notifications) | Until you unsubscribe or the campaign concludes |
| Payment transaction references | 7 years (legal / tax compliance) |
| Technical/server logs | 90 days |
After the applicable retention period, data is securely deleted or anonymised.
8. Your Rights
Depending on your location, you may have the following rights under GDPR (EU/UK) or equivalent privacy law:
- Access: Request a copy of the personal data we hold about you.
- Rectification: Ask us to correct inaccurate data.
- Erasure: Ask us to delete your personal data, subject to legal retention obligations.
- Portability: Receive your data in a structured, machine-readable format.
- Objection: Object to processing based on legitimate interest.
- Restriction: Ask us to restrict processing of your data in certain circumstances.
- Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior lawful processing.
To exercise any of these rights, email privacy@unimelabs.com. We will respond within 30 days. You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or your relevant national supervisory authority.
9. Cookies and Tracking
When you first visit this page you are shown a consent banner. Until you choose, no analytics or advertising cookies are set and no such identifiers are read. This is enforced technically through Google Consent Mode v2, which starts in a denied state and only changes if you accept.
| Name / pattern | Category | Set by | Purpose | Typical lifetime | Before consent? |
|---|---|---|---|---|---|
exxy_smartpen_consent | Strictly necessary | This site (browser localStorage, not a cookie) | Remembers your cookie choice so you are not asked again | Until you clear browser storage | Only once you answer the banner |
| Airwallex checkout cookies | Strictly necessary | Airwallex (payment iframe) | Processing your reservation payment and preventing fraud | Session | Only when you open the payment window |
_ga, _ga_<id> | Analytics | Google Analytics via Google Tag Manager | Distinguishes visitors and sessions to count page views and campaign traffic | Up to 2 years | No |
_gid | Analytics | Google Analytics via Google Tag Manager | Distinguishes visitors within a day | 24 hours | No |
_gcl_*, IDE, test_cookie | Advertising / personalisation | Measuring whether campaign advertising led to a reservation | Up to 13 months | No |
Exact cookie names and lifetimes are set by Google and can change without notice on their side; the categories and the consent gate above are what we control and enforce.
Your choice is stored locally in your browser (exxy_smartpen_consent) and is not sent to us as a personal identifier. Rejecting is a single click, exactly like accepting, and the page works identically either way.
Changing your mind: select Cookie settings here or in the footer of any page to reopen the banner and change or withdraw your consent. Clearing your browser storage also resets the choice.
No tracking without JavaScript: Google Tag Manager also offers a <noscript> fallback that loads before any JavaScript runs. We have deliberately removed it, because Consent Mode is a JavaScript mechanism and could not gate it — leaving it in would mean tracking visitors who had not consented, and who had no way to refuse.
9.1 Who receives cookie data, and where
If — and only if — you accept analytics cookies, data collected through Google Tag Manager and Google Analytics is processed by Google Ireland Limited as our processor, and may be transferred to and stored by Google LLC in the United States. Such transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework and, where that does not apply, on Standard Contractual Clauses. Google's own handling is described in the Google Privacy Policy. IP addresses are truncated by Google Analytics before storage.
If you accept and later change your mind, withdrawing consent stops any further collection. It does not retroactively delete data already collected; to request erasure of that data, contact privacy@unimelabs.com (see §8).
If you open the payment window, Airwallex may set its own strictly necessary cookies subject to their policy.
10. Data Security
We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful loss, destruction, alteration, or unauthorised access. These include:
- HTTPS / TLS encryption for all data in transit.
- AES-256 encryption for data at rest in Azure SQL.
- Role-based access controls limiting staff access to personal data.
- Automated retention and deletion policies.
If a data breach occurs that is likely to result in risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by law.
11. International Data Transfers
Your personal data is primarily stored in Microsoft Azure (East US 2 region). If data is transferred to countries outside the UK or European Economic Area, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses with the data processor).
12. Children's Privacy
This campaign is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has submitted personal data, please contact us immediately at privacy@unimelabs.com.
13. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email to all Reservists and Interested Backers. The "Last updated" date at the top of this page indicates when the policy was last revised. Continued participation after notice of changes constitutes acceptance.
14. Contact Us
For any questions about this Privacy Policy or your personal data:
- Email: privacy@unimelabs.com
- General enquiries: hello@unimelabs.com
- Website: exxysmartpen.unimelabs.com