Privacy Policy

Introduction

This Privacy Policy explains how H28 Labs Ltd ("H28 Labs", "we", "our", "us") collects, uses, and shares personal data when you visit or interact with our website and services. Our registered office and contact details are below:

Scope and purpose

We provide UK-focused crypto education, structured courses, mentoring, and cohort services. This policy describes how we handle data for learners, prospective learners, and visitors, including data collected via forms, cookies, analytics, advertising tags, and other tracking technologies.

1. Cookie categories 🍪

We use cookies to run the site, measure performance, and deliver personalised advertising. Cookies are grouped into three categories:

2. Marketing cookies — key disclosures

The following statements explain how marketing cookies and associated technologies are used on this site:

• "Third-party vendors, including Google, use cookies to serve ads based on a user's previous visits to this website and other sites on the internet."
• "We may work with advertising partners such as Google and Meta to deliver advertisements tailored to your interests across various websites and platforms."
• "We may use remarketing services to advertise to previous visitors of our website. After visiting our site, you may see our ads on other websites, apps, or platforms you visit."
• "Advertisements may appear across Google services including YouTube, Gmail, and the Google Display Network."
• "We use the following tracking technologies on this website:
  • - Cookies (first-party and third-party)
  • - Tracking pixels (Google Ads tag / gtag.js, Meta Pixel)
  • - Device identifiers (browser fingerprint, IP address)
  • - Conversion event tags
• "We use conversion tracking to understand which advertisements lead to actions on our website — such as form submissions, calls, or purchases. This allows us to measure campaign effectiveness and allocate budget appropriately. Conversion data may be shared with Google Ads and Meta."
• "Advertising and analytics technologies active on this site:
  • - Google Ads (gtag.js / Google Tag Manager)
  • - Google Analytics 4
  • - Google Remarketing Tag
  • - Meta Pixel (Facebook / Instagram)
• "You may opt out of personalized advertising at any time:
  • - Google Ads Settings: https://adssettings.google.com
  • - Your Online Choices (EU): https://www.youronlinechoices.eu
  • - Network Advertising Initiative: https://optout.networkadvertising.org
  • - Digital Advertising Alliance: https://optout.aboutads.info
  • Opting out does not remove ads entirely — you will continue to see non-personalized advertisements.
• Cookie preference management: use the "Manage cookie preferences" link below to open the cookie preferences panel and accept or reject categories independently.

3. Consent and cookie banner

Our cookie consent banner offers three options: "Accept All", "Reject Non-Essential", "Manage Preferences". Analytics and marketing cookies will not be activated until you consent. Your choice is stored in localStorage for 12 months. You can dismiss the banner without accepting; in that case only essential cookies are active. A link to this Privacy Policy is included in the banner.

"By clicking 'Accept All Cookies', you consent to the storing of cookies on your device for analytics and advertising purposes, including personalized advertising delivered by Google and Meta. You may withdraw consent at any time through the cookie preferences panel without affecting the lawfulness of processing that occurred before withdrawal."

Users in the European Economic Area and the United Kingdom receive this consent notice in compliance with the General Data Protection Regulation (GDPR) and UK GDPR. Marketing and analytics cookies are activated solely after explicit, informed, freely given consent under GDPR Article 6(1)(a). Consent is recorded with a timestamp and may be audited upon request.

You may withdraw consent at any time by clicking "Manage cookie preferences" in the footer, or by clearing cookies via your browser. Withdrawal does not affect processing that occurred while consent was valid.

4. Data Sharing with Advertising Partners

We share certain data with advertising partners for campaign delivery and measurement. Recipients and the data categories shared include:

• Google LLC: cookie identifiers, conversion events, anonymized behavioral data, remarketing lists. Governed by Google's Privacy Policy: https://policies.google.com/privacy
• Meta Platforms, Inc.: pixel events, conversion data, custom audiences. Governed by Meta's Data Policy: https://www.facebook.com/privacy/policy

We do not sell personal data. Transfers to Google and Meta operate under Standard Contractual Clauses where applicable. Data is processed for ad targeting and campaign measurement only and is not resold to unaffiliated third parties. We encourage users to review Google and Meta policies directly.

5. Lead forms and contact requests

When you submit a contact form, request a quote, or register interest, we collect the information you provide. This typically includes: full name, email address, phone number, and your message.

Legal basis: consent (GDPR Art. 6.1.a) and, where a service relationship exists, performance of a contract (GDPR Art. 6.1.b). Retention: form submission data is retained for up to 2 years from the date of submission, unless a longer period is required by law. You may request deletion by contacting [email protected]. A link to this Privacy Policy appears adjacent to every submission button on the site and by submitting you acknowledge this policy.

6. Google services and advertising

This website uses the following Google services:

• Google Analytics 4: collects anonymized usage data, device info, and behavioral signals. IP anonymization is enabled. Data retention is set to 14 months. Users may opt out via the Google Analytics Opt-out Browser Add-on: https://tools.google.com/dlpage/gaoptout
• Google Ads Conversion Tracking: records when a user completes a defined action (form submission, call, purchase) after clicking an ad. Used solely for measuring ad campaign performance.
• Google Remarketing: allows us to show ads to previous visitors across Google's network. Remarketing lists are not created from sensitive data categories.
• Google Tag Manager: deploys tracking tags on our behalf. GTM acts as a container and does not itself collect personal data.

Google's advertising products are governed by: https://policies.google.com/technologies/ads

7. Meta advertising services

We use the Meta Pixel to measure advertising effectiveness on Facebook and Instagram. The pixel may record page views, conversion events, and custom audience membership for retargeting. We do not use the Meta Pixel to collect sensitive personal data or to target based on protected characteristics. Meta acts as an independent data controller for Pixel data. See Meta's Data Policy: https://www.facebook.com/privacy/policy

To manage ad preferences on Meta platforms, visit: https://www.facebook.com/adpreferences/

8. Prohibited content self-declaration

This website does not promote, sell, or facilitate access to prohibited products or services including weapons, controlled substances, counterfeit goods, unlicensed gambling, adult content, or services that make misleading health or financial claims. All advertising conducted through Google Ads and Meta Ads complies with platform policies.

9. Landing page integrity statement

The content of this website accurately represents our products and services. We do not use bait-and-switch practices, cloaking, or content variation by traffic source. Paid visitors receive the same landing experience as other visitors. We do not perform automatic redirects that alter content based on traffic source.

10. Children's privacy

This website is not directed at individuals under 16. We do not knowingly collect personal data from minors. If we learn we have collected data from someone under 16 without verifiable parental consent, we will delete it promptly. Contact [email protected] to report concerns.

11. International data transfers

Personal data may be transferred to and processed in countries outside the EEA, including the United States, where Google LLC and Meta Platforms, Inc. are based. Transfers are conducted under Standard Contractual Clauses (SCCs) where applicable. A copy of applicable SCCs is available on request by emailing [email protected].

12. Your rights (EEA / UK)

If you are in the EEA or the UK you have rights under GDPR Articles 15–22:

• Access (Art. 15): request a copy of data we hold about you
• Rectification (Art. 16): correct inaccurate or incomplete data
• Erasure (Art. 17): request deletion
• Restriction (Art. 18): limit processing
• Portability (Art. 20): receive data in a structured, machine-readable format
• Objection (Art. 21): object to processing based on legitimate interest
• Withdraw consent (Art. 7.3): revoke consent at any time without penalty

To exercise any right, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority: EU users: https://edpb.europa.eu · UK users: https://ico.org.uk

13. What data we collect

We collect the following personal and technical data as applicable:

• Full name
• Email address
• Phone number
• IP address
• Browser type and version
• Device type and operating system
• Cookies and tracking identifiers
• Usage data (pages visited, time on site, click paths)
• Form submission content
• Conversion events (form submits, calls, purchases)

14. Legal basis for processing (GDPR Art. 6)

We process data under the following legal bases:

• Contact form data: consent (Art. 6.1.a) and contract performance (Art. 6.1.b)
• Analytics data: consent (Art. 6.1.a)
• Marketing / remarketing data: consent (Art. 6.1.a)
• Security and fraud prevention: legitimate interest (Art. 6.1.f)

15. Retention periods

We retain data according to the following periods:

• Contact form submissions: 2 years
• Analytics data (GA4): 14 months
• Marketing cookies (Google Ads): up to 540 days
• Email communications: duration of relationship plus 1 year
• Server logs: 90 days
• Cookie consent records: 3 years (audit requirement)

16. Policy metadata

Last Updated: January 15, 2026

Effective Date: January 15, 2026

Material changes will be notified via a homepage banner at least 14 days before they take effect.

Contact and questions

If you have questions about this Privacy Policy, wish to exercise a data subject right, or request copies of the Standard Contractual Clauses used for transfers, email us at [email protected] or write to: