Privacy Policy
Contents
1. In short
We collect only what we need: your details when you ask us something, your email address when you join The Murray Lab, and a record of the members-only files people open, kept to protect them. We use it to reply to you and run your account. We never sell it, and we keep most of it in the European Union. Optional cookies load only if you accept them. You can ask what we hold about you, or have it deleted, at any time by emailing marketing@murrayuniforms.com. The detail follows.
2. Who we are
This policy explains what personal information Murray collects through murrayuniforms.com, including The Murray Lab and the Fully Managed Service, what we do with it, how long we keep it and the rights you have over it.
Murray is a trading name of Murray Uniforms Ltd, registered in England and Wales, company number 06840659, registered office Unit 1A Castle Court, Bodmin Road, Coventry, Warwickshire, CV2 5DB. Murray Uniforms Ltd is the controller of the information described here.
We handle personal information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you are in the European Economic Area, the EU General Data Protection Regulation also applies.
3. What we collect
When you send us an enquiry
Our contact forms ask for your name and email address, and sometimes your phone number, company or a message. We store what you send with the date and time and the page you sent it from, and we use it to reply to you.
We email you once to confirm we have your message. Neither that email nor the alert our team receives contains what you wrote: the enquiry stays in our own database, which only named administrators can open.
To stop automated spam, we limit how many forms can be sent from one internet (IP) address in a minute. That count is kept by Cloudflare for the minute only and is never stored with your enquiry.
When you join The Murray Lab
To join, you give us your work email address and choose a password. Your account is held by Auth0, our sign-in provider. We never see or store your password. With your account we record:
- whether your request is waiting, approved or declined
- the version of The Murray Lab terms you agreed to, and when
- the sector your organisation works in, which we add when we approve you
- when your account was created and when you last signed in
A member of our team reviews every request. If we decline it, we tell you by email and delete your account straight away.
If you use the Fully Managed Service, your account is also linked to your organisation’s client group, so you see the content prepared for your organisation.
When you open a members-only file
Some files on this site are for members only. Each time anyone asks for one, we record the time, the file, the account that asked (if signed in), the IP address the request came from and whether access was given.
We use this record only to protect members-only content. Once an hour we check it for unusual activity, such as one account opening far more files than a person reading them would, and a member of our team looks into anything it flags. Nothing is decided automatically.
When you browse the site
Every request your browser makes carries your IP address and browser details: that is how a web page reaches you. Cloudflare, which hosts this site, uses them to deliver pages and to block attacks. Cloudflare also counts visits to each page for us, without cookies and without identifying you.
If you accept cookies, Google Analytics and Microsoft Clarity measure how the site is used. Section 11 lists every cookie we set and everything we keep in your browser.
When you apply for a job
Our vacancies are listed from BambooHR, our recruitment system, and you apply on BambooHR’s own site. This site collects nothing about your application.
4. Why we use it
Data protection law requires a lawful basis for each use of your information. Ours are:
| What we do | Lawful basis |
|---|---|
| Reply to your enquiry | Legitimate interests: you asked us to get in touch. Where you are asking about buying from us, taking steps at your request before a contract. |
| Run your account for The Murray Lab or the Fully Managed Service | Contract: the terms you accept when you join, or your organisation’s contract with us. |
| Send you marketing emails | Consent, which you can withdraw at any time. |
| Record access to members-only files | Legitimate interests: keeping members-only content secure. |
| Deliver the website and protect it from attack | Legitimate interests: running a secure website. |
| Measure how the site is used | Consent, given through our cookie banner. |
| Keep records the law requires, and defend legal claims | Legal obligation, and legitimate interests. |
5. Marketing emails
Some of our forms offer a box to tick if you would like our latest insights and news by email. It is never ticked for you, and you do not need to tick it to send an enquiry. We only send marketing emails to people who ticked it.
Joining The Murray Lab is not consent to marketing. We will email you about your membership, such as your approval or a password change, and we send related marketing only if you have agreed to it separately.
Every marketing email has an unsubscribe link. You can also email marketing@murrayuniforms.com and we will stop.
6. Who we share it with
We do not sell your personal information. We share it with the companies that run parts of this website for us, under contracts that limit them to doing what we ask:
| Provider | What they do for us | Where your information is held |
|---|---|---|
| Cloudflare | Hosts this website, our database and our files, counts visits to the site, and protects it from attack. | Our database and files are stored in the European Union. Pages are delivered from Cloudflare’s network worldwide. |
| Auth0 (Okta) | Runs sign-in and holds accounts for The Murray Lab and the Fully Managed Service. | European Union |
| Resend | Sends the emails this website sends: enquiry confirmations, membership emails and staff alerts. | United States |
| Sanity | Holds this website’s content. It holds nothing about visitors, enquirers or members. | European Union (Belgium) |
| Vimeo and Wistia | Host our videos. | United States |
| Google and Microsoft | Google Analytics and Microsoft Clarity, only if you accept cookies. | United States |
We also share information when the law requires it, or when we need to establish, exercise or defend a legal claim.
7. Information sent outside the UK and Europe
We keep personal information in the UK and the European Union wherever we can. Some of our providers store it in the United States:
- Resend keeps a copy of every email this website sends, including who it went to and the message itself, for 30 days. That is why our emails carry as little as possible: a link back to our own systems, never the content of your enquiry or of members-only material.
- Vimeo and Wistia receive your IP address and browser details when a video loads.
- Google and Microsoft receive analytics data, only if you accept cookies.
Each of these transfers is protected by the UK Extension to the EU–US Data Privacy Framework, under which the provider is certified, or by standard contractual clauses approved for transfers from the UK and the EU. You can ask us for a copy of the safeguards that apply.
8. How long we keep it
| Information | How long we keep it |
|---|---|
| Enquiries | 3 years from our last contact with you |
| Your agreement to marketing emails | Until you unsubscribe |
| Accounts for The Murray Lab and the Fully Managed Service | Until you close your account, or we close it. A declined request is deleted straight away. |
| Records of members-only files opened | 90 days |
| Monthly totals of members-only files opened by each account, with no IP address | 24 months |
| Copies of emails held by Resend | 30 days |
Our database can be restored to any minute in the last 30 days, so information we delete stays in that backup for up to 30 days before it is gone for good.
9. Your rights
You have the right to:
- ask for a copy of the personal information we hold about you
- have anything inaccurate corrected
- have your information deleted
- ask us to restrict how we use it
- object to how we use it, including stopping marketing at any time
- receive information you gave us in a format you can pass to someone else
- withdraw your consent, wherever consent is our basis for using it
Contact us using the details in section 13. It is free, and we reply within one month. We may ask you to prove who you are first, so we never hand your information to someone else.
If you are unhappy with how we have handled your information, please tell us first and we will put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. If you are in the European Economic Area, you can complain to the data protection authority where you live.
10. Closing your account
You can delete your account yourself, from “Your account” in The Murray Lab, or ask us to do it. Deleting it removes your sign-in, your password and your link to your organisation’s client group at once.
The records of members-only files you opened are security records, so they stay until they expire under section 8. They name your account only by a reference number, which no longer leads to you once your account is deleted.
Information about your organisation, rather than about you, is part of our business records and is kept when your account is closed.
11. Cookies and your browser
What cookies are
A cookie is a small file a website stores in your browser so it can remember something between pages or between visits. Some are essential: without them you could not stay signed in. Others are optional, such as those that measure how a site is used. We only set optional cookies if you accept them.
Your choice
On your first visit we ask whether you accept cookies. Accepting and rejecting carry equal weight, and rejecting changes nothing about what you can read or do on this site.
You can change your answer at any time from “Cookie settings” at the foot of every page. We ask again after six months.
Essential cookies
These are set whatever you choose, because the site cannot work without them.
| Cookie | What it does | How long |
|---|---|---|
| murray_consent | Remembers whether you accepted or rejected cookies. | 6 months |
| __session | Keeps you signed in to The Murray Lab or the Fully Managed Service. Its contents are encrypted. A large session is split across __session__0, __session__1 and so on. | 30 days |
| __txn_ followed by a code | Protects the sign-in process from forgery while you sign in. | 1 hour |
| murray-sector | Murray staff only: remembers which sector’s view a member of staff is previewing. | 1 year |
Our sign-in page, auth.murrayuniforms.com, is run for us by Auth0, which sets its own essential cookies there to keep sign-in secure.
Analytics cookies, only if you accept
If you accept cookies, we use Google Analytics and Microsoft Clarity to see which pages people read, how they found us and where a page gets in their way. Clarity also records how you move, click and scroll on a page. If you reject cookies, neither loads. If you accept and later reject, we remove these cookies.
| Cookie | Set by | What it does | How long |
|---|---|---|---|
| _ga | Google Analytics | Tells one visitor apart from another. | 2 years |
| _ga_ followed by a code | Google Analytics | Keeps track of your current visit. | 2 years |
| _clck | Microsoft Clarity | Recognises a returning visitor. | 1 year |
| _clsk | Microsoft Clarity | Joins the pages you view into one visit. | 1 day |
We also count visits with Cloudflare Web Analytics. It sets no cookies and keeps nothing in your browser, so it runs whether or not you accept. It tells us how many people read each page, not who they are.
Other things kept in your browser
A few settings are kept in your browser’s own storage rather than in cookies. They are never sent to us, and we cannot read them.
| Name | What it does | How long |
|---|---|---|
| murray-language-prompt | Remembers that you closed the offer to read a page in your own language. | Until you clear your browser’s storage |
| murray-lab-tour-done | Remembers that you have seen the tour of The Murray Lab. | Until you clear your browser’s storage |
| murray-lab-news-seen | Remembers when you last opened “What’s new” in The Murray Lab, so new items stand out. | Until you clear your browser’s storage |
| murray-lab:last-pillar | Takes you back to the part of The Murray Lab you came from. | Until you close the tab |
Videos
Our videos are hosted by Vimeo and Wistia. When a page with a video loads, your browser connects to them, which gives them your IP address and browser details. We switch tracking off on both, so neither sets tracking cookies. The case study films from Wistia only load when you press play.
Managing cookies in your browser
Every major browser lets you see, block and delete cookies in its settings. Blocking essential cookies will stop you signing in. To find out more, visit aboutcookies.org.
12. Keeping your information secure
Murray is certified to ISO 27001, the international standard for information security.
Members-only files are checked on every request: our server confirms you are signed in and approved before it sends anything, so a members-only file cannot be reached by guessing or sharing its address.
13. Contact us
To use any of your rights, or with a question or complaint about this policy or how we handle your information, contact us.
Email: marketing@murrayuniforms.com
Post: Data protection, Murray Uniforms Ltd, Unit 1A Castle Court, Bodmin Road, Coventry, Warwickshire, CV2 5DB
When we change this policy, we update the date below. If a change affects how we use information you have already given us, we will tell members by email before it takes effect. Last updated 6 November 2026.