Most policies of this kind blend three different subjects into one. They are kept apart here: what you type into a form, what happens to a device once it is inside a laboratory, and what a browser leaves behind simply by loading a page. It is meant to be read rather than scrolled past. This version carries the date August 2026, which is how you can tell which one you have.
Two forms exist. The contact page carries one, which asks for a callback; the free diagnostic carries the other, which closes the wizard once a device, a make and a symptom have been chosen. The fields are identical on both: something to call you by, a number to ring, an address for the written quote, and a box for your own account of what happened. The diagnostic sends its three clicked answers along as well, so the engineer who telephones already knows whether the subject is a ticking 3.5-inch disk or a volume nobody can unlock. That is everything either form collects. One further field exists in the markup, deliberately hidden and labelled to be left alone: automated form-fillers complete it, people never see it, and anything arriving with text in that box is discarded unread.
Nobody is asked for a date of birth. A postal address is wanted only when a parcel has to travel back to you. No part of this website takes payment, so card details are never typed into it; invoicing details are collected separately once work is agreed and kept with the accounts, not inside a marketing tool.
Throughout this page, the controller for UK GDPR purposes is Coventry Data Recovery, the trading name this laboratory's work is sold under to households, sole traders, professional practices and companies in Coventry, across Warwickshire and the West Midlands, and anywhere else a parcel will reach. No premises exist in Coventry. The bench, the imaging hardware, the donor stock and the job records are all at one address: Oxford Data Recovery, John Eccles House, Oxford Science Park, Robert Robinson Avenue, Littlemore, Oxford OX4 4GP, which is roughly fifty-five miles, the M40 south, about an hour in the car. Anything here can be raised on 0800 689 0668 during Mon–Fri 9:00am–5:30pm or in writing to support@oxford-datarecovery.co.uk, and whoever replies works on the jobs rather than in a ticketing queue.
Two of the six lawful bases do nearly all the work. Replying to an enquiry, quoting, taking custody of a device and carrying out a recovery are all done on your instruction, either in the run-up to a contract or in performing one, which is Article 6(1)(b). Retaining invoices and job records for as long as HMRC requires is a legal obligation, Article 6(1)(c). Legitimate interest, Article 6(1)(f), accounts for the remainder: an engineer recording how an unusual fault behaved so the next one goes better. That note describes hardware, not the person who owned it.
Nothing here rests on consent for marketing, because no marketing is sent. A completed form buys an answer to the question asked and nothing more. There is no newsletter and no list quietly filling up with names.
Reception opens the parcel, records what is in it against a job number, and passes the media through to the laboratory. After that only the engineers working on the job handle it. Nothing is sub-contracted, nothing is sent on to a second laboratory, and nothing leaves the building in a bag to be looked at over a weekend. Drives that have to be opened are opened under filtered air on the premises.
Almost every job starts with a sector-level image, and the work that follows is done to that copy rather than to the item you posted. It is why a fragile drive can sit untouched on a shelf while the difficult part happens elsewhere. It is also why the next two sections are necessary, because that image is a complete duplicate of your data.
There are three points in a job where contents have to be visible, and no others: reading the file system, rebuilding directory trees, and proving that what goes home opens. The line is drawn exactly there. A document is opened to check that it is intact rather than to learn what it says. A photograph is viewed as a thumbnail, which shows the image data survived and nothing else. Nothing is copied out for any purpose of ours, nothing is shown outside the laboratory, and nothing is discussed with anyone beyond the engineers on that job and the customer whose name is on it.
Two exceptions exist, and they belong in the main text rather than a footnote. A court order or statutory demand from a UK authority is complied with. Material whose possession is in itself a criminal offence is reported. Every laboratory in the country carries both duties equally.
Investigation work runs on different rules, because examining content and writing it up is the point of the instruction. The scope is set by whoever gave it — a solicitor, an employer, an insurer — and the report goes back to them. A chain-of-custody record runs alongside it, naming who held the media and when. That record exists to be produced and challenged later, which is the whole reason for keeping it. Footage exported from a recorder is treated the same way. If you are the subject of an investigation rather than the party who commissioned it, your rights over the material are exercised through whoever commissioned it.
Destroyed, in that list, means a multi-pass overwrite of whatever storage held the image, or, where a disk is being retired, its platters physically broken up. It does not mean a folder moved to a recycle bin.
On the premises: controlled entry, a second door in front of the recovery area, and media stored away instead of sitting out on a desk overnight. No third party sees any of it at any stage. On the systems: encrypted working storage, recovered files returned on encrypted media with the passphrase travelling by a different route, and access to a job's storage limited to the engineers assigned to it. This website holds no customer database at all, since one is never built — a form hands its contents to mail and keeps nothing back.
Nobody can honestly promise that traffic crossing the internet is impossible to intercept, and no such promise appears here. The narrower and more useful point is this: the forms carry contact details only, never the data being recovered, and recovered data travels home as a physical object on encrypted media rather than down a wire.
Calls to the freephone line are not recorded. What an engineer notes during one is the same handful of facts a form would have collected, filed against the job so the next person to pick up is not starting from nothing. The chat window in the corner is Olark's. Whatever you type into it is treated exactly as an email would be.
A web server has to write down an IP address, a time, the page requested and the browser string in order to deliver a page at all and to spot abuse. Those logs rotate off on a short cycle. Google Fonts keeps a comparable record while it serves typefaces. On cookies: none here advertises, follows you between sites or feeds an analytics package. The one you are most likely to meet belongs to the Olark chat window, and its job is to remember a conversation already in progress so you do not have to start again. Decline it and nothing about the site changes.
Work, media and job records never leave the United Kingdom. The two third-party scripts named above are the exception, since Olark and Google Fonts are both served from abroad, so loading a page here does send a request overseas, under whatever transfer safeguards those suppliers publish. Neither is compulsory. Use the freephone line instead of the chat window, and tell your browser to refuse third-party font requests: the site will then render in a system typeface and behave exactly as before in every other way.
UK GDPR gives you a set of rights over personal information held about you. Every one of them is honoured here, without argument:
Name the one you are after on 0800 689 0668 or in an email to support@oxford-datarecovery.co.uk. You may be asked to prove who you are before anything is sent out, and the reason for that is simply that information must not end up with the wrong person.
Come to us first, on the telephone or on paper, and the point will be looked at properly. Where that still leaves you dissatisfied, the Information Commissioner's Office is the supervisory authority for the United Kingdom, and it will take a complaint through ico.org.uk or on its helpline. Doing so is free, and it alters nothing about the way a recovery of yours is handled.
This is a service bought by adults. None of it is aimed at children and no age information is collected anywhere. Where a device belongs to a child, everything is handled with the parent or guardian who asked for the recovery.
The date in the opening paragraph tells you which version this is. A change that materially alters how information is handled is written into this page. Where such a change affects a job already under way, the customer is told directly rather than left to notice an edit on a website.
Freephone 0800 689 0668, Mon–Fri 9:00am–5:30pm. Email support@oxford-datarecovery.co.uk. Post to Oxford Data Recovery, John Eccles House, Oxford Science Park, Robert Robinson Avenue, Littlemore, Oxford OX4 4GP. Commercial terms are in the terms and conditions (PDF), and the contact page explains how to get a device here undamaged.