Privacy Policy 

1. Introduction

Welcome to Studio Two.

We are committed to protecting your privacy and handling your personal information responsibly, securely and transparently. This Privacy Policy explains how we collect, use, store and protect your personal data when you visit our website, contact us or use our services.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and all other applicable UK data protection legislation.

2. Who We Are

Studio Two is a UK-based web design and digital agency specialising in website design, website development, branding, hosting, website maintenance and digital solutions for sole traders and small to medium-sized businesses.

Contact: Lewis Heywood, lewis@studiotwodigital.co.uk. Luke Cattigan, luke@studiotwodigital.co.uk. Website: https://studiotwodigital.co.uk

3. Information We Collect

We may collect information including names, business names, email addresses, telephone numbers, postal addresses, project requirements, website details, documents you provide, communication history, quotations and invoices.

When you send an enquiry through the form on this website, we collect your name, your business name, your email address, your phone number if you give one, the services you are interested in and whatever you write in the message box. That enquiry is stored in our own customer relationship management system, which runs on our own infrastructure at crm.studiotwodigital.co.uk, and a copy is emailed to us so we see it straight away. We use those details to reply to you, by email or by phone, and to prepare a quote.

We may also automatically collect IP addresses, browser information, device information, pages visited, dates and times of visits, referring websites and cookie/analytics information.

4. How We Use Your Information

We use personal information to respond to enquiries by email or by telephone, prepare quotations, deliver services, manage projects, provide support, process invoices, improve our services, maintain website security, comply with legal obligations and send marketing communications where permitted by law.

5. Lawful Basis

Depending on the circumstances, we rely on performance of a contract, legitimate interests, legal obligations or consent. Where legitimate interests are relied upon, we carefully balance our interests against your rights.

6. Marketing

We may contact businesses where our services may be relevant. You may object or unsubscribe at any time by replying "unsubscribe" or contacting us directly. We will action requests promptly.

7. Cookies

Our website may use cookies to improve performance, remember preferences, analyse visitor behaviour and enhance user experience. Non-essential cookies will only be used where required by law following consent. Please see our Cookie Policy for further details.

8. Sharing Information

We only share personal information where necessary with trusted providers such as Cloudflare, Google Workspace, hosting providers, domain registrars, payment providers, analytics providers, CRM providers and professional advisers. We never sell, rent or trade personal information.

9. Data Controller & Processor

When you contact Studio Two directly, Studio Two acts as the Data Controller.

When we design, develop, host or maintain websites or digital systems for clients, we may process personal data solely on the client's documented instructions. In these situations Studio Two acts as the Data Processor and our client remains the Data Controller.

10. Client Website & Data

Any personal data stored within a client's website, CRM or digital platform always remains the property of the client. Studio Two accesses such information only where reasonably necessary to build, maintain, support, troubleshoot or secure the services we provide.

Upon termination of our services, and subject to legal or contractual obligations, we will cooperate with clients to return or securely delete personal data under our control where requested.

11. CRM Security

Studio Two uses a secure CRM to manage enquiries, prospects and client relationships. It is our own system rather than a third-party product, it runs on Cloudflare infrastructure, and it is reachable only by Lewis and Luke. Access is restricted to authorised personnel only. Appropriate technical and organisational measures are implemented to protect confidentiality, integrity and availability of data.

12. International Transfers

Where service providers process information outside the UK, appropriate safeguards are implemented in accordance with UK GDPR.

13. Security

We use HTTPS encryption, access controls, secure cloud infrastructure, strong authentication, software updates and ongoing security monitoring. While we take reasonable precautions, no online service can guarantee absolute security.

14. Data Retention

We retain personal information only for as long as necessary to provide services, comply with legal obligations, maintain records, resolve disputes and enforce agreements. Data is securely deleted or anonymised when no longer required.

In practice that means client records are kept for at least 6 years after the final invoice, which is the period HMRC requires us to keep business records for. Business enquiries are kept on our CRM for as long as there may be a reason to work together, which may be indefinitely, so that we have the history if you come back to us. You can ask us at any time to delete your details, and we will do so unless we are legally required to keep them.

15. The Game In Our Footer

There is a small game at the bottom of our website. You can play it without giving us anything at all. Your best score is remembered in your own browser, on your own device, using local storage rather than a cookie. It is never sent to us and we cannot see it.

If you beat a score on the leaderboard you may choose to put a name to it. We ask for a first name only, and you are welcome to use any name you like. If you submit one, we store that name and that score on our own infrastructure at crm.studiotwodigital.co.uk, and we publish both on the leaderboard where anyone can see them. We do not store your email address, your IP address or anything else alongside it, and we do not use any of it to contact you or to work out who you are.

Submitting a name is entirely optional, so we rely on your consent. If you want a name and score taken down, email us and we will remove it. We also remove anything we consider offensive or impersonating, without being asked.

16. Your Rights

You have the right to access, rectify, erase, restrict, object to processing, request portability and withdraw consent where applicable. Contact us using the details above to exercise your rights.

17. Complaints

If you have concerns, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk.

18. Third-Party Websites

Our website may contain links to external websites. We are not responsible for their privacy practices and encourage you to review their policies.

19. Changes

We may update this Privacy Policy from time to time. The latest version will always be published on our website.

20. Contact Us

Studio Two

Lewis Heywood, lewis@studiotwodigital.co.uk

Luke Cattigan, luke@studiotwodigital.co.uk

https://studiotwodigital.co.uk