Privacy notice

This notice explains what personal data Toyzie Studio collects through this website, why it is collected, how long it is kept and what you can ask us to do with it. It is written to be read, so it leaves out anything we cannot state plainly.

Who we are

Toyzie Studio is the data controller for the personal data described here. The studio works with clients internationally. For anything in this notice, including a request to exercise your rights, write to hello@toyziestudio.uk.

The studio is small. An enquiry is read by the person who would do the work, not passed through a sales team.

What this notice covers

It covers this website and the correspondence that follows an enquiry. It does not cover the handling of information inside a live client engagement, which is dealt with in the agreement for that engagement, and it does not cover other organisations we link to.

What we collect

The enquiry form is the only place on this site where you are asked for personal data. Depending on what you fill in, it can include:

• your name
• your email address
• your business name and website address, where you give them
• which service or services your enquiry relates to
• what you have written about the situation you want help with
• an indication of your timeline
• an indication of your budget
• how you heard about the studio

We do not ask for special category data, such as health or ethnicity, and you should not send any through the form. Everything else we hold about you comes from what you choose to tell us afterwards, by email or in a conversation.

Separately, our hosting provider keeps standard server logs as part of serving the site securely. Those logs are held under the provider’s own settings and are not used to build a picture of you.

Why we use it, and the lawful basis

• To reply to your enquiry, ask follow-up questions and prepare a proposal. Where you are asking about working together, the lawful basis is that we are taking steps at your request before entering into a contract.
• To run the studio, including keeping a record of enquiries and understanding what people ask for. Here the lawful basis is our legitimate interests in operating a small service business and replying to the people who contact us. Replying to a message you sent us is what you would reasonably expect, and you can object at any time.
• To meet legal obligations, such as keeping accounting records once an enquiry becomes paid work.

We do not use enquiry details for unrelated marketing, and we never sell or rent them. There is no marketing mailing list. If that changes it will be something you opt into, and this notice will be updated first.

How your enquiry reaches us

Enquiries submitted on this site are delivered to the studio by email through a third party email delivery provider, so the content of your message passes through that provider on its way to our inbox. The provider handles the message on our instructions under a contract and does not use it for its own purposes. The email then sits in a standard business email account, like any other message you might send us.

Analytics and cookies

Analytics on this site is optional and privacy aware. It only runs if a provider has been configured for the site, and when none is configured no analytics script is loaded at all. Where analytics is running, it is set up to count pages and actions in aggregate rather than to identify you.

No advertising cookies are set on this site. There is no cross site tracking, no advertising profile is built from your visit, and no visitor data is sold on. If you would like to know exactly what is configured at the time you are reading this, ask us and we will tell you.

Who else sees your data

Only the organisations that help us run the studio, and only for that purpose:

• our website hosting and content delivery provider
• the email delivery provider that carries enquiries to our inbox
• our business email provider
• an analytics provider, where one is configured
• our professional advisers, such as an accountant, where a record is genuinely relevant

We may also disclose information where the law requires it. We do not share personal data with advertising networks or data brokers.

International transfers

Some of the providers above process data in other countries, most often in the European Economic Area or the United States. Where personal data crosses a border we rely on an adequacy decision where one applies, or on standard contractual clauses, alongside the provider’s own safeguards. You can ask us which of these applies to a particular provider.

How long we keep it

• Enquiries that do not lead to work: up to 24 months from your last message, then deleted. Sooner if you ask.
• Enquiries that become client work: kept for the length of the engagement, then held with the records for that engagement. Records connected to a contract or a payment are normally kept for six years, which is a common statutory period for business and accounting records.
• Server logs and analytics: kept for the period set by the relevant provider, in aggregate form where the provider allows it.

Your rights

Under applicable data protection law you have the right to:

• ask what personal data we hold about you, and get a copy of it
• have inaccurate data corrected
• ask us to delete data we no longer need
• ask us to restrict how we use it while a question is resolved
• object to our use of it where we rely on legitimate interests, as we do for enquiry records
• ask for a copy in a portable format, where that right applies
• withdraw consent, where consent is what we relied on

You also have the right not to be subject to a decision made solely by automated means that has a legal or similarly significant effect. We do not make decisions about people that way.

To use any of these rights, email hello@toyziestudio.uk and say what you would like us to do. There is no charge. We will reply within one month, and we will only ask you to confirm your identity where we genuinely cannot tell who is asking.

Keeping it secure

The site is served over an encrypted connection. Access to enquiries is limited to the people who need it to do the work, and the accounts involved are protected with strong authentication. No transmission over the internet can be guaranteed completely secure, so please do not send confidential documents, card details or account credentials through the enquiry form.

Children

This site is aimed at businesses and is not directed at children. We do not knowingly collect personal data from them.

Changes to this notice

We update this notice when the site or the processes behind it change. The date at the top tells you which version you are reading. If a change materially affects how we use information you have already given us, we will tell you directly where we are able to.

Complaints

If something here concerns you, please tell us first at hello@toyziestudio.uk. You also have the right to complain to the data protection supervisory authority in your country. Raising a complaint there does not affect any other right you have.