1
Who we are
The GDPR Studio Ltd is the controller of personal data collected through this website and in connection with our business and services, except where we process client-provided personal data solely on a client’s documented instructions.
Registered office:
Suite A, 82 James Carter Road, Mildenhall, IP28 7DE
Company number: 13546270
Email: letstalk@thegdprstudio.co.uk
We have not appointed a Data Protection Officer.
For privacy questions or data rights requests, email letstalk@thegdprstudio.co.uk and use the subject line Privacy Request.
2
Personal data we collect
We only collect personal data that is relevant to our business, services, recruitment, associate relationships and communications with you.
Information you provide directly
Name, email address and telephone number.
Business or company name, business address, job title or role.
Information included in an enquiry, live chat message, booking, application or form.
Booking details, intake-form information, correspondence and service-administration information.
Documents, records and other information you provide so that we can assess or deliver a Clarity service.
Invoice details and payment-status information.
Your communication preferences and any objection or unsubscribe request.
Payments are handled through relevant banking or payment providers. We do not normally receive or store full payment-card details.
Forms, bookings and sensitive information
When you download a resource, join a waitlist, make an enquiry, apply for a service or book a Clarity Call, we may collect the information requested in the relevant form. This includes Clarity Review enquiries and Clarity Sprint applications.
Some fields may be optional. Please only provide information necessary for your enquiry, booking or support request.
Please avoid unnecessary sensitive information.
Do not include special category personal data, such as health information, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data used for identification, sex life or sexual orientation, or criminal offence data unless we have specifically asked for it and it is necessary for the support requested.
Please also avoid including identifiable information about staff, customers, clients or other individuals unless it is necessary and relevant.
If sensitive information is genuinely necessary, we will explain how it will be used and identify the additional legal condition that applies where required.
Information provided during client work
A client may provide personal data about its staff, customers, suppliers or other individuals when asking us to assess a data protection issue or deliver an agreed service. We ask clients to minimise or redact this information wherever possible.
This Notice primarily covers personal data for which The GDPR Studio acts as controller. Where we process personal data solely on a client’s documented instructions, the client remains the controller and separate contractual data-processing terms apply.
Information from other sources
We may receive or collect limited professional contact information from publicly available business sources and reputable business-data providers. Sources may include company websites, Companies House, professional networking platforms, business directories and licensed business-contact databases.
Name and business contact details.
Employer, job title or professional role.
Publicly available information about the organisation, including its sector, location and approximate size.
The source of the information and relevant outreach or suppression history.
We use this information only where we reasonably believe our business services may be relevant. If we contact you, we will identify ourselves and provide a clear way to object or unsubscribe.
Where privacy information is required because we obtained your data indirectly, we provide it within the applicable period and, where we contact you, no later than our first communication. You can ask us for the specific source of your details.
Associate applications and working relationships
If you apply to work with us or provide services as a freelance associate or specialist, we may collect and use information needed to assess your application, complete onboarding, manage assignments and administer the working relationship.
Contact details, CV, employment and consultancy history, qualifications, professional memberships, availability and location.
Application correspondence, interview notes, assessment information and references where obtained.
Identity and right-to-work information, including check results, dates, relevant restrictions and expiry dates where applicable.
Contract, business-status, insurance, VAT, invoice, payment and bank-account information.
Assignment offers and acceptances, client allocations, availability, communications, work records, progress updates and deliverables.
Quality-review records, revisions, feedback, conflicts, complaints, incidents and information relevant to professional performance or conduct.
Account, system-access, security and training or policy-acknowledgement records.
Please do not provide unnecessary sensitive information in an application or CV. We only use special category or criminal offence information where it is necessary, proportionate and permitted by law.
Information collected automatically
Our website hosting, security and technical systems may collect limited technical information when you visit the website.
IP address, browser type and device type.
Operating system, pages requested and date or time of access.
Technical security, error-log and troubleshooting information.
We use this information for website operation, security, troubleshooting and preventing misuse.
Website analytics
We use privacy-friendly, cookieless website analytics to understand aggregated website usage, such as which pages are visited and how people find the website.
This analytics does not use cookies or track you across websites.
3
How and why we use your data
UK data protection law requires us to have a lawful basis for using personal data. The main ways we use information are set out below.
Responding to enquiries and live chat messages
We use your name, email address, chat messages, enquiry content and correspondence to respond to questions and manage communications with you.
Lawful basis: Legitimate interests in running our business, responding to enquiries and providing useful support; or steps requested before entering into a contract where the enquiry relates to a proposed service.
Providing requested resources
We use your name, email address and resource-download details to send the checklist, guide, resource or information you requested.
Lawful basis: Consent or legitimate interests, depending on how the resource is requested and delivered.
Managing bookings and paid services
We use contact details, business details, booking information, intake information, correspondence, documents, invoice details and payment status to arrange, assess and deliver Clarity Calls, Clarity Reviews, Clarity Sprints and other agreed support.
Lawful basis: Contract, where processing is necessary to take steps at your request before entering into a contract or to provide an agreed service; legitimate interests in administering and improving our services; and legal obligation where applicable.
Contact, intake and service information is normally necessary for us to assess your request, enter into the engagement and deliver the agreed work. If you do not provide necessary information, we may be unable to accept, arrange or complete the service.
Working with freelance associates and specialists
We use applicant and associate information to assess suitability, verify identity, qualifications, professional standing, insurance and right to work where required, enter into and administer contracts, offer and allocate assignments, provide system access, manage delivery and quality, make payments, handle conflicts, complaints or incidents and protect our clients, systems and legal position.
Lawful basis: Steps requested before entering into a contract; performance of a contract; legal obligations, including applicable right-to-work, tax and accounting requirements; and legitimate interests in selecting and managing suitable consultants, maintaining service quality, protecting clients and systems and establishing, exercising or defending legal claims. Where special category or criminal offence data is used, we also identify an appropriate additional legal condition.
Website operation, security and preventing misuse
We use technical data, logs and relevant account information to operate and protect our website and systems, investigate problems and prevent fraud, misuse or unauthorised access.
Lawful basis: Legitimate interests in maintaining secure and reliable services and, where applicable, legal obligation.
Business administration and legal obligations
We use contact details, correspondence, invoices, payments and service records to manage our business, meet accounting obligations and protect our legal position where needed.
Lawful basis: Legitimate interests and legal obligation.
Automated decision-making
We do not use personal data to make solely automated decisions that have legal or similarly significant effects on you.
4
Business marketing
Where you download a resource or complete a form, we may ask whether you would like to receive occasional GDPR guidance, resources and updates from The GDPR Studio.
Marketing consent is separate from requesting a free resource or making an enquiry. You do not need to agree to marketing to receive a requested checklist, guide or response.
Requested updates and opt-in marketing
Where you actively opt in, we use your contact details and preferences to send the updates you requested. The lawful basis is consent, and you can withdraw that consent at any time.
Relevant business-to-business outreach
We may contact selected people in their professional capacity where we reasonably believe our services are relevant to their organisation. We may use information supplied by reputable business-data providers or obtained from publicly available business sources.
Lawful basis: Legitimate interests in promoting and developing our business, subject to an assessment of necessity, reasonable expectations and the effect on the individual. Where consent is required by the Privacy and Electronic Communications Regulations, we will rely on consent or another permitted route before sending the communication.
We identify The GDPR Studio and explain why we are contacting you.
Every marketing email includes a clear way to unsubscribe.
You can object to direct marketing at any time by replying to the message or emailing letstalk@thegdprstudio.co.uk.
If you object or unsubscribe, we stop the marketing and may retain limited information on a suppression list so that we can respect your request.
We do not sell personal data or provide our marketing lists to other organisations for their own marketing.
5
Cookies and similar technologies
We use cookies and similar technologies to make the website work and to provide optional features, such as live chat.
Some cookies are strictly necessary for the website to function.
Optional cookies support tools such as live chat and will only be used if you choose to allow them.
Cookieless website analytics does not use cookies or track you across websites.
You can manage your cookie preferences through our cookie banner or by selecting the Cookie Policy link on the website.
6
Who we share data with
We may share personal data with trusted service providers where this is necessary to operate our website, manage our business or provide services to you.
Website hosting, website platform and website-maintenance providers.
Microsoft 365, including email, SharePoint and business-administration systems.
Microsoft Bookings and Microsoft Teams for appointments and video meetings.
Zoho Forms, Zoho CRM and Zoho Projects for forms, resource delivery, enquiries, contact management and service administration.
Tidio for live chat functionality.
Smartlead and other business-data, email-verification and outreach platforms used for relevant business-to-business marketing.
Recruitment or professional networking platforms used to receive or manage associate applications.
Registered digital verification providers and the Home Office where required to complete or verify a right-to-work check.
Stripe, Mettle and Payit, or other relevant payment, banking and invoice providers.
Clients, where limited associate identity, professional or contact information is necessary to arrange or manage an assigned engagement.
Freelance associate consultants and specialist subcontractors authorised to work on an enquiry or engagement.
Accountants, legal advisers, insurers or other professional advisers where required.
Regulators, law-enforcement bodies or public authorities where we are legally required to share information.
We do not sell your personal data.
We limit access to what is reasonably necessary. Associate consultants and service providers are subject to appropriate contractual, confidentiality and data-protection requirements. Some providers process data on our behalf. Others, such as payment providers or professional advisers, may act as independent controllers for their own legal and regulatory purposes.
7
International transfers
Some of our service providers may process personal data outside the United Kingdom.
Where this happens, we take appropriate steps to ensure personal data is protected in line with UK data protection law.
UK adequacy regulations.
The UK Extension to the EU–US Data Privacy Framework, where applicable.
The UK International Data Transfer Agreement.
The UK Addendum to the European Commission’s Standard Contractual Clauses.
Other appropriate safeguards permitted by law.
Contact us if you would like more information about safeguards used for a particular provider.
8
How long we keep your data
We keep personal data only for as long as reasonably necessary for the purpose it was collected, including to meet legal, accounting or reporting obligations.
General enquiries and live-chat records: up to 24 months after the last meaningful contact.
Checklist, guide and resource-download records: up to 24 months after collection, unless you remain subscribed to marketing communications.
Business outreach records: normally up to 24 months after collection or the last meaningful contact, unless you object sooner.
Opt-in marketing records: until you unsubscribe, withdraw consent or the information is no longer relevant. We periodically review these records.
Suppression records: limited contact information may be kept for as long as reasonably necessary to ensure that we continue to respect an objection or unsubscribe request.
Booking, service-delivery and client-support records: up to 6 years after the service ends.
Invoices, payment records and accounting records: up to 6 years after the end of the relevant accounting period.
Service enquiries or applications that do not proceed: normally up to 24 months after the final communication.
Unsuccessful associate applications: normally up to 12 months after the recruitment process ends, unless you agree that we may retain the information for longer to consider you for future opportunities.
Successful associate and contractor records: contract, assignment, quality, payment, insurance and related records are normally kept for up to 6 years after the working relationship ends.
Right-to-work check records: for the duration of the working relationship and for 2 years afterwards, after which the check records are securely destroyed unless a different period is required by law.
Website security and technical logs: normally up to 12 months, unless a longer period is needed to investigate or respond to a security issue.
We may retain information for longer where necessary to establish, exercise or defend legal claims, or where the law requires us to do so.
9
How we protect your data
We use proportionate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, disclosure, access or misuse.
Access controls and multi-factor authentication where available.
Controlled access to client records based on role and need.
Confidentiality and data-protection obligations for associates and relevant suppliers.
Appropriate system, device, backup and account-security measures.
Processes for identifying, assessing and responding to suspected personal-data breaches.
No internet-based service can be guaranteed to be completely secure, but we review our measures and working practices as our services develop.
10
Your rights
You have rights over your personal data. Depending on the circumstances, these may include the right to:
request access to your personal data;
ask us to correct inaccurate or incomplete personal data;
request deletion of your personal data;
object to certain processing;
ask us to restrict certain processing;
withdraw consent where we rely on consent;
request data portability in certain circumstances;
ask for human involvement where a solely automated decision has a legal or similarly significant effect on you; and
complain to the Information Commissioner’s Office.
To make a request:
Email letstalk@thegdprstudio.co.uk
Subject line: Privacy Request
We may need to verify your identity before acting on a request. Rights are not absolute and may depend on the circumstances, but we will normally respond within one month.
11
Data protection complaints
If you believe we have not handled your personal data properly or complied with data protection law, you can make a data protection complaint directly to us. You do not need to quote the law or use legal language.
How to make a complaint:
Email: letstalk@thegdprstudio.co.uk
Subject line: Data Protection Complaint
Please explain what has happened, when it happened and what you would like us to do. If possible, include any relevant correspondence or reference numbers. If you are acting for someone else, we may ask for evidence that you are authorised to act for them.
What happens next
We will acknowledge your complaint within 30 days of receiving it. This does not mean that the investigation must be completed within 30 days.
We will take appropriate steps to investigate the complaint without undue delay.
We may ask you for further information or verify your identity or authority where necessary.
We will keep you informed of progress while the investigation is ongoing.
We will tell you the outcome of the complaint without undue delay and explain any action we have taken or propose to take.
Complaining to the ICO
You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator.
ICO telephone: 0303 123 1113
Website: ico.org.uk/make-a-complaint 12
Links to other websites
Our website may contain links to external websites or third-party services.
We are not responsible for the privacy practices, content or security of those websites. Please read their privacy information before providing personal data.
13
Changes to this Privacy Notice
We may update this Privacy Notice from time to time.
Any updated version will be published on this page, and the “Last updated” date will show when this Notice was most recently revised.
