Privacy Notice

Who we are and contact details

This website is operated by No-Tea Studio (trading name). We are the data controller for personal information collected through this website.

If you have questions about how we handle your data or wish to exercise your rights, please contact us at:

Email: info@noteastudio.co.uk
Location: Leeds, West Yorkshire, United Kingdom
Jurisdiction: United Kingdom

If you need to reach us by post or require our full business address for legal purposes, please email us at info@noteastudio.co.uk.

What personal data we collect

When you contact us, request a website design quote or apply for a free website, we collect:

Information you provide: Email address, name (if provided in message), subject line, and message content
Free website applications: Your name, email address, business or group name, town or city, type and size of business, any website or social media links you share, what you would like a website to help with, your descriptions of your business, and your confirmations about eligibility, portfolio use and a testimonial request
Technical information: IP address, browser type, device type, and approximate location (from your ISP)
Interaction data: Which pages you visit, how long you spend on the site, and links you click

We do not intentionally collect sensitive personal data (such as health information, criminal records, or ethnic origin). Please do not include such information in your messages.

How we use your information

We use the personal data you provide for the following purposes:

To respond to your enquiry: Answer your questions about our services
To assess free website applications: Decide whether we can offer a free website, and reply to every applicant
To feature your website: If you are chosen and agree, show the finished website in our portfolio and ask you for a short testimonial
To prepare quotes: Understand your website project requirements and provide an accurate estimate
To provide services: If you become a customer, we use your information to deliver the website design service you've requested
To fulfil legal obligations: Keep records for tax, accounting, and contract purposes (as required by UK law)
To protect our interests: Detect and prevent fraud, abuse, or security incidents

We will not use your personal data for marketing purposes without your explicit consent. We do not sell your personal information to third parties.

Legal basis for processing

Under GDPR and UK data protection law, we process your personal data on the following legal bases:

Legitimate interest (Article 6(1)(f)): To respond to enquiries, manage our business, and protect against fraud
Contract performance (Article 6(1)(b)): To fulfil a website design service you've requested or are considering, including steps you ask us to take (such as assessing a free website application) before a contract is agreed
Legal obligation (Article 6(1)(c)): To comply with UK tax, accounting, and employment law
Consent (Article 6(1)(a)): For any marketing communications (only if you explicitly opt in), and for featuring your website or testimonial in our portfolio (which you can withdraw at any time)

When processing is based on legitimate interest, we balance your privacy rights against our business need to respond to enquiries and deliver services.

How long we keep your data

We retain personal data only as long as necessary for the purposes described above:

Website enquiries, quotes and free website applications: We retain enquiry data for 12 months after your last contact, or until the matter is resolved, whichever is longer
Customer service records: If you become a customer, we keep records for the duration of our engagement plus 6 years (as required by UK tax law)
Legal disputes: If a dispute arises, we retain data for as long as the dispute is unresolved and any statutory limitation period has expired
Marketing consent records: We retain records of your consent preferences indefinitely (to respect opt-out requests)

After the retention period expires, we delete or anonymise your data securely.

We only share your personal data with trusted third parties where necessary:

Formspree (form processor): Your form submission data (for example email, subject, message, or your free website application answers) is transmitted to Formspree to deliver messages to us. View Formspree's privacy policy
Google Fonts: When our website loads, font files are retrieved from Google Fonts, which may receive your IP address. View Google's privacy policy
Email service providers: If you become a customer and we provide email setup, your email data is hosted with our email provider
Accountants and legal advisors: We may share necessary business records with our accountants and solicitors to meet legal obligations
Law enforcement: We will disclose data if legally required to do so by court order or other legal process

We do not transfer data outside the UK or EEA except where necessary and only with appropriate safeguards (such as Standard Contractual Clauses). We do not use automated decision-making or profiling.

Cookies and tracking

Our site does not intentionally set cookies. However:

Technical cookies: Your browser may store basic session information to improve performance
Browser storage on your device: We save your colour and light or dark mode choice, whether you have seen the welcome hint, and your cookie choice in your browser's local storage so the site remembers them. This stays on your device and is not sent to us
Third-party cookies: Google Fonts and form processors may set cookies; see their privacy policies
Analytics: We do not use Google Analytics, Hotjar, or similar tracking tools. We do not profile or track user behaviour

You can control cookies through your browser settings. Disabling cookies may affect website functionality.

Your data protection rights

Under GDPR and the UK Data Protection Act 2018, you have the following rights:

Right of access: Request a copy of the personal data we hold about you
Right to rectification: Ask us to correct inaccurate or incomplete data
Right to erasure ("right to be forgotten"): Request deletion of your data in certain circumstances (e.g., if it's no longer needed)
Right to restrict processing: Ask us to limit how we use your data while you investigate a concern
Right to data portability: Request your data in a portable, machine-readable format
Right to object: Object to processing based on legitimate interest, and opt out of marketing communications
Rights related to automated decision-making: You have the right not to be subject to decisions based solely on automated processing (we don't do this)
Right to withdraw consent: If we process data based on your consent, you can withdraw it at any time

To exercise any of these rights, contact us at info@noteastudio.co.uk. We will respond to your request within 30 days (or up to 90 days in complex cases).

Data security

We take data security seriously and use industry-standard measures to protect your information:

HTTPS encryption for all website communications
Secure handling of form submissions (via Formspree's secure service)
Restricted access to personal data (only team members who need it can access it)
Regular security reviews and updates

While we implement security measures, no system is 100% secure. If a data breach occurs, we will notify affected individuals and relevant authorities without undue delay (as required by law).

Children's privacy

Our website is not directed at children under 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected data from a child under 13, we will delete it immediately and contact the child's parent or guardian. If you believe we have collected data from a child under 13, please contact us at info@noteastudio.co.uk.

International data transfers

We are based in the United Kingdom. If you are located outside the UK/EEA, please be aware that your data may be transferred to and processed in the UK. By using our website and submitting data, you consent to such transfers. We ensure that any transfers are protected by appropriate safeguards (such as Standard Contractual Clauses) and comply with data protection law.

Complaints and regulatory contact

If you believe we have mishandled your data or breached data protection law, you have the right to lodge a complaint with your national data protection authority:

UK: Information Commissioner's Office (ICO)
EU/EEA: Contact your national Data Protection Authority (list available at EDPB website)

We encourage you to contact us first at info@noteastudio.co.uk so we can address your concerns directly.

Changes to this privacy notice

We may update this privacy notice if our practices, services, or legal obligations change. When we make material changes, we will update the "Last updated" date at the top of this page. If we make significant changes that affect your rights, we will notify you by email or prominent notice on our website. Your continued use of the website after such changes constitutes your acceptance of the updated privacy notice.

Third-party websites

Our website may link to third-party websites (such as Formspree, Google Fonts, or your hosting provider). We are not responsible for their privacy practices. Please review their privacy policies before submitting data to them.

Contact us

If you have questions about this privacy notice or how we handle your data, please get in touch:

Email: info@noteastudio.co.uk
Response time: We aim to respond to all data protection enquiries within 5 business days