Privacy Policy.

The Code Studio ("we", "us", or "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website, use our services, or otherwise interact with us.

We are registered in Scotland and operate from Glasgow, United Kingdom. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, The Code Studio is the data controller responsible for your personal data.

Please read this Privacy Policy carefully. By accessing or using our website and services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy.

We may collect and process the following categories of personal data:

Identity Data

This includes your first name, last name, company name, job title, and any other identifiers you provide when contacting us or using our services.

Contact Data

Your email address, telephone number, postal address, and any other contact details you provide.

Technical Data

Information automatically collected when you visit our website, including your IP address, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, device information, and other technology on the devices you use to access our website.

Usage Data

Information about how you use our website, including pages visited, time spent on pages, page interaction information (such as scrolling, clicks, and mouse-overs), and navigation paths.

Communications Data

Records of correspondence when you contact us, including emails, contact form submissions, and project briefs.

Project Data

Information relating to projects we undertake for you, including project requirements, specifications, feedback, and any other information you provide during the course of our engagement.

We collect personal data through the following methods:

• Direct interactions: When you fill in forms on our website, send us correspondence, subscribe to our newsletter, request services, or otherwise engage with us directly.
• Automated technologies: As you navigate our website, we may automatically collect Technical Data through cookies, server logs, and similar technologies. Please see our Cookie Policy for further details.
• Third parties: We may receive personal data about you from various third parties, including analytics providers (such as Google Analytics), advertising networks, and search information providers.

We will only process your personal data where we have a lawful basis to do so. The lawful bases we rely on include:

Consent

Where you have given clear consent for us to process your personal data for a specific purpose, such as receiving marketing communications.

Contract

Where processing is necessary for the performance of a contract we have with you, or to take steps at your request before entering into such a contract.

Legitimate Interests

Where processing is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. Our legitimate interests include operating our business, providing and improving our services, and communicating with clients and prospects.

Legal Obligation

Where processing is necessary for compliance with a legal obligation to which we are subject, such as tax and accounting requirements.

We use your personal data for the following purposes:

• To provide and deliver our web development, design, and digital services
• To respond to your enquiries and provide customer support
• To send you project updates, invoices, and service-related communications
• To send you marketing communications (where you have opted in)
• To improve our website, services, and user experience
• To analyse website usage and trends
• To detect, prevent, and address technical issues or security breaches
• To comply with legal obligations and protect our legal rights
• To administer and protect our business and website

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose.

We may share your personal data with the following categories of recipients:

Service Providers

Third-party service providers who perform services on our behalf, such as hosting providers, email service providers, analytics providers, and payment processors. These providers are contractually obligated to protect your data and use it only for the purposes we specify.

Professional Advisers

Lawyers, accountants, auditors, and insurers who provide consultancy, banking, legal, insurance, and accounting services.

Regulatory Authorities

HMRC, regulators, and other authorities who require reporting of processing activities in certain circumstances.

Business Transfers

If we sell, merge, or transfer any part of our business, we may share your data with prospective purchasers or new owners.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes.

We primarily store and process your data within the United Kingdom and European Economic Area (EEA). However, some of our service providers may be located outside the UK or EEA.

Whenever we transfer your personal data outside the UK or EEA, we ensure a similar degree of protection is afforded to it by implementing at least one of the following safeguards:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data
• Where we use service providers in the US, we may transfer data to them if they participate in certified data transfer frameworks
• We use specific contracts approved for use in the UK (UK International Data Transfer Agreement or UK Addendum to the EU SCCs)

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process your personal data, whether we can achieve those purposes through other means, and applicable legal requirements.

In general:

• Client project data: Retained for 7 years after project completion for legal and warranty purposes
• Contact form enquiries: Retained for 2 years unless converted to a client relationship
• Marketing data: Retained until you unsubscribe or withdraw consent
• Website analytics data: Retained for 26 months

Under UK data protection laws, you have certain rights in relation to your personal data. These rights include:

Right of Access

You have the right to request a copy of the personal data we hold about you (commonly known as a "subject access request").

Right to Rectification

You have the right to request correction of any inaccurate or incomplete personal data we hold about you.

Right to Erasure

You have the right to request deletion of your personal data in certain circumstances (also known as the "right to be forgotten").

Right to Restrict Processing

You have the right to request that we suspend the processing of your personal data in certain scenarios.

Right to Data Portability

You have the right to request the transfer of your personal data to you or to a third party in a structured, commonly used, machine-readable format.

Right to Object

You have the right to object to processing of your personal data where we are relying on legitimate interests, or where we are processing your data for direct marketing purposes.

Right to Withdraw Consent

Where we are relying on consent to process your personal data, you have the right to withdraw that consent at any time.

To exercise any of these rights, please contact us using the details provided below. We will respond to your request within one month of receiving it. We may need to verify your identity before processing your request.

You also have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (ico.org.uk). However, we would appreciate the opportunity to address your concerns before you approach the ICO, so please contact us in the first instance.

We have implemented appropriate technical and organisational security measures to protect your personal data against accidental loss, unauthorised access, alteration, disclosure, or destruction.

These measures include:

• Encryption of data in transit using TLS/SSL
• Secure hosting with reputable providers
• Regular security assessments and updates
• Access controls limiting who can access personal data
• Staff training on data protection and security
• Secure disposal of data when no longer needed

While we take all reasonable precautions, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee the absolute security of your data.

Our website uses cookies and similar tracking technologies to distinguish you from other users. This helps us provide you with a good experience when you browse our website and allows us to improve our site.

For detailed information about the cookies we use and the purposes for which we use them, please see our Cookie Policy.

Our website may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you.

We do not control these third-party websites and are not responsible for their privacy policies or practices. We encourage you to read the privacy policy of every website you visit.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes, we will update the "Last updated" date at the top of this policy.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of our website and services after any changes constitutes your acceptance of the updated policy.

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or have any concerns about how we handle your personal data, please contact us:

You have the right to make a complaint to the Information Commissioner's Office (ICO) if you are concerned about how we handle your personal data: