Privacy policy
This notice explains what personal information Subtle Standard handles, why it is used, the choices available to you and how to raise a concern.
Who controls your information
Luke McInery, a sole trader trading as Subtle Standard, is the data controller for personal information handled for the studio's own business purposes. Subtle Standard is not a registered company or separate legal entity. It is a digital design studio based in Ascot, Berkshire, England. References to “Subtle Standard”, “we”, “us” and “our” in this notice mean Luke McInery carrying on business under the Subtle Standard name.
You can contact Luke McInery trading as Subtle Standard quickly by email at hello@subtlestandard.com. Luke McInery's name and a UK postal address at which documents relating to the business can be served are stated on every proposal, contract, invoice and business letter, and are given in writing straight away to anyone dealing with the business who asks at legal@subtlestandard.com.
Privacy questions, rights requests and data protection complaints can be sent electronically to legal@subtlestandard.com. Please use the subject line “Data protection”.
Where we process personal information solely on a client's documented instructions—for example, while maintaining a client system—the client will normally be the controller and we will act as its processor. The relevant client privacy notice and a written data-processing agreement will govern that activity.
Who and what this notice covers
This notice covers personal information relating to:
- visitors to subtlestandard.com;
- people who contact the studio or request a proposal;
- prospective, current and former clients and their personnel;
- suppliers, professional advisers, collaborators and their personnel; and
- business contacts with whom we communicate lawfully.
It covers the website, website chat, email enquiries, project administration, service delivery, hosting or support administration where agreed, billing, legal compliance and related business records. A client-specific contract or privacy notice may provide additional information for a particular service.
Information we may collect
Identity and contact details
Name, role, organisation, postal address, email address, telephone number and communication preferences where provided.
Enquiry and project information
Website chat messages, project descriptions, briefs, budgets, timing, requirements, decisions, approvals, correspondence, meeting notes and files supplied for the work.
Contract and financial records
Proposal and contract records, invoicing information, payment status, transaction references and information needed for tax or accounting. We do not currently collect card details through this website.
Service and support information
Authorised account contacts, support requests, issue history, system access records and technical information needed to provide an agreed service.
Website and security information
IP address, request time, requested URL, referrer, browser or device information, response status and security events that may appear in ordinary server, proxy or security logs.
Rights and complaint records
Your request or complaint, relevant correspondence, evidence of identity or authority where reasonably needed, the enquiries made and the outcome.
Please do not provide special-category information—such as health, biometric, political, religious or trade-union information—or criminal-offence information unless it is genuinely necessary and we have agreed a lawful and secure way to receive it.
Where information comes from
Most information is received directly from you when you email, enquire, meet with us, enter into an agreement or use an agreed service. We may also receive relevant information from:
- your employer, organisation, authorised representative or project colleague;
- a client, supplier, collaborator or professional adviser involved in the same project;
- public professional or business sources, such as an organisation's website or a professional directory, where it is reasonable and lawful to use the information; and
- hosting, security and technical systems that create routine service logs.
If we obtain personal information from another source and the law requires us to notify you, we will provide the relevant privacy information within one month and, where an earlier point applies, by the first communication or before disclosure.
Why we use information and our lawful bases
We only use personal information where a lawful basis applies. More than one basis may apply to the same information where the purposes are different.
| Purpose | Information normally involved | Lawful basis |
|---|---|---|
| Responding to enquiries, discussing requirements and preparing a proposal | Identity, contact, organisation and project information | Steps requested before a contract; legitimate interests in responding to business enquiries and developing the studio |
| Entering into, administering and delivering an agreed service | Contact, contract, project, account and service information | Performance of a contract; legitimate interests where the contract is with your organisation rather than you personally |
| Hosting, maintenance, support, service security and troubleshooting where contracted | Authorised contacts, support material, access and technical logs | Contract; legitimate interests in providing, securing and documenting the service; legal obligations where applicable |
| Invoicing, accounting, tax, fraud prevention and debt administration | Identity, contact, contract, transaction and payment-status records | Legal obligation; contract; legitimate interests in receiving payment and preventing misuse |
| Operating, protecting and improving the website and business systems | Technical, security and limited usage information | Legitimate interests in security, reliability and proportionate improvement; consent where required for non-exempt browser technologies |
| Managing suppliers, advisers and collaborators | Contact, contract, due-diligence and payment records | Contract; legitimate interests in operating and protecting the business; legal obligation |
| Sending relevant business communications or direct marketing where lawful | Business contact details, relationship and preferences | Consent where required; otherwise legitimate interests in proportionate business development, subject to the right to object and PECR |
| Complying with law, resolving disputes and establishing, exercising or defending legal claims | Information relevant to the obligation, complaint or claim | Legal obligation; legitimate interests in protecting legal rights; special legal-claims conditions where relevant |
Our legitimate interests include responding to prospective clients, delivering and improving services, protecting systems, maintaining appropriate records, receiving payment, managing suppliers and defending legal rights. We assess necessity, proportionality and the effect on individuals before relying on those interests.
Website enquiries, chat and email
When you submit the website enquiry form, the name, email address, selected service and project description you provide are sent over HTTPS to the website server. The server validates the submission and uses Resend, an email-delivery service operated by Plus Five Five, Inc., to deliver it to the studio inbox. After that copy is accepted, Resend also sends a one-off transactional acknowledgement to the email address you supplied. The acknowledgement contains your name, selected service and enquiry reference, but not the project description. The website does not create a separate enquiry database, and no automatic marketing subscription is created.
You are not legally required to make an enquiry. If you want a proposal, we need enough contact and project information to understand and answer the request. If you do not provide it, we may be unable to respond, quote or enter into a contract. Please use an email address you control or are authorised to use, and do not include passwords, unnecessary sensitive information or material you are not authorised to share. Resend and the relevant mailbox providers receive the information and delivery metadata needed to transmit the enquiry and acknowledgement. Resend states that standard email data is retained for 30 days. The copy received in the studio inbox is then kept according to the enquiry retention period below.
If you start the website chat, the name, email address and messages you provide are stored in a first-party conversation database within the website hosting environment. The browser receives a secure session token so it can reopen only its own conversation. Luke can read and respond through a private, password-protected inbox. Resend may send Luke a new-message alert and may send you a transactional copy of Luke's reply if the chat has not recently been open. Chat messages are not used to train or operate a chatbot, and starting a chat does not create a marketing subscription.
International transfers
Resend states that customer data, including email metadata, logs, API records and message content, is stored in the United States. Resend's published data-processing addendum incorporates the UK Addendum to the approved Standard Contractual Clauses for restricted transfers and also records its participation in the UK Extension to the EU–US Data Privacy Framework. We will keep the applicable transfer mechanism, provider terms and transfer-risk assessment under review.
Other service providers or project tools may also process information outside the United Kingdom. Before making a restricted transfer, we will assess the destination, recipient and purpose and use a lawful mechanism. You can ask for information about safeguards relevant to your information by emailing us.
How long information is kept
We keep information only for a defined period or according to documented criteria, then delete, anonymise or securely archive it unless law or a live dispute requires longer retention. The intended schedule is:
| Record | Normal retention |
|---|---|
| Website chats, enquiries and proposals that do not proceed | Up to 18 months after the last meaningful communication |
| Client contracts, project records and material correspondence | Normally six years after the relationship or relevant contract ends |
| Invoices, payments and tax or accounting records | Normally six years after the relevant accounting period, or longer where law requires |
| Support requests and service-administration records | Up to 24 months after closure, unless needed with the main contract record |
| Routine website and security logs | Normally up to 90 days; relevant extracts may be retained longer for an incident or claim |
| Marketing preferences and suppression records | Until consent is withdrawn or an objection is made; a minimal suppression record may then be kept to honour the choice |
| Rights requests and data protection complaints | Normally three years after closure, unless a longer period is reasonably needed for a claim or legal obligation |
| Cookie or storage-notice preference | Up to 183 days on the device, unless reset sooner |
| Chat greeting preference and secure chat session cookie | The greeting preference is used for 7 days, with its timestamp removed when next checked after expiry. The chat session cookie lasts up to 90 days. Either can be deleted sooner. |
These periods must be reflected in day-to-day systems. A record may be retained for longer where litigation is reasonably anticipated, a legal hold applies, a regulator requires it, or deletion would conflict with another legal duty.
Security and incidents
We use proportionate technical and organisational measures intended to protect personal information against accidental or unlawful loss, alteration, disclosure, access or destruction. Measures may include access controls, least-privilege access, authentication, supported software, secure transfer, backups where contracted, confidentiality duties and provider due diligence.
No internet or storage system can be guaranteed completely secure. We assess suspected personal-data incidents and will notify affected people and the Information Commissioner's Office where the law requires it. Please report a suspected privacy or security issue promptly to legal@subtlestandard.com.
Your data protection rights
Depending on the circumstances and lawful basis, you may have the right to:
- ask whether we use your personal information and receive a copy;
- correct inaccurate or incomplete information;
- ask for erasure of information in qualifying circumstances;
- restrict how information is used in qualifying circumstances;
- receive information you supplied in a structured, commonly used and machine-readable format, or ask us to transfer it, where portability applies;
- object to processing based on legitimate interests and object at any time to direct marketing;
- withdraw consent at any time, without affecting processing carried out before withdrawal; and
- challenge a qualifying decision made solely by automated processing.
Rights are not absolute and exemptions may apply. Send a request to the privacy email above. We may ask for information reasonably needed to confirm identity, clarify the request or verify authority to act for another person. We normally respond within one month, subject to any lawful extension. There is normally no fee, although the law permits a reasonable fee or refusal in limited circumstances.
Your right to object
You can object to direct marketing at any time
If personal information is used for direct marketing, your objection is absolute. We will stop the marketing and may retain only the minimum suppression information needed to make sure the objection is respected.
You may also object where processing relies on legitimate interests. Tell us the reasons relating to your situation. We will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the information is needed for legal claims.
Data protection complaints and the ICO
You can raise a data protection complaint electronically by emailing legal@subtlestandard.com with the subject “Data protection complaint”. Explain what happened, the information involved, the outcome you want and any relevant dates. Do not send unrelated identity documents unless requested.
You can also write to us at hello@subtlestandard.com or raise a concern through another contact channel. You do not have to use a particular subject line, form or legal wording for us to recognise and handle a data protection complaint.
We will acknowledge a data protection complaint within 30 days of receipt. We may provide the substantive outcome at the same time. Without undue delay, we will make appropriate enquiries, keep you informed where the investigation is ongoing and explain the outcome. If someone complains for you, we may require evidence that they are authorised to act.
You also have the right to complain to the UK Information Commissioner's Office. You can use the ICO's online complaint service, call 0303 123 1113, or write to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would appreciate the opportunity to address the issue first, but this does not restrict your right to approach the ICO or a court.
Children, automated decisions, links and changes
Children
The website and services are intended for business and professional audiences and are not directed to children. We do not knowingly seek personal information from children through the website. A parent or guardian who believes a child has provided information should contact us.
Automated decision-making
We do not currently make decisions about people using solely automated processing that produces legal or similarly significant effects, and the current site does not profile visitors for advertising.
External websites
Links to third-party websites do not make us responsible for their privacy practices. Review the notice provided by the relevant operator before giving it information.
Changes to this notice
We review this notice when services, providers, legal requirements or processing activities change. The version and date above identify this notice. If a material new use is proposed, we will provide information before it begins where required and seek fresh consent where consent is the lawful basis.