Privacy Policy
Last updated: January 2025
At Mapletree Studio, we are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, and safeguard your data in compliance with UK GDPR and Data Protection Act 2018.
1. Contact Information
Data Controller: Mapletree Studio
Contact Person: Jacob Haynes
Address: The Old Post Office, Victoria Street, Derby, Derbyshire DE1 1EQ
Email: [email protected]
Phone: 07862 123417
2. Information We Collect
2.1 Information You Provide
- Contact Forms: Name, email address, phone number, location, project details, budget range, timeline preferences
- Email Communications: Any information you include in emails to us
- Phone Calls: Information discussed during consultation calls (with your consent)
2.2 Information Collected Automatically
- Website Analytics: Pages visited, time on site, referral sources, device information (via Google Analytics)
- Technical Data: IP address, browser type, operating system
- Cookies: Essential cookies for website functionality and analytics cookies (see Cookie Policy below)
3. How We Use Your Information
3.1 Legal Basis for Processing
- Legitimate Interest: Responding to enquiries, providing quotes, improving our services
- Contract Performance: Delivering web design services you've contracted
- Consent: Marketing communications (only if you opt-in)
3.2 Specific Uses
- Responding to your enquiries and providing quotes
- Delivering web design and development services
- Processing payments and managing invoices
- Sending project updates and communications
- Improving our website and services
- Sending marketing emails (only with explicit consent)
4. Information Sharing
We do not sell, trade, or rent your personal information. We may share information with:
- Service Providers: Hosting providers (Netlify), email services (Formspree), analytics (Google Analytics)
- Payment Processors: For invoicing and payment processing
- Legal Requirements: If required by law or to protect our rights
All third-party services are carefully selected for GDPR compliance and appropriate data protection measures.
5. Data Security
We implement appropriate security measures to protect your information:
- SSL encryption for all data transmission
- Secure hosting with reputable providers
- Regular security updates and monitoring
- Limited access to personal data on a need-to-know basis
- Regular data backups with encryption
6. Data Retention
- Enquiry Data: 2 years after initial contact (for potential future projects)
- Client Data: 7 years after project completion (for tax and legal requirements)
- Marketing Data: Until you unsubscribe or withdraw consent
- Analytics Data: 26 months (Google Analytics default)
7. Your Rights Under GDPR
You have the following rights regarding your personal data:
- Right of Access: Request a copy of your personal data
- Right to Rectification: Correct inaccurate or incomplete data
- Right to Erasure: Request deletion of your data (with certain exceptions)
- Right to Restrict Processing: Limit how we use your data
- Right to Data Portability: Receive your data in a machine-readable format
- Right to Object: Object to processing based on legitimate interests
- Right to Withdraw Consent: Withdraw consent for marketing communications
To exercise any of these rights, contact us at [email protected]
8. Cookies Policy
8.1 What Are Cookies
Cookies are small text files stored on your device when you visit our website.
8.2 Cookies We Use
- Essential Cookies: Required for website functionality (no consent required)
- Analytics Cookies: Google Analytics to understand website usage (anonymised data)
- Performance Cookies: Help us improve website speed and user experience
8.3 Managing Cookies
You can control cookies through your browser settings. Note that disabling essential cookies may affect website functionality.
9. International Data Transfers
Some of our service providers may process data outside the UK/EU:
- Google Analytics: Data may be processed in the US (Google participates in EU-US adequacy frameworks)
- Hosting Services: Data is primarily stored in EU/UK data centres
All international transfers are protected by appropriate safeguards including adequacy decisions and standard contractual clauses.
10. Children's Privacy
Our services are intended for businesses and individuals aged 18 and over. We do not knowingly collect personal information from children under 18.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by email or through a prominent notice on our website. The "Last updated" date at the top indicates when the policy was last revised.
12. Complaints
If you have concerns about how we handle your personal data, please contact us first. If you're not satisfied with our response, you can lodge a complaint with:
13. Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us:
Email: [email protected]
Phone: 07862 123417
Post: Mapletree Studio, The Old Post Office, Victoria Street, Derby, Derbyshire DE1 1EQ