01 Who we are
[data]subject.studio ("we", "us", "our") is a data protection practice helping people and organisations exercise their rights under the General Data Protection Regulation (GDPR) and equivalent national law. For the personal data described in this policy, we are the data controller.
02 How to contact us
For anything relating to this policy or your personal data, email us at hello@datasubject.studio. If you contact us about your own data rights, please don't send sensitive documents in a first email.
03 The data we collect
We keep what we collect to a minimum. Depending on how you interact with us, that may include:
- When you contact us: your name, contact details, and whatever you choose to tell us about your situation or enquiry.
- When we work with you: the information needed to carry out the work, which may include personal data relating to a matter you've asked us to help with.
- When you visit the site: limited technical information collected by our hosting provider to keep the site running securely.
We don't knowingly collect data about anyone under 18, and we don't collect more than we need for the purpose at hand.
04 How we use it
We use your personal data only to:
- respond to your enquiry and, where relevant, carry out work you've asked us to do;
- communicate with you about that work;
- meet our own legal and regulatory obligations.
We will never sell your data, and we don't use it for advertising or marketing.
05 Our lawful basis
We rely on one or more of the following, depending on the circumstances:
- Consent: where you've agreed to us using your data for a specific purpose.
- Performance of a contract: where we're carrying out work you've engaged us to do.
- Legitimate interests: where we use your data in a limited, proportionate way to run the practice and respond to you.
- Legal obligation: where the law requires us to process it.
06 Sharing your information
We do not share your personal data for any commercial reason. We may use trusted service providers, for example for secure storage or email, who process data on our behalf under appropriate agreements. We may also share information where the law requires it, or where you've asked us to (for instance, with a nominated adviser or representative).
07 How long we keep it
We keep personal data only for as long as we need it for the purposes above, and then delete it. You can ask us to delete your data at any time by emailing us.
08 Keeping it secure
We use appropriate technical and organisational measures to protect your data. No transmission over the internet is ever completely secure, so we can't guarantee against interception, but we take reasonable steps to keep your information safe.
09 Your rights
These are the rights we help others exercise, and they apply to your data with us too. You can:
- ask for a copy of the data we hold about you;
- have inaccurate or incomplete data corrected;
- ask us to delete your data, or restrict how we use it;
- object to our processing, or withdraw consent where we rely on it;
- ask us to transfer your data to you or another controller.
To exercise any of these, email hello@datasubject.studio. If you're unhappy with how we've handled your data, you can complain to the ICO at ico.org.uk/make-a-complaint or by phone on 0303 123 1113.
10 Changes to this policy
We may update this policy from time to time. Any changes will be posted here with a revised date.
11 About our work
We help people and organisations exercise their existing rights under the General Data Protection Regulation and equivalent national law. We are not a law firm and do not provide legal advice or representation; where a matter needs legal advice, we'll say so and suggest where to find it. Exercising data rights does not guarantee any particular outcome.