1 Who We Are
Graft Studio is a trading name of Ethan Timothy, sole trader. We provide website design, development, and hosting services to trade businesses in West Yorkshire and beyond.
Data Controller: Ethan Timothy trading as Graft Studio
Email: hello@graftstudio.co.uk
Phone: 07505 931570
If you have any questions about this Privacy Policy or how we handle your data, please get in touch using the contact details above or via our contact form.
2 What Data We Collect
Data you give us directly
- Your name and business name
- Your phone number and email address
- Your trade or business type
- Your current website address (if applicable)
- Any information you provide in the "Anything we should know" field
- Any photos, logos, or content you send us for your website
Data collected automatically
- Basic website analytics (page visits, general location, device type) if analytics tools are enabled
- Cookies — see our Cookie Policy in Section 8
Data from third parties
If you contact us via social media (Instagram, Facebook) or a trade platform (Checkatrade, MyBuilder), we may receive your name and contact details through those platforms. Their own privacy policies apply to how they handle your data.
3 Why We Collect Your Data
We collect and use your personal data for the following purposes:
- To respond to your enquiry — so we can contact you about your free mockup request
- To provide our services — to build, host, and maintain your website
- To process payments — we use GoCardless or Stripe; your payment data is handled by them directly and we do not store card details
- To communicate with you — updates about your project, invoices, or service changes
- To comply with legal obligations — including tax and accounting requirements
We will never sell your data to third parties. We will never use your data for unsolicited marketing beyond responding to your enquiry.
4 Legal Basis for Processing
Under UK GDPR, we process your data on the following legal bases:
- Contract performance — where processing is necessary to provide the services you've requested
- Legitimate interests — to respond to enquiries and manage our business, where this doesn't override your rights
- Legal obligation — where we are required to process data to comply with UK law (e.g. HMRC requirements)
- Consent — where you have explicitly given us permission, such as opting in to future communications
5 How Long We Keep Your Data
- Enquiry data (no contract formed): Deleted within 12 months if no project proceeds
- Client project data: Retained for 6 years after the end of the contract for legal and accounting purposes, then securely deleted
- Payment records: Retained for 7 years as required by HMRC
- Website content you provide: Deleted within 30 days of a project ending unless otherwise agreed
6 Who We Share Your Data With
We only share your data with trusted third parties where necessary to provide our services:
- GoCardless — for Direct Debit payment processing (their privacy policy applies)
- Stripe — for one-off card payments (their privacy policy applies)
- Google Workspace — our email is hosted by Google; emails you send us are stored on Google servers
- Netlify / hosting providers — your website may be hosted on third-party servers in the UK or EU
- Formspree — contact form submissions may pass through Formspree to reach us
- HMRC — we are legally required to share certain financial records
We do not transfer your data outside the UK or EU without appropriate safeguards in place.
7 Your Rights Under UK GDPR
You have the following rights regarding your personal data. To exercise any of these, contact us at hello@graftstudio.co.uk:
Right of Access
Request a copy of the personal data we hold about you.
Right to Rectification
Ask us to correct inaccurate or incomplete data.
Right to Erasure
Ask us to delete your data, subject to legal obligations.
Right to Restrict Processing
Ask us to limit how we use your data in certain circumstances.
Right to Data Portability
Receive your data in a structured, machine-readable format.
Right to Object
Object to processing based on legitimate interests.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
8 Cookie Policy
Cookies are small text files placed on your device when you visit our website. We use the following types:
- Essential cookies — necessary for the website to function. Cannot be switched off. No personal data is stored.
- Analytics cookies — if enabled, these help us understand how visitors use our site (e.g. Google Analytics). We only use these with your consent.
You can control cookies through our cookie consent banner when you first visit the site, or through your browser settings at any time. Withdrawing consent will not affect any processing that has already taken place.
Our website does not currently use advertising or social media tracking cookies.
9 Security
We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Our website uses HTTPS encryption. We do not store payment card details — these are handled entirely by our payment processors.
In the unlikely event of a data breach that affects your rights and freedoms, we will notify you and the ICO as required by law within 72 hours.
10 Changes to This Policy
We may update this Privacy Policy from time to time. The most current version will always be available at graftstudio.co.uk/privacy.html. We will notify active clients of any significant changes by email.
Graft Studio is a trading name of Ethan Timothy, sole trader based in West Yorkshire, England.
hello@graftstudio.co.uk · 07505 931570