Privacy Notice
How we collect and use personal data, and your rights over it.
Last updated:
Who we are
Hexa Studios Limited("Hexa", "we", "us") is the controller of the personal data described in this notice. We are registered in England and Wales, company number 11472522. Our registered office is 123 Marmion Avenue, London, E4 8EJ.
For anything about your personal data, email privacy@hexastudios.co.
What this notice covers
This notice covers personal data we hold about:
- people who visit this website
- people who contact us
- our clients, prospective clients and their staff
- billing contacts
It does not cover the users of apps we build or host for clients. See When we act for our clients below.
What we collect, why, and our legal basis
Website visitors
| What we collect | Why | Legal basis |
|---|---|---|
| Pages viewed, referring site, browser, operating system, device type, screen size, language and country (worked out from your IP address) | Understanding which pages people use so we can improve the site. We use Umami, an analytics tool we host ourselves. It sets no cookies and does not store your IP address. You can opt out below. | Legitimate interests (Article 6(1)(f)) |
| IP address, browser details, the page requested and the time of the request | Delivering pages to you, keeping the site secure and diagnosing faults. Our servers record this in access logs. | Legitimate interests (Article 6(1)(f)) |
Enquiries
| What we collect | Why | Legal basis |
|---|---|---|
| Name, email address, your message and anything else you choose to tell us | Replying to you and discussing possible work | Legitimate interests (Article 6(1)(f)). If you are asking about a contract with you personally, taking steps at your request before a contract (Article 6(1)(b)). |
| Email address, if you register interest in one of our products | Telling you when the product is available | Consent (Article 6(1)(a)), which you can withdraw at any time |
Clients and prospective clients
| What we collect | Why | Legal basis |
|---|---|---|
| Name, job title, organisation, work email address, phone number, and our correspondence and meeting notes | Providing our services, managing the working relationship, support and account administration | Contract (Article 6(1)(b)) where you are our client personally. Otherwise legitimate interests (Article 6(1)(f)) in working with your organisation. |
| Name, organisation and work contact details of people we would like to work with | Getting in touch about work we could do together. We do not send marketing emails or newsletters. | Legitimate interests (Article 6(1)(f)) |
Billing
| What we collect | Why | Legal basis |
|---|---|---|
| Billing contact name and details, company details, invoices, payment records and VAT details | Invoicing, collecting payment, keeping accounts and meeting tax obligations | Contract (Article 6(1)(b)) and legal obligation (Article 6(1)(c)) to keep accounting records |
Where we rely on legitimate interests, we have weighed our interests against yours. You can ask us for details of that assessment.
Where we get your data
Mostly from you. Client and prospect contact details may also come from your organisation, from a colleague who introduces you, or from your organisation's public website.
If you do not give us your data
You do not have to give us any personal data. Without a name and email address we cannot reply to an enquiry, and without billing details we cannot provide services under a contract.
Who we share it with
We share personal data only where we need to:
- hosting providers, which run this website and our systems
- our contact form provider, Formspree, Inc., which receives messages sent through the contact page
- our email delivery providers, Mailgun and Resend, which send email on our behalf
- our bank, Revolut, and our accounting software provider
- professional advisers such as our accountant, lawyers and insurers, when needed
- HMRC, the courts or other authorities, when the law requires it
We do not sell personal data.
International transfers
Our systems are hosted in the UK and the European Economic Area, which the UK recognises as providing adequate protection for personal data.
Some of our providers are US companies. Transfers to Mailgun, Resend and Cloudflare are covered by the UK Addendum to the EU Standard Contractual Clauses and by the UK Extension to the EU-US Data Privacy Framework. Formspree publishes that it hosts form submissions in the United States, with Amazon Web Services, and relies on the EU Standard Contractual Clauses.
How long we keep it
| Data | How long we keep it |
|---|---|
| Website analytics | Up to three years |
| Server logs | One year |
| Enquiries that do not lead to work | Until the conversation has ended, then deleted |
| Client contact details and project correspondence | Until our working relationship ends. Copies in database backups expire 90 days later. |
| Invoices and accounting records | Five years from the end of the financial year they relate to |
| Product interest sign-ups | One year |
After that we delete the data or anonymise it.
Your rights
Under UK GDPR you have the right to:
- get a copy of the personal data we hold about you
- have inaccurate data corrected
- have your data deleted
- restrict how we use your data
- object to our use of your data where we rely on legitimate interests, and to object at any time to direct marketing
- receive data you gave us in a portable format, where we rely on consent or contract
- withdraw consent at any time, where we rely on consent
Some rights apply only in certain circumstances. To use any of them, email privacy@hexastudios.co. We will reply within one month. We may ask you to confirm your identity first. There is usually no charge.
We do not make decisions about you based solely on automated processing.
Complaints
If you are unhappy with how we have handled your data, please tell us first at privacy@hexastudios.co so we can try to put it right.
You have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection, at ico.org.uk or on 0303 123 1113. If you live in the EU, you can also complain to the data protection supervisory authority in your country.
Cookies and similar technologies
This site sets no cookies. It stores two small items in your browser:
- your light or dark theme choice, so it is remembered between visits
- your analytics choice, if you opt out below
Opting out of analytics
Our analytics count visits without cookies and without identifying you. If you would rather not be counted at all, use the button below. It applies to this browser only.
Checking whether your visits are counted…
Embedded videos
Some pages include videos hosted on YouTube. Nothing is loaded from YouTube until you press play. When you do, the video plays in YouTube's privacy-enhanced mode. YouTube may still store cookies or similar data in your browser once the video starts, under its own privacy policy.
When we act for our clients
When we build or host an app for a client, the client decides how their users' personal data is used. The client is the controller of that data and we are their processor. We handle it only on the client's instructions, under a data processing agreement.
If you use an app we built or host for someone else, that organisation's own privacy notice explains how your data is used, and you should contact them to exercise your rights. If you contact us instead, we will pass your request on to them.
Our sub-processors and security measures are published on this site.
Changes to this notice
We will update this notice when the way we use personal data changes. The date at the top shows when it last changed.