Privacy Policy
Data handling responsibility
Merit Studio, with offices in Port Mitchell, acts as the data controller—responsible for choices about what data is gathered and processed from this site. We serve as the initial point of contact for your questions, disagreements, or complaints regarding data handling. Reach our controller or the staff member overseeing data protection compliance at info@meritstudio.co.uk. Messages arriving there are seen by relevant team members and tracked comprehensively, allowing any inquiry to be matched with its response. Verification requirements prompt us to seek only those identifying particulars required to establish that you are who you claim.
What happens to your data
Processing uses data to answer your question, draft proposals when asked, and document correspondence needed for responsible administration of the practice. Client engagements rely on these same records for delivery, payment, and the closeout handoff described elsewhere on this site. Form data is never applied to marketing, advertising, profiling, newsletters, or algorithmic systems of any kind. No inquiry is scored, ranked, analysed by machines, or fed into a growth tool. Once a communication has clearly finished, it transitions to the deletion schedules set out below rather than perpetual storage.
Data deletion schedules
Non-client inquiries delete one year after final correspondence, permitting enough time for future recognition without permanent storage. Client records are retained six years from engagement conclusion, aligned with the contractual and tax limitation periods that ordinarily apply. Consent statements and analytics data, where analytics have been accepted, are kept twelve months then auto-purged automatically. Legal holds, open complaints, and pending data requests prevent scheduled deletion entirely; affected data transfers to restricted storage until each matter closes, after which standard periods resume and run their course.
What information we collect
We gather exclusively and comprehensively the specific details you consciously enter through our contact form: your name, email address, an optional phone number, and your complete message. All form elements are fully visible and accessible; no hidden or covert data harvesting occurs. Our server security logs maintained completely separately record exclusively technical information—your IP address, the precise timestamp when you submit, your browser type. We categorically and absolutely do not purchase mailing lists, merge external datasets with yours, or infer personal characteristics. Email attachments receive identical protection and equivalent security treatment.
Your legal protections
GDPR Articles 15 to 22 confer rights on you. Request access to your personal information, seek correction of inaccuracies, and demand erasure when processing authority lapses. You may restrict processing during accuracy disagreements, get your submitted data in portable digital form, and oppose legitimate-interest processing perpetually. Contact info@meritstudio.co.uk with plain requests; no formal template needed. One month for response, extendable by two months if complex, with advance notification of extension. Refusals explain the reasons.
Data security and safeguards
All site connections use HTTPS; submissions are encrypted both in transit and once at rest in the database. Access to enquiries is limited by role to the small number of authorised personnel who actually answer them, each with an individual account, strong authentication, and a logged trail of access. Encrypted backups are kept in a location separate from the primary systems and tested on a schedule. Security patches deploy promptly upon release; the same logs are monitored for suspicious patterns; breach procedures include risk assessment and notification of the supervisory authority and affected persons within the legal seventy-two-hour deadline where required.
Recipients and processors
Your data is never commercialised, licenced, or given to advertisers of any kind. It flows only to infrastructure essentials: the web host that stores the website and its data, and the email service that connects you to info@meritstudio.co.uk. They are contractually-bound GDPR processors operating under written agreements, with restricted use rights limited to our instructions, appropriate security obligations, and an annual compliance review. Banking and tax bodies access payment data only upon invoice issuance when the law legally mandates disclosure. Processor access is strictly limited to what each functional task genuinely requires, never more.
Legal basis
Two legal bases authorise our processing under GDPR. Article 6(1)(a) GDPR permits processing based on your consent: you freely provide information expecting a response, able to revoke this consent at info@meritstudio.co.uk anytime. Article 6(1)(f) GDPR permits processing of messages related to existing professional relationships or legal documentation: our legitimate interests in professional response and record defensibility justify this. Consent withdrawal stops further processing; legally-required records are restricted, not deleted.
Moving data internationally
Our website and email infrastructure are maintained exclusively within the EEA; your personal information ordinarily stays within EEA jurisdiction. Where processor infrastructure extends beyond the EEA—including backup systems—data movement is permitted only under Chapter V GDPR protections: Commission adequacy determinations or binding standard contractual clauses paired with transfer impact assessment. Processor organisations, their locations, and applicable safeguards are available from info@meritstudio.co.uk on request. If service changes would necessitate data transfer outside the EEA without such protections, those changes are not undertaken; no transfer depends on your consent, and form use does not imply such consent.
Complaints
A supervisory authority complaint is your entitlement if you believe data handling has violated your rights, addressable to your resident EU state or the location of the alleged breach. ICO serves as our regulatory authority, offering a costless independent complaint process. Authority escalation demands no prior contact with us, maintains all alternative legal options, and carries no relational penalty. We encourage notifying info@meritstudio.co.uk initially because rapid contact often enables direct resolution—most concerns dissolve quickly once explained.