Privacy, cookies and terms of use

This privacy policy sets out how helium studio (“helium studio”, “we”, “us”, “our”) collects, uses, stores and protects personal data obtained through the website at www.heliumstudio.co.uk (the “site”). It applies to visitors to the site and to individuals who contact us through it.

It also applies to the directors and owners of businesses whom we write to or telephone about the business’s own website. Their personal data is not obtained through the site; section 3.3 sets out what it is and where it comes from.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy does not apply to any third-party website reached from a link on the site; those sites are governed by their own policies.

Section 14 sets out the terms of use on which the site is provided. Those terms are separate from, and additional to, this privacy policy.

helium studio is the data controller for the personal data described in this policy. helium studio is a trading name and is not a limited company. It operates from Leeds, United Kingdom.

Enquiries about this policy, and requests relating to personal data, should be addressed to hello@heliumstudio.co.uk or 07830 873006.

We are not required to appoint a data protection officer under Article 37 of the UK GDPR and have not appointed one. Responsibility for data protection rests with the studio principal, contactable at the address above.

We collect personal data in three circumstances, and in no others.

3.1 Enquiry form

Where you submit the enquiry form on the site, we collect the information you provide in it: your name, your email address, your company name (optional) and the free-text description of your project. This data is provided directly by you.

3.2 Website analytics

Where you have accepted analytics, we receive anonymised, aggregate data about use of the site: which pages are viewed and the approximate geographic origin of visits. This data is aggregated at the point of collection and does not identify you.

3.3 Business contacts we write to

We write to, and telephone, directors and owners of businesses to tell them about a specific fault we have noticed on the business’s own public website and to offer a short call. We do this only where the business is a limited company or a limited liability partnership. If we have contacted you in this way, this section applies to you.

We hold the following.

• Your name, as a director or owner of the business.
• A work email address and a business telephone number.
• The company’s registered number and its status at Companies House.
• A note of what we noticed on the business’s public website.
• Any reply you send us, and our notes of any telephone call with you.

This data is not provided by you. Your name and the company details come from the company’s public record at Companies House. The email address and telephone number come from the business’s own website. We do not buy or rent contact lists, we do not guess email addresses, and we do not record a director’s date of birth or home address.

A business we contact receives at most three short emails and two telephone calls over about two weeks. If a call is not answered we may try it again; no call is tried more than three times. If we hear nothing, we make no further contact for at least six months. Every email says who it is from and how to stop further contact, and our emails carry no tracking of opens or clicks. We telephone a number only after checking it against the Telephone Preference Service and the Corporate Telephone Preference Service.

You may object at any time by replying “stop” to any of our emails or by emailing hello@heliumstudio.co.uk. We then stop, and the business is placed on our do-not-contact list, which we keep so that it is not contacted again. Sections 4, 10 and 11 set out the lawful basis, how long the data is kept and your rights.

3.4 Data we do not collect

We do not collect special category data through the site. We do not operate advertising pixels, device fingerprinting or cross-site tracking, and we do not sell personal data or disclose it to advertisers.

We rely on the following lawful bases under Article 6(1) of the UK GDPR.

• Enquiry form data — legitimate interests, Article 6(1)(f). The legitimate interest pursued is responding to enquiries about our services and managing any engagement that follows from them. Processing is limited to what is necessary for that purpose. We consider that this processing is within the reasonable expectations of a person who has contacted us, and that it does not override their interests, rights or freedoms.
• Analytics data — consent, Article 6(1)(a). Analytics are loaded only after you accept them in the consent banner. Consent may be withdrawn at any time, as set out in section 11.
• Business contact data — legitimate interests, Article 6(1)(f). The legitimate interest pursued is finding customers for our services, by telling a business about a specific fault on its own public website and offering a short call. This is direct marketing. Processing is limited to the data and the contact described in section 3.3. We consider that a person who runs a business would reasonably expect to be contacted about that business through the contact details it publishes, and that contact on this scale does not override their interests, rights or freedoms. Because a person may not expect their name to be taken from the Companies House register for this purpose, our first email says where we found it. You may object at any time, as set out in section 11, and we will stop.

We use personal data for the following purposes only.

• To respond to your enquiry and to correspond with you about it.
• To provide services, and to administer the engagement, where an engagement follows from your enquiry.
• To understand in aggregate how the site is used, and to improve it, where you have consented to analytics.
• To tell a business about a fault we have noticed on its own public website and to offer a short call, as described in section 3.3, and to answer any reply.
• To keep a record of the businesses that have asked us not to contact them, so that they are not contacted again.

The contact with business contacts described in section 3.3 is the only direct marketing for which we use personal data. We do not send newsletters or bulk mailings, we do not use enquiry form data for marketing, and we do not buy, sell or share marketing lists. We do not carry out automated decision-making, including profiling, within the meaning of Article 22 of the UK GDPR.

This section covers cookies and similar technologies, including data stored in or read from your browser. The complete inventory for the site is as follows.

• Consent preference. Your response to the consent banner is stored in your browser using localStorage. This is strictly necessary: it exists so that your choice is recorded and you are not asked on every visit. It is not a cookie, and it is not transmitted to us.
• Vercel Analytics. Loaded only where you have accepted analytics. It is cookieless by design and records anonymised, aggregate page views. It does not build a profile of you and does not track you across other sites.
• Nothing else. The site sets no advertising cookies, no third-party tracking cookies and no other similar technologies.

Declining analytics does not affect the availability or operation of the site. You may change your choice at any time using “Cookie settings” in the site footer, which reopens the consent banner.

We engage two processors, each of which acts on our instructions and under its own data processing terms.

• Vercel Inc. Hosting of the site and, where you have consented, its privacy-focused analytics.
• Web3Forms. Delivery of enquiry form submissions to our email inbox.

For the business contact data described in section 3.3 we also use the following service providers.

• Zoho. Our email service, from which those emails are sent and in which replies are received.
• Supabase. Hosting of the database in which the records and the do-not-contact list are kept.
• Anthropic. The AI assistant software we use to help find the businesses, prepare the emails, read replies and keep the records.

We do not otherwise disclose personal data to third parties, except where we are required to do so by law or where disclosure is necessary to establish, exercise or defend legal claims. If we engage a further processor, this policy will be updated to record it.

Vercel Inc. and Web3Forms are both established outside the United Kingdom and may process personal data on infrastructure outside the United Kingdom. Vercel Inc. is established in the United States. Web3Forms operates from India and uses infrastructure providers that may process data in more than one region.

Of the service providers used for business contact data, Zoho holds our mail in data centres in the European Union and our Supabase database is hosted in France. Anthropic is established in the United States and may process personal data there.

Where personal data is transferred outside the United Kingdom, we rely on the safeguards set out in the data processing terms of the processor concerned. Vercel’s published Data Processing Addendum provides that, for transfers from the United Kingdom, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses is incorporated and applies. Web3Forms states that transfers from the United Kingdom and the European Economic Area are made under the Standard Contractual Clauses set out in its data processing agreement.

A copy of the relevant safeguards may be requested using the contact details in section 2.

The site is served over HTTPS, so information you submit through it is encrypted in transit. Enquiry correspondence is held in our email account, access to which is restricted to studio personnel who need it in order to respond to you and is protected by multi-factor authentication.

Business contact data (section 3.3) is held in the studio’s own database. It can be read only by the people who run the studio and by the studio’s software acting under their sign-in.

For data held by our processors we rely on the technical and organisational measures each of them commits to in its own terms. We hold no independent security certification and make no claim to any. No transmission over the internet can be guaranteed to be completely secure.

Enquiry correspondence is retained for as long as the enquiry, or an engagement resulting from it, remains live. It is deleted once neither applies, and in any event no later than two years after the date of last contact.

Business contact data (section 3.3) is kept while the contact described in that section is under way and for the six months that follow it, so that the business is not contacted again during that time. We review these records every March and September and delete what is no longer needed.

Where you have asked us to stop, we keep only what is needed to make sure the business is not contacted again: the email address and telephone number we used, the business’s website address and company number, and the date of your request. That entry stays on our do-not-contact list indefinitely, because deleting it would risk the business being contacted again. The rest of the record is deleted at the next review.

Analytics data is aggregated and anonymised at the point of collection. There is no personal record within it to retain, and consequently none to erase.

Subject to the conditions and exemptions in the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data.

• Access. To be told whether we hold personal data about you and to receive a copy of it.
• Rectification. To have inaccurate personal data corrected and incomplete data completed.
• Erasure. To have personal data deleted where the grounds in Article 17 apply.
• Restriction. To have our processing restricted where the grounds in Article 18 apply.
• Objection. To object to processing carried out on the basis of our legitimate interests. Where we use your personal data for direct marketing, as described in section 3.3, this right is absolute: if you object we will stop, and you do not need to give a reason.
• Portability. To receive personal data you provided to us in a structured, commonly used and machine-readable format.
• Withdrawal of consent.To withdraw consent to analytics at any time, using “Cookie settings” in the site footer or by contacting us. Withdrawal does not affect the lawfulness of processing carried out before it.
• Complaint.To lodge a complaint with the Information Commissioner’s Office, as set out in section 12.

To exercise any of the rights in section 11, contact us at hello@heliumstudio.co.uk. We may ask for information to confirm your identity. We will respond within one month of receiving the request. That period may be extended by up to two further months where a request is complex or where several requests have been made, in which case we will tell you within one month and explain why. No fee is charged unless a request is manifestly unfounded or excessive.

If we have written to you or telephoned you as a business contact (section 3.3), the quickest way to stop further contact is to reply “stop” to any of our emails, or to say so on the call. We act on it straight away.

The supervisory authority for data protection in the United Kingdom is the Information Commissioner’s Office. You have the right to lodge a complaint with it at any time.

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. ico.org.uk. Telephone 0303 123 1113.

We would ask that you raise any concern with us first, so that we have the opportunity to address it, but you are not required to do so. Where you complain to us, we will acknowledge the complaint within 30 days and tell you the outcome without undue delay.

We may update this policy from time to time, for example to reflect a change in the way the site operates or in the processors we engage. Changes take effect when they are published on this page, and the date at the head of the page is revised accordingly. We do not notify individuals of changes separately, so please review this page when you next use the site.

The following terms apply to your use of the site. They are separate from the privacy policy set out in sections 1 to 13.

1. Intellectual property. The design, code and content of the site are owned by helium studio, or used under licence, and are protected by copyright and other intellectual property rights. They may not be reproduced or reused without our written permission.

2. Studio-build projects. The projects shown in the work section of this site and labelled as design studies on their own pages are self-directed demonstrations of our capability, not client engagements. Any resemblance to a real brand is incidental and no association is implied.

3. Information, not advice. The site is provided on an as-is basis. Its content is general information about our services and should not be relied on as professional advice. We give no warranty that the content is complete, current or fit for any particular purpose.

4. Liability. Nothing in these terms excludes or limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be excluded or limited. Subject to that, we exclude liability for any loss or damage arising from use of, or reliance on, the site to the fullest extent permitted by law.

5. Availability. We may change, suspend or withdraw the site, or any part of it, without notice.

6. Governing law and jurisdiction. These terms, and any dispute or claim arising out of or in connection with them or the site, are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.