Privacy, cookies and terms of use

This privacy policy sets out how helium studio (“helium studio”, “we”, “us”, “our”) collects, uses, stores and protects personal data obtained through the website at www.heliumstudio.co.uk (the “site”). It applies to visitors to the site and to individuals who contact us through it.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy does not apply to any third-party website reached from a link on the site; those sites are governed by their own policies.

Section 14 sets out the terms of use on which the site is provided. Those terms are separate from, and additional to, this privacy policy.

helium studio is the data controller for the personal data described in this policy. helium studio is a trading name and is not a limited company. It operates from Leeds, United Kingdom.

Enquiries about this policy, and requests relating to personal data, should be addressed to hello@heliumstudio.co.uk or 07830 873006.

We are not required to appoint a data protection officer under Article 37 of the UK GDPR and have not appointed one. Responsibility for data protection rests with the studio principal, contactable at the address above.

We collect personal data in two circumstances, and in no others.

3.1 Enquiry form

Where you submit the enquiry form on the site, we collect the information you provide in it: your name, your email address, your company name (optional) and the free-text description of your project. This data is provided directly by you.

3.2 Website analytics

Where you have accepted analytics, we receive anonymised, aggregate data about use of the site: which pages are viewed and the approximate geographic origin of visits. This data is aggregated at the point of collection and does not identify you.

3.3 Data we do not collect

We do not collect special category data through the site. We do not operate advertising pixels, device fingerprinting or cross-site tracking, and we do not sell personal data or disclose it to advertisers.

We rely on the following lawful bases under Article 6(1) of the UK GDPR.

• Enquiry form data — legitimate interests, Article 6(1)(f). The legitimate interest pursued is responding to enquiries about our services and managing any engagement that follows from them. Processing is limited to what is necessary for that purpose. We consider that this processing is within the reasonable expectations of a person who has contacted us, and that it does not override their interests, rights or freedoms.
• Analytics data — consent, Article 6(1)(a). Analytics are loaded only after you accept them in the consent banner. Consent may be withdrawn at any time, as set out in section 11.

We use personal data for the following purposes only.

• To respond to your enquiry and to correspond with you about it.
• To provide services, and to administer the engagement, where an engagement follows from your enquiry.
• To understand in aggregate how the site is used, and to improve it, where you have consented to analytics.

We do not use personal data for marketing purposes and we do not operate a marketing list. We do not carry out automated decision-making, including profiling, within the meaning of Article 22 of the UK GDPR.

This section covers cookies and similar technologies, including data stored in or read from your browser. The complete inventory for the site is as follows.

• Consent preference. Your response to the consent banner is stored in your browser using localStorage. This is strictly necessary: it exists so that your choice is recorded and you are not asked on every visit. It is not a cookie, and it is not transmitted to us.
• Vercel Analytics. Loaded only where you have accepted analytics. It is cookieless by design and records anonymised, aggregate page views. It does not build a profile of you and does not track you across other sites.
• Nothing else. The site sets no advertising cookies, no third-party tracking cookies and no other similar technologies.

Declining analytics does not affect the availability or operation of the site. You may change your choice at any time using “Cookie settings” in the site footer, which reopens the consent banner.

We engage two processors, each of which acts on our instructions and under its own data processing terms.

• Vercel Inc. Hosting of the site and, where you have consented, its privacy-focused analytics.
• Web3Forms. Delivery of enquiry form submissions to our email inbox.

We do not otherwise disclose personal data to third parties, except where we are required to do so by law or where disclosure is necessary to establish, exercise or defend legal claims. If we engage a further processor, this policy will be updated to record it.

Both of our processors are established outside the United Kingdom and may process personal data on infrastructure outside the United Kingdom. Vercel Inc. is established in the United States. Web3Forms operates from India and uses infrastructure providers that may process data in more than one region.

Where personal data is transferred outside the United Kingdom, we rely on the safeguards set out in the data processing terms of the processor concerned. Vercel’s published Data Processing Addendum provides that, for transfers from the United Kingdom, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses is incorporated and applies. Web3Forms states that transfers from the United Kingdom and the European Economic Area are made under the Standard Contractual Clauses set out in its data processing agreement.

A copy of the relevant safeguards may be requested using the contact details in section 2.

The site is served over HTTPS, so information you submit through it is encrypted in transit. Enquiry correspondence is held in our email account, access to which is restricted to studio personnel who need it in order to respond to you and is protected by multi-factor authentication.

For data held by our processors we rely on the technical and organisational measures each of them commits to in its own terms. We hold no independent security certification and make no claim to any. No transmission over the internet can be guaranteed to be completely secure.

Enquiry correspondence is retained for as long as the enquiry, or an engagement resulting from it, remains live. It is deleted once neither applies, and in any event no later than two years after the date of last contact.

Analytics data is aggregated and anonymised at the point of collection. There is no personal record within it to retain, and consequently none to erase.

Subject to the conditions and exemptions in the UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data.

• Access. To be told whether we hold personal data about you and to receive a copy of it.
• Rectification. To have inaccurate personal data corrected and incomplete data completed.
• Erasure. To have personal data deleted where the grounds in Article 17 apply.
• Restriction. To have our processing restricted where the grounds in Article 18 apply.
• Objection. To object to processing carried out on the basis of our legitimate interests.
• Portability. To receive personal data you provided to us in a structured, commonly used and machine-readable format.
• Withdrawal of consent.To withdraw consent to analytics at any time, using “Cookie settings” in the site footer or by contacting us. Withdrawal does not affect the lawfulness of processing carried out before it.
• Complaint.To lodge a complaint with the Information Commissioner’s Office, as set out in section 12.

To exercise any of the rights in section 11, contact us at hello@heliumstudio.co.uk. We may ask for information to confirm your identity. We will respond within one month of receiving the request. That period may be extended by up to two further months where a request is complex or where several requests have been made, in which case we will tell you within one month and explain why. No fee is charged unless a request is manifestly unfounded or excessive.

The supervisory authority for data protection in the United Kingdom is the Information Commissioner’s Office. You have the right to lodge a complaint with it at any time.

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. ico.org.uk. Telephone 0303 123 1113.

We would ask that you raise any concern with us first, so that we have the opportunity to address it, but you are not required to do so.

We may update this policy from time to time, for example to reflect a change in the way the site operates or in the processors we engage. Changes take effect when they are published on this page, and the date at the head of the page is revised accordingly. We do not notify individuals of changes separately, so please review this page when you next use the site.

The following terms apply to your use of the site. They are separate from the privacy policy set out in sections 1 to 13.

1. Intellectual property. The design, code and content of the site are owned by helium studio, or used under licence, and are protected by copyright and other intellectual property rights. They may not be reproduced or reused without our written permission.

2. Studio-build projects. The projects shown in the work section of this site and labelled as design studies on their own pages are self-directed demonstrations of our capability, not client engagements. Any resemblance to a real brand is incidental and no association is implied.

3. Information, not advice. The site is provided on an as-is basis. Its content is general information about our services and should not be relied on as professional advice. We give no warranty that the content is complete, current or fit for any particular purpose.

4. Liability. Nothing in these terms excludes or limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability that cannot lawfully be excluded or limited. Subject to that, we exclude liability for any loss or damage arising from use of, or reliance on, the site to the fullest extent permitted by law.

5. Availability. We may change, suspend or withdraw the site, or any part of it, without notice.

6. Governing law and jurisdiction. These terms, and any dispute or claim arising out of or in connection with them or the site, are governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction.