Privacy Policy

Who we are

Lume Studios Consulting Ltd is the data controller, the company responsible for your information and for this policy.

• Registered in England and Wales, company number 12609670.
• Registered office in Farnham, England.
• Contact for anything in this policy: ben@lumestudios.co.uk.

We are a small consultancy, so there is no separate data protection officer. Questions about your data come straight to us at that address.

What we collect

The only personal information we actively collect is what you choose to type into our contact form:

• your name;
• your email address;
• your company name;
• your company size;
• the service you are interested in;
• the message you write to us.

Our website is hosted by Netlify, and like most web hosts Netlify keeps standard server logs, which can include your IP address and basic technical details about your visit.

We do not ask for anything we do not need, and we do not buy, enrich, or gather your details from anywhere else.

Why we use it

We use your information for one thing: to read and respond to your enquiry, to follow up on that conversation, and to keep a short record of it afterwards.

We do not use it for marketing. We will not add you to a mailing list, and we do not share it for anyone else's advertising.

Our lawful basis

Under UK GDPR we rely on legitimate interests (Article 6(1)(f)). The interest is straightforward: if you send us a business enquiry, we have a genuine reason to read it and reply. We have weighed that against your privacy, and we do not think replying to an enquiry you chose to send is something you would object to.

Because we do not use your details for marketing, we do not need, and do not ask for, separate consent.

How long we keep it

We keep enquiry information for 12 months from our last contact with you, after which we delete or anonymise it, unless our conversation turns into an actual project, in which case normal business-record retention applies.

Who else sees it

We keep the number of people and companies who touch your data as small as we can. The processors we currently use are:

• Netlify, Inc. hosts the website and runs the contact form; your submission is stored and transmitted through Netlify's infrastructure.
• Our email provider receives the notification when you submit the form, so that we can read and reply to it.
• Google Analytics (Google LLC) collects statistics about how visitors use the site, so we can see which pages are useful and improve them. It sets cookies in your browser and processes limited technical data such as your device, browser, and approximate location. It does not receive your name or contact details.

Beyond these, we use no CRM and no advertising or remarketing tools. If that changes, we will update this policy before the change takes effect.

Sending data outside the UK

Netlify, Inc. is based in the United States, so submitting the form means your information is transferred there. That transfer is covered by Netlify's certification under the EU–US Data Privacy Framework and its UK Extension, and by Standard Contractual Clauses in Netlify's data processing agreement as a backstop.

Google, which provides our website analytics, is also US-based. Google is certified under the same Data Privacy Framework, with Standard Contractual Clauses as a backstop.

In fairness we should note that the Data Privacy Framework's long-term status is the subject of legal challenge during 2026. We are keeping an eye on it, and if the framework is suspended or withdrawn we will review this transfer and update this section.

Your rights

Under UK GDPR you have the following rights over your information:

• Access: ask for a copy of the information we hold about you.
• Rectification: ask us to correct anything that is wrong or incomplete.
• Erasure: ask us to delete your information.
• Restriction: ask us to pause using it while something is being sorted out.
• Portability: ask for your information in a portable, machine-readable form.
• Objection: object to us relying on legitimate interests; we will stop unless we have a compelling reason not to.

To exercise any of these, email ben@lumestudios.co.uk. There is no charge, and we will respond within one month.

Complaints

Cookies and analytics

We use Google Analytics to understand how visitors use the site: which pages get read, roughly where people arrive from, and what we might improve. To do that it sets a small number of cookies in your browser and collects usage data such as the pages you view, your device and browser, and your approximate location. It does not collect your name or contact details, and Google Analytics 4 does not store your IP address. We have not enabled any advertising, remarketing, or cross-site tracking features.

You can opt out at any time: block or delete cookies in your browser settings, use your browser's privacy controls, or install Google's opt-out browser add-on. Our contact form itself sets no cookies, and is protected from spam by a simple hidden "honeypot" field rather than a tool such as reCAPTCHA.

Automated decisions

We do not make any automated decisions about you, and we do not profile you. A person reads every enquiry.

Changes to this policy

We may update this policy from time to time. When we do, we will change the "last updated" date at the top of the page. This version was last updated on 6 July 2026.