Your data, our promise.
Last updated: 23 June 2026
This page explains what personal data we collect when you use theunderfoundstudio.com, why we collect it, how we use it, and your rights under the UK GDPR and the Data Protection Act 2018.
We are UNDERFOUND Studio Ltd, 11 Oxford Road, Altrincham, WA14 2DY, United Kingdom. We are the data controller for any personal data you share with us through this site. You can reach us at info@theunderfoundstudio.com for any data-protection question.
1. What we collect
- Contact & booking data. Name, email, phone, company and the message you send via the contact or booking forms. Lawful basis: legitimate interest in replying to enquiries, or contract performance once a project is agreed.
- Newsletter sign-ups. Email address (and source page) when you opt in to Field Notes. Lawful basis: your consent, confirmed via double opt-in. You can unsubscribe from every email.
- Anonymous analytics. Page path, referrer and a random session ID, only after you accept analytics cookies. No IP address, no profiling, no cross-site tracking.
- Server logs. Standard hosting logs (IP, user agent, timestamp) kept by our hosting provider for security and abuse prevention.
2. Cookies
We use the smallest set of cookies we can get away with. There are no advertising cookies, no third-party trackers and no cross-site profiling on this site.
- uf_consent_v1 — stores your cookie choice so we don't ask again. Strictly necessary.
- uf_sid — random session identifier for analytics. Cleared when you close the browser. Only set if you accept analytics.
- Google Tag Manager / Google Analytics — if and when enabled, these load only after you accept analytics cookies and are used to understand which pages and channels are working. You can withdraw consent at any time by clearing site data in your browser.
3. Who we share data with
We never sell your data. We share the minimum necessary with the processors that run this site and our business:
- Supabase (database & auth) — EU region.
- Cloudflare (hosting & CDN).
- Resend (transactional & newsletter email).
- Google (Calendar, optional Search Console & Tag Manager).
- Tinybird (anonymous pageview analytics, only after consent).
Each processor is GDPR-compliant and bound by a Data Processing Agreement. We do not transfer personal data outside the UK / EEA without appropriate safeguards.
4. How long we keep it
- Contact enquiries: up to 24 months after last contact.
- Project & booking records: 7 years (HMRC requirement).
- Newsletter subscribers: until you unsubscribe.
- Analytics data: rolling 26 months.
5. Your rights
You can ask us to: confirm what data we hold, correct it, delete it, restrict how we use it, port it to another provider, or withdraw consent you've given. Email info@theunderfoundstudio.com and we'll respond within 30 days.
If you're not happy with how we've handled your data, you can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.
6. Changes
We'll update this page if anything material changes. The date at the top of the page reflects the latest revision.