Privacy Policy

1.Who is responsible for your information

Alex Longson Ltd is the controller of personal information described in this policy.

Alex Longson LtdTrading as Longson StudioCompany number SC739129Third Floor, 3 Hill Street, Hill Street, Edinburgh, Scotland, EH2 3JPalex@longson.studio

Alex Longson Ltd is registered with the UK Information Commissioner's Office.

2.Information we collect

Depending on how you interact with us, we may collect:

Information you give us

• your name;
• email address;
• telephone number where supplied;
• company name and professional role;
• information about what you are launching, raising or building and relevant dates;
• project requirements, budget and enquiry details;
• information included in emails, forms, calls and meetings;
• billing, payment and transaction information;
• contract and project-administration information;
• feedback and correspondence.

Information generated through our relationship

• meeting notes;
• project decisions and approvals;
• creative briefs;
• client communications;
• records of services supplied;
• invoices and accounting records;
• call recordings, transcripts or AI-generated meeting summaries where recording or summarisation is enabled and you have been informed.

Website and device information

Subject to your cookie choices where required, we may collect:

• IP address;
• approximate location derived from IP;
• browser and device information;
• pages viewed;
• referring page or campaign;
• interactions with the website;
• analytics identifiers;
• advertising and attribution information.

We do not intentionally collect special-category personal data through the public website and ask that you do not include sensitive personal information in an ordinary project enquiry unless it is genuinely necessary.

3.How we collect information

We collect information:

• directly from you through forms, email, calls, meetings and project work;
• when you book a meeting;
• when a client or colleague introduces you;
• through payment and business-administration providers;
• through website analytics and advertising technologies where permitted;
• from publicly available professional or business sources where relevant to a legitimate business enquiry.

4.Why we use personal information and our lawful bases

Responding to enquiries and taking steps toward a contract

We use enquiry and contact information to respond, arrange calls, prepare proposals and discuss potential work.

Lawful basis: taking steps at your request before entering a contract and, where appropriate, our legitimate interests in developing and operating our business.

Delivering client services

We use client information to manage projects, communicate, deliver work, administer approvals and fulfil contractual obligations.

Lawful basis: performance of a contract and legitimate interests where the contracting client is an organisation rather than the individual concerned.

Payments, accounting and legal obligations

We process transaction, invoice and business records for payment, accounting, tax, fraud prevention and legal compliance.

Lawful basis: performance of a contract, legal obligation and legitimate interests.

Meetings and AI-assisted notes

Where calls are recorded or summarised using an AI notetaker, we use the resulting recording, transcript or summary to maintain accurate project records, follow up actions and deliver services. Participants should be informed before recording or summarisation occurs.

Lawful basis: legitimate interests in accurate business records and service delivery, and consent where consent is required by applicable law or the particular recording context.

Website operation and security

We process technical information necessary to deliver, protect and troubleshoot the website.

Lawful basis: legitimate interests in operating a secure website and, where applicable, performance of a requested service.

Analytics

Where required, analytics technologies are used only after consent. We use analytics to understand aggregate website use and improve performance and content.

Lawful basis for associated personal-data processing: consent where consent is used or required for the technology.

Advertising and attribution

Meta advertising technologies and any other advertising tags run only after the appropriate advertising consent. We use permitted advertising data to measure campaigns, attribute enquiries and, where enabled and consented to, support advertising audiences or retargeting.

Lawful basis: consent where required.

Legal claims and business protection

We may use records to establish, exercise or defend legal claims and protect our rights.

Lawful basis: legitimate interests and legal obligation where applicable.

5.Marketing

Longson Studio does not currently operate a public newsletter and does not send unsolicited marketing emails to people who have not subscribed or otherwise provided a lawful basis for such marketing.

Ordinary replies to enquiries, project communications and service messages are not marketing communications.

If our marketing practices change, we will update this policy and implement any consent or opt-out mechanisms required by law before using personal information for the new purpose.

6.Services and recipients

We use carefully selected providers to operate the business and website. Depending on your interaction, personal information may be processed by providers in these categories:

• Google Workspace / Gmail for business email and collaboration;
• Google Calendar for appointment scheduling;
• Stripe for payment processing where used for a transaction;
• Vercel for website hosting and delivery;
• Google Analytics for website analytics, only in accordance with the visitor's consent choices where consent is required;
• Meta for advertising measurement and advertising technologies, only in accordance with the visitor's consent choices where consent is required;
• our customer relationship management system for lead and client administration;
• an AI meeting or notetaking provider where enabled for a call;
• professional advisers, accountants, insurers or legal advisers where necessary;
• authorities or regulators where disclosure is legally required.

We do not sell personal information.

7.International transfers

Some technology providers may process information outside the United Kingdom or European Economic Area.

Where data-protection law requires safeguards for an international transfer, we rely on an applicable adequacy regulation or decision, approved contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum, EU Standard Contractual Clauses where applicable, or another lawful transfer mechanism.

8.How long we keep information

• Unsuccessful or dormant enquiries: normally up to 24 months after the last meaningful contact, unless there is a reason to retain them longer.
• Client project files and core correspondence: normally up to 7 years after the end of the engagement where reasonably required for contractual, professional, tax or legal purposes.
• Contracts, invoices and accounting or tax records: normally at least 6 years after the relevant accounting period, or longer where law requires.
• Payment-card data: Longson Studio does not store full card details. Payment providers process them under their own retention and security arrangements.
• Call recordings: deleted within 90 days unless there is a documented project, dispute or legal reason to retain a particular recording longer.
• AI-generated meeting notes and transcripts: normally retained with the relevant project record where they form part of the working record; material that is no longer needed is removed.
• Analytics data: the analytics platform is configured to the shortest useful retention setting and no longer than 14 months for user-level or event data unless a documented need justifies a different period.
• Cookie-consent records: retained for a reasonable period necessary to demonstrate and respect consent choices, then consent is refreshed where appropriate.
• Advertising identifiers: retained only in accordance with the configured advertising platform settings, the consent given and the purpose for which they were collected.

Deletion from active systems may not immediately remove information from secure backups, which are overwritten in the ordinary backup cycle.

9.Security

We use proportionate technical and organisational measures intended to protect personal information, including access controls, reputable hosted services and appropriate account and security practices.

No internet transmission or storage system can be guaranteed to be completely secure.

10.Your rights

Depending on the law that applies to you, you may have rights to:

• access your personal information;
• correct inaccurate information;
• request deletion;
• restrict processing;
• object to processing based on legitimate interests;
• receive certain information in a portable format;
• withdraw consent at any time where processing relies on consent;
• complain to a data-protection authority.

To exercise a right, email **alex@longson.studio**.

We may need to verify your identity before acting on a request.

Withdrawing consent does not affect processing that was lawful before withdrawal.

11.UK complaints

If you are in the UK, you can complain to the Information Commissioner's Office. We would appreciate the opportunity to address your concern first, but you are not required to contact us before approaching the regulator.

12.EEA complaints

If EU or EEA data-protection law applies to your interaction, you may also have the right to complain to the competent supervisory authority in your country.

13.Children

Our website and professional services are intended for adults and businesses and are not directed at children.

We do not knowingly seek to collect personal information from children through the public website.

14.Cookies and tracking

Our Cookie Policy explains the storage and access technologies used by the website.

Non-essential analytics and advertising technologies are not activated before the required consent has been obtained.

Visitors can change their choices at any time through Cookie Settings.

15.Changes to this policy

We may update this policy when our services, providers, processing or legal obligations change.

The current version and its last-updated date will be published here.

16.Contact

Privacy questions and rights requests:

**alex@longson.studio**

Alex Longson Ltd / Longson StudioThird Floor, 3 Hill StreetHill StreetEdinburgh, ScotlandEH2 3JP