Last updated: 20 July 2026

Privacy Policy

This policy explains what I do with personal data when you visit octarstudio.uk, email me, or work with me as an agency client. It applies to data I control directly. It does not cover data I handle on behalf of an agency while building a project — see “My two roles” below.

Who I am

Octar Studio is the trading name of David Down, a sole trader based in the UK. For data protection purposes, I am the data controller — meaning I decide what personal data is collected and why.

Name: David Down, trading as Octar Studio
Address: Available on request by email
Email: david@octarstudio.uk
ICO registration number: ZC139592

If you have any question about this policy or your data, email me at the address above.

My two roles

Most of the time I act in one of two ways, and it changes who is responsible for your data:

As a controller — for my own website, enquiries, and direct client relationships. This policy covers that, and I am responsible for it.
As a processor — when an agency hires me to build or design a project and I handle personal data belonging to their end-clients, I do so on the agency’s written instructions under a separate data processing agreement. In that case the agency is the controller, their privacy policy applies to those individuals, and any questions about that data should go to them.

This policy only covers data I control directly.

What I collect, why, and my lawful basis

Data	When / how	Why	Lawful basis
Email address and correspondence	When you email me directly	To handle our conversation	Legitimate interests — responding to people who choose to contact me
Technical data (IP address, browser type, pages visited)	Automatically, when you load the site	To keep the site secure, working, and debuggable	Legitimate interests — running a secure, functional website
Contact details, project details, contracts, invoices	When you engage me for work	To deliver the project, manage the relationship, and bill	Contract, plus legal obligation for financial records

Data: Email address and correspondence
When / how: When you email me directly
Why: To handle our conversation
Lawful basis: Legitimate interests — responding to people who choose to contact me
Data: Technical data (IP address, browser type, pages visited)
When / how: Automatically, when you load the site
Why: To keep the site secure, working, and debuggable
Lawful basis: Legitimate interests — running a secure, functional website
Data: Contact details, project details, contracts, invoices
When / how: When you engage me for work
Why: To deliver the project, manage the relationship, and bill
Lawful basis: Contract, plus legal obligation for financial records

I do not collect special category data (health, ethnicity, beliefs, and so on) through this site, and I don’t use the site to make automated decisions about you.

Who I share your data with

I don’t sell your data or share it for marketing. I use a small number of named service providers (“processors”) to run my business. Each handles data only on my instructions:

Vercel — hosts the website and processes server logs. (United States)
Google Workspace — runs my email (david@octarstudio.uk). (United States)
FreeAgent — accounting and invoicing. Holds client billing data. (United Kingdom)

I may also disclose data where I’m legally required to — for example, to HMRC, or in response to a lawful request.

Sending data outside the UK

Some of the providers above are based outside the UK, so your data may be transferred to the United States — Vercel and Google Workspace.

For transfers to the United States, the safeguard is either the UK Extension to the EU–US Data Privacy Framework (where the provider is certified under it) or the UK’s International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.

How long I keep your data

Data	Retention
Enquiries that don't lead to work	Up to 12 months after our last contact, then deleted
Client and project records, contracts, invoices	6 years from the end of the relevant tax year — required for HMRC and to handle any disputes
Server / security logs	Retained by my hosting provider (Vercel) for up to 1 day on my current plan

Data: Enquiries that don't lead to work
Retention: Up to 12 months after our last contact, then deleted
Data: Client and project records, contracts, invoices
Retention: 6 years from the end of the relevant tax year — required for HMRC and to handle any disputes
Data: Server / security logs
Retention: Retained by my hosting provider (Vercel) for up to 1 day on my current plan

When data is no longer needed, I delete it securely.

Your rights

Under UK data protection law you have the right to:

Access the personal data I hold about you
Correct it if it’s wrong or incomplete
Erase it, in certain circumstances
Restrict or object to how I use it
Port it to another provider, where applicable
Withdraw consent, where I’m relying on consent

To exercise any of these, email me at david@octarstudio.uk. I’ll respond within one month. There’s normally no charge.

How to complain

If you’re unhappy with how I’ve handled your data, tell me first — email david@octarstudio.uk. I’ll acknowledge your complaint within 30 days and work to resolve it without undue delay, keeping you informed of progress and the outcome.

If you’re still not satisfied, you have the right to complain to the Information Commissioner’s Office (ICO):

Website: ico.org.uk/make-a-complaint
Helpline: 0303 123 1113

You can complain to the ICO at any time, but raising it with me first usually gets it sorted faster.

Cookies

This site does not use tracking or advertising cookies, so there’s no cookie banner. Any cookies strictly necessary to make the site work are exempt from consent under UK rules.

Changes to this policy

I may update this policy as my business or the law changes. The “last updated” date at the top shows the current version. Material changes will be reflected here before they take effect.