Data Use Policy

Data Use Policy

We help brands earn trust. That starts with how we treat your data.

This policy explains what personal data we collect, why, who we share it with, how long we keep it and what rights you have. It’s written to meet the UK General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations and any other data protection laws that apply to us (together, Data Protection Laws).

Who we are and how to contact us
How and why we use personal data
Cookies and website visitors
Who we share personal data with
How long we keep personal data
How we keep personal data safe
International transfers
Your rights
How to complain
Updates to this policy

1. Who we are and how to contact us

We’re Straight Forward Design Limited (Straight Forward, we, us, our), a company registered in England and Wales with company number 06175417.

Studio and registered office: The Foundry, 5 Baldwin Terrace, London N1 7RU
Email: [email protected]
Phone: +44 (0)20 7580 2875

We’re the controller of the personal data described in this policy. That means we decide how and why it’s used, and we’re responsible for keeping it safe. We’re registered with the Information Commissioner’s Office (ICO) under registration number ZA347639.

We don’t need a formal Data Protection Officer, but every data protection question comes to one inbox: [email protected].

2. How and why we use personal data

A. Clients

We use personal data about the people we work with at our clients: employees, officers and representatives of client companies, and clients themselves if they’re sole traders.

What we collect: names, job titles, work contact details, correspondence, meeting notes and recordings (see section 2E), images and voices in video calls and workshop photos, and bank or payment details when money changes hands.

Where it comes from: you, your colleagues, the work itself (emails, calls, workshops), partners we work with on your projects, and public sources such as Companies House.

Why, and our lawful basis:

to deliver our services and manage our contract with you (contract, or our legitimate interests where the contract is with your employer)
to invoice, pay and keep financial records (legal obligation)
to run and grow our business, including showing our work where clients have agreed (legitimate interests)

If we don’t get the information we need to deliver a contract, we may not be able to deliver it.

B. Business contacts and prospective clients

We keep details of people we meet or want to work with: potential clients, partners, suppliers, freelancers and people we meet at events.

What we collect: name, job title, employer, work email, phone number, LinkedIn profile, notes of our conversations, and whether you open or click our emails.

Where it comes from: you, introductions, events, and public sources such as company websites, LinkedIn and trade press.

Why, and our lawful basis: to build business relationships and tell people about our work (legitimate interests). We manage these contacts in HubSpot. Every marketing email has an unsubscribe link, and if you’d rather not hear from us, we’ll stop.

C. Job applicants

We use personal data about people who apply to join us, whether directly or through a recruiter.

What we collect: your CV, portfolio, cover letter, correspondence, interview notes, any test or task you complete, references (only at offer stage, and only with your knowledge), and your right to work in the UK.

Why, and our lawful basis: to assess your application, communicate with you and keep fair records of our hiring decisions (steps before entering a contract, and our legitimate interests). We check right to work because the law requires it (legal obligation).

We don’t ask for special category data, such as health information. If you tell us you need an adjustment during the process, we’ll use that information only to make the adjustment, and we’ll handle it with extra care as Data Protection Laws require.

If you’re unsuccessful, we keep your details for six months after we tell you our decision, so we can show our process was fair if it’s ever questioned. Then we delete them. If we’d like to keep you on file for future roles, we’ll ask first. If you join us, your application becomes part of your personnel file.

D. Visitors to our studio (CCTV)

We run CCTV at The Foundry to keep our people, visitors and premises safe and to prevent and detect crime (legitimate interests). We use it for nothing else. Signs tell you where cameras operate. Footage is kept for a short period (see section 5) and only reviewed if there’s an incident. We follow the ICO’s guidance on video surveillance and have a separate CCTV policy, which we’ll share on request.

E. AI tools and meeting notes

We use AI tools to help us do better work. That includes assistants that help us research, draft and analyse, and tools that record, transcribe and summarise meetings.

Meetings: if we record or transcribe a call, we’ll tell you at the start. You can ask us not to, and we’ll take notes by hand instead.
What goes in: these tools may process your name, voice, image and what’s said in a meeting or written in a document.
Safeguards: we use business versions of these tools, under terms that stop the provider using your data to train its models. Where a client contract sets rules on AI use, we follow them.
Judgement stays human: we don’t use AI to make decisions about you that have legal or similarly significant effects.

Why, and our lawful basis: to keep accurate records and work efficiently for our clients (legitimate interests).

3. Cookies and website visitors

You can browse our website without telling us who you are. We only learn your name and contact details if you get in touch.

Cookies are small files a website stores on your device. These are the ones we use:

Cookie	Set by	What it does	Your choice
Consent cookies (cmplz_*)	Us	Remember whether you accepted or rejected cookies	Always on. The site needs them to respect your choice
Google Analytics 4 (_ga, _ga_*)	Google	Counts visits and shows which pages people use, so we can improve the site	Only if you accept
HubSpot (__hstc, hubspotutk, __hssc, __hssrc)	HubSpot	Measures visits and, if you’ve contacted us, links your visits to your contact record	Only if you accept
Embedded videos, maps and Instagram posts	Vimeo, Google, Instagram	Lets this content play or load on our pages	Only if you accept

You can accept or reject cookies on our banner, and change your mind at any time using the Cookie settings link at the bottom of every page. You can also block cookies in your browser settings, or install Google’s opt-out add-on.

Links to other sites. Our site links to Instagram, LinkedIn, Threads, Facebook and X. Those sites have their own privacy policies, and this one doesn’t cover them.

We don’t sell personal data. We share it only when we need to:

Service providers who run parts of our business for us, under contract and only on our instructions: cloud and productivity tools (such as Google Workspace and Dropbox), our CRM (HubSpot), video calling, AI assistants and meeting note-takers, and IT support
Partners on your project, such as production partners or other agencies, where we’re working with them for you
Professional advisers, such as accountants, lawyers and insurers
Recruiters, when they’ve introduced a candidate to us
Authorities and regulators, including the ICO, when the law requires it
A buyer or investor, if we’re ever part of a merger, acquisition or similar deal, so our clients keep getting our services without interruption

Every service provider we use has given us written guarantees that they’ll keep personal data safe and use it only to provide their service to us.

5. How long we keep personal data

We keep personal data only as long as we need it for the reason we collected it, or to meet legal, tax and accounting rules. Then we delete it securely.

Data	How long we keep it
Client contracts and project records	6 years after our work together ends
Invoices and payment records	6 years after the end of the financial year
Business contacts	While we have an active relationship. We review our contacts every 2 years and delete those that have gone quiet
Unsuccessful job applicants	6 months after we tell you our decision
Meeting recordings	90 days. Written notes and summaries stay with the project file
CCTV footage	30 days, unless we need it for an incident
Website analytics	14 months

6. How we keep personal data safe

We protect personal data with physical and technical security: a secure, access-controlled studio, encrypted devices, multi-factor sign-in on our business systems, and regular back-ups.

Only people who need personal data to do their job can access it. Everyone who works with us, including freelancers and contractors, is bound by confidentiality.

If something goes wrong, we have a process to deal with it. Where the law requires, we’ll tell the ICO within 72 hours and tell you without undue delay.

7. International transfers

We mostly store personal data in the UK and the European Economic Area. Some of our service providers are based in, or use, other countries, including the United States.

Before personal data leaves the UK, we make sure it stays protected to UK standards. We do that by using providers in countries or frameworks the UK recognises as adequate, or by putting UK-approved safeguards in place, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

If you’d like more detail on these safeguards, email [email protected].

8. Your rights

Data Protection Laws give you these rights over your personal data:

Access: get a copy of the personal data we hold about you
Correction: have inaccurate or incomplete data put right
Erasure: ask us to delete your data, unless we have a lawful reason to keep it
Objection: object to us using your data for our legitimate interests, and stop direct marketing at any time
Restriction: ask us to limit how we use your data in certain circumstances
Portability: get data you gave us in a structured, machine-readable format, or have it sent to someone else, where we use it under a contract or your consent
Withdraw consent: where we rely on your consent, withdraw it at any time
Automated decisions: we don’t make decisions about you by automated means alone that have legal or similarly significant effects. If that ever changes, you’ll be able to challenge them and ask for a person to review them

How to make a request. Email [email protected] or write to Data Protection Requests, Straight Forward Design Limited, The Foundry, 5 Baldwin Terrace, London N1 7RU.

What happens next. We’ll respond within one month. If your request is complex, or you’ve made several, we may need up to two more months, and we’ll tell you why. We may ask you to confirm your identity or clarify what you’re looking for, and the clock pauses until you do. We’ll carry out reasonable and proportionate searches for your data.

Fees. Making a request is free. We may charge a reasonable fee, or refuse, if a request is clearly unfounded or excessive. Some rights have exceptions, and we’ll explain if one applies.

9. How to complain

If you’re unhappy with how we’ve handled your personal data, tell us first. We’d rather put it right than have you wait.

Complain by email to [email protected], or by post to the studio address above
We’ll acknowledge your complaint within 30 days
We’ll look into it promptly, keep you updated and tell you the outcome

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. The ICO will usually expect you to have raised your complaint with us first.

10. Updates to this policy

We review this policy when our tools, our business or the law change. The current version always lives on our website.

This policy was last updated in October 2026.