This notice explains how By Default collects and uses your personal data when you visit bydefault.studio or get in touch with us. We keep it plain and we keep it short, because that's how privacy should be.
Who we are
Anonymous Innovators Ltd ("By Default", "we", "us", "our") is the "data controller" responsible for your personal data. We're a company registered in England and Wales (company number 12681300), with our registered office at 124 City Road, London, EC1V 2NX.
For anything privacy-related, contact us at hello@bydefault.studio.
[If applicable, once registered: We are registered with the UK Information Commissioner's Office (ICO) under registration number [ICO number].]
The data we collect
When you contact us or book a call. If you use our contact form or booking flow, we collect the details you give us, typically your name, email address, company, and whatever you write in your message. We use this to respond to you and to discuss potential work.
When you browse the site. Like most websites, we collect limited technical and usage data through Google Analytics, for example pages visited, approximate location, device and browser type, and how you arrived. This is collected via cookies, which you can control as described in our Cookie Policy.
Embedded content and interactive experiences. We embed video from Vimeo across the site, and some Playground experiences use interactive maps powered by Mapbox. These third-party tools are needed for those experiences to work, and when you interact with them the provider may collect data about you (such as your IP address) as if you'd visited their site directly. We don't control that, see "Who we share it with" below.
We do not knowingly collect data from children, and we don't ask you for special-category data (such as health, ethnicity, or beliefs).
Why we use it, and our legal basis
Under UK GDPR we need a lawful basis for using your data:
- To respond to enquiries and discuss work: our legitimate interest in answering people who contact us, and taking steps toward a possible contract.
- To understand and improve the site: our legitimate interest in seeing how the site is used. You can control analytics cookies at any time (see our Cookie Policy).
- To send you information you've asked for: your consent, which you can withdraw at any time.
- To meet legal and accounting obligations, and to protect our rights: compliance with the law and our legitimate interests.
Who we share it with
We don't sell your data, and we don't share it for anyone else's marketing. We do use trusted service providers who process personal data on our behalf and on our instructions, so that we can run the studio. These fall into the following categories:
- our website hosting and infrastructure provider;
- our analytics provider (Google Analytics, provided by Google);
- our email and scheduling tools;
- video hosting (Vimeo) and interactive mapping (Mapbox) for embedded and interactive content.
We may also disclose data if the law requires it, or where necessary to establish, exercise, or defend our legal rights. We can provide the names of the specific providers we use on request.
International transfers
Some of our providers (including Google, Vimeo, and Mapbox) are based outside the UK, typically in the United States. Where your data is transferred abroad, we rely on appropriate safeguards, such as the UK's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, so it stays protected.
How long we keep it
We don't keep personal data longer than we need it. In practice:
- Enquiry and contact data: kept while we deal with your enquiry and for up to 24 months after our last contact, then deleted. If we begin working together, your data is kept for the duration of our engagement under our client agreement.
- Client and financial records: where we enter into a contract, related records (including invoices) are kept for 6 years after the end of the relationship, to meet HMRC, accounting, and legal obligations.
- Analytics data: Google Analytics retains user and event level data for 14 months, after which it is automatically deleted. Aggregated, anonymised reporting may be kept for longer.
Your rights
Under UK GDPR you have the right to: access your data; have it corrected; have it deleted; restrict or object to how we use it; ask for portability; and withdraw consent at any time where we rely on it. To exercise any of these, email us at hello@bydefault.studio and we'll respond within one month.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk, though we'd appreciate the chance to put things right first.
Changes to this notice
We may update this notice from time to time. The "last updated" date above shows the current version.