Privacy Policy

1. Who We Are

Basil Studio Co is a freelance marketing consultancy based in London, United Kingdom.

Data controller: Basil Studio Co
Contact email: hello@thebasilstudio.co.uk

If you have any questions about this policy or how your data is handled, contact us using the details above.

2. What Data We Collect

We collect data in two ways: information you give us directly, and information collected automatically when you use the Site.

2.1 Information you give us directly

If you fill in a contact form, book a call, or email us, we may collect:

• •Your name
• •Your email address
• •Your phone number (if provided)
• •Your company name and website (if provided)
• •Any other information you choose to include in your message

2.2 Information collected automatically

When you visit the Site, we automatically collect certain technical information via cookies and similar tracking technologies, including:

• •IP address (anonymised where possible)
• •Browser type and version
• •Device type and operating system
• •Pages visited and time spent on each page
• •Referring website or search engine
• •Approximate geographic location (derived from IP address, not precise location)
• •Mouse movement, scroll depth, and click behaviour (via session recording/heatmap tools)

We do not collect sensitive personal data (such as health, religious beliefs, or political opinions) through the Site, and we do not knowingly collect data from children.

3. Cookies and Tracking Technologies We Use

Cookies are small text files stored on your device. We use the following categories:

3.1 Strictly necessary cookies

These are required for the Site to function (for example, remembering your cookie consent choices) and cannot be switched off. They do not require consent under PECR.

3.2 Analytics cookies: Google Analytics

We use Google Analytics (GA4) to understand how visitors use the Site, such as which pages are most popular and how visitors found us. Google Analytics uses cookies to collect this information.

• •Data collected: pages viewed, session duration, device/browser type, approximate location, referral source
• •Data processor: Google LLC
• •Data transfers: Google may process data on servers outside the UK/EEA, including in the United States. Google is certified under the EU-US and UK-US Data Privacy Framework, and/or transfers are governed by Standard Contractual Clauses (SCCs), where applicable.
• •Retention: Google Analytics data is retained for up to 2 months by default (Google Analytics 4's standard setting), or up to 14 months if a longer retention period has been configured, before automatic deletion.

Opt out: you can opt out of Google Analytics tracking using the Google Analytics Opt-out Browser Add-on, or by declining analytics cookies in our cookie consent banner.

3.3 Analytics cookies: Microsoft Clarity

We use Microsoft Clarity to record anonymised session behaviour, such as clicks, scrolls, and mouse movement, so we can understand and improve how visitors experience the Site (heatmaps and session recordings).

• •Data collected: on-page interactions, scroll and click behaviour, device/browser type, approximate location. Clarity is designed to mask sensitive input fields (such as passwords) automatically.
• •Data processor: Microsoft Corporation
• •Data transfers: Microsoft may process data outside the UK/EEA, governed by Standard Contractual Clauses and/or the UK-US Data Bridge, where applicable.
• •Retention: Clarity retains full session recordings for 30 days. A small sample of favourited or labelled recordings, and aggregated heatmap data, may be retained for up to 13 months.

Opt out: you can decline analytics cookies in our cookie consent banner to prevent Clarity from recording your session.

3.4 Advertising cookies (not currently in use)

We do not currently run paid advertising or remarketing campaigns using cookies (such as Google Ads or Meta Pixel). If we introduce advertising cookies in the future, this policy will be updated in advance, and our cookie consent banner will be updated to request your explicit opt-in consent before any advertising cookies are set, in line with PECR requirements. We encourage you to review this page periodically or check the “Last updated” date above.

3.5 Managing your cookie preferences

When you first visit the Site, you will be shown a cookie consent banner allowing you to accept or decline non-essential cookies (analytics). You can change your preferences at any time via the “Cookie Preferences” link in the Site footer. You can also block or delete cookies through your browser settings, though this may affect how parts of the Site function.

4. Legal Basis for Processing

Under UK/EU GDPR, we rely on the following legal bases:

Where we rely on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.

5. How We Use Your Data

We use the data we collect to:

• •Respond to enquiries and provide quotes or proposals
• •Understand how visitors use the Site so we can improve it
• •Identify which pages, content, or campaigns are performing well
• •Diagnose technical issues and improve Site performance
• •Comply with legal obligations, where applicable

We do not sell your personal data to third parties.

6. Who We Share Data With

We share limited data with the following categories of third-party processors, solely to operate the Site and our business:

• •Google LLC (Google Analytics) - website analytics
• •Microsoft Corporation (Clarity) - session recording and heatmaps
• •Cloudflare, Inc. - website hosting and infrastructure
• •Google LLC (Google Workspace) - processing enquiry emails
• •Supabase Inc. - storing lead data submitted through gated content downloads on the Site
• •Resend - sending transactional email notifications when a new lead comes in

Each of these providers is contractually bound to process data only as instructed and to apply appropriate security measures. We do not share your data with third parties for their own marketing purposes.

7. International Data Transfers

Some of our third-party processors (including Google and Microsoft) may process data outside the UK and European Economic Area, including in the United States. Where this occurs, we ensure appropriate safeguards are in place, such as:

• •Standard Contractual Clauses (SCCs) approved by the UK/EU
• •Adequacy decisions
• •Certification under the UK-US or EU-US Data Privacy Framework

8. Data Retention

We retain personal data only for as long as necessary for the purposes it was collected:

• •Enquiry/contact form data: retained for 24 months from your last contact with us, or until you request deletion
• •Analytics data (GA4/Clarity): retained per the periods set out in Section 3, in line with each provider's default or configured retention settings
• •Email correspondence: retained in line with our standard business record-keeping practices

9. Your Rights

Under UK/EU GDPR, you have the right to:

• •Access the personal data we hold about you
• •Rectify inaccurate or incomplete data
• •Erasure (“right to be forgotten”) of your data, subject to legal exceptions
• •Restrict how we process your data
• •Object to processing based on legitimate interest
• •Data portability, receiving your data in a structured, machine-readable format
• •Withdraw consent at any time, where processing is based on consent (such as analytics cookies)

To exercise any of these rights, contact us at hello@thebasilstudio.co.uk. We will respond within one month, as required by law.

If you believe we have not handled your data appropriately, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or your local supervisory authority if you are located in the EU.

10. Data Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse, including encrypted connections (HTTPS/TLS) across the Site and restricted access to any stored enquiry data. No method of transmission over the internet is entirely secure, and we cannot guarantee absolute security.

11. Children's Privacy

The Site is not directed at children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time, particularly if we introduce new tools such as advertising cookies. Any changes will be posted on this page with an updated “Last updated” date. We encourage you to review this policy periodically.

13. Contact Us

If you have questions about this Privacy Policy or how your data is handled, contact us at:

Email: hello@thebasilstudio.co.uk