01 Who We Are
Hexagon Studio Ltd is a UK-based automation and AI consultancy. We are the data controller for any personal data we collect through our website, services, and AI-powered systems.
If you have any questions about how we handle your data, please contact us at contact@hexagon-studio.com.
02 What We Collect
We collect personal data in the following ways:
Website contact form
- Your name and email address
- The content of your message
- Your service enquiry type (if selected)
Website chat widget
- The content of your messages
- Your name or email address — if provided during the conversation
- A summary record of your enquiry, stored for follow-up purposes
WhatsApp AI chatbot
- Your WhatsApp phone number — collected automatically when you initiate a conversation
- Your WhatsApp display name — collected automatically from your WhatsApp profile
- Your email address — if provided during the conversation
- The content of your messages
- A summary record of your enquiry, stored for follow-up and lead-handling purposes
Automation services delivered to clients
- Data processed as part of delivering automation workflows is handled on behalf of our clients. Clients are responsible for their own privacy obligations to their end users.
We do not collect sensitive personal data (such as health information, financial data, or government identifiers) through any of our standard services.
03 How We Use Your Data
- To respond to your enquiries and provide the services you request
- To manage leads and arrange discovery calls or project scoping
- To fulfil our contractual obligations to clients
- To comply with legal and regulatory obligations
We do not sell, rent, or trade your personal data with third parties for marketing purposes.
04 Legal Basis for Processing
Under UK GDPR, we rely on the following lawful bases:
- Contract — processing is necessary to perform or prepare a contract with you
- Legitimate interests — for responding to enquiries and managing our business, where this does not override your rights
- Legal obligation — where we are required to retain data by law
- Consent — where you have explicitly provided consent, such as subscribing to updates
05 Third-Party Services
We use third-party services in the course of our work, which may process personal data on our behalf. These fall into the following categories:
- Cloud hosting and infrastructure — servers and infrastructure used to run our automation systems, hosted within the UK or EU where possible
- AI processing — language model services used to power chatbot responses; data is processed transiently in accordance with the AI provider's data processing terms. We do not opt in to any model training programmes
- Database and storage — services used to store lead records, conversation context, and client data securely
- Messaging platforms — third-party platforms used to deliver messages (e.g. via WhatsApp Business API or other channels), subject to those platforms' own terms
- Communication and project tools — tools used internally to manage client projects and communications
All third-party providers are selected with data security in mind. Where data is transferred outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) where applicable. Details of specific providers used in your project are available on request.
06 Data Retention
- Contact form enquiries — retained for up to 2 years, then deleted or anonymised
- Chat widget and WhatsApp conversation data — retained for up to 12 months from last contact
- Lead records in our database — retained for up to 2 years or until you request deletion
- Client project data — working data (workflow configurations, project files, and related content) is retained for the duration of the engagement plus up to 2 years
- Contracts, invoices, and billing records — retained for 6 years from the end of the financial year they relate to, as required by UK tax and company law
You may request deletion of your data at any time by contacting us at contact@hexagon-studio.com.
07 Cookies
Our website currently uses no third-party tracking cookies and no analytics tools. The site is static HTML and does not set any persistent cookies.
If this changes in future, this policy will be updated and a cookie notice will be added to the site.
08 Your Rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data ("right to be forgotten") where applicable
- Restrict processing in certain circumstances
- Data portability — receive your data in a structured, machine-readable format
- Object to processing based on legitimate interests
- Withdraw consent at any time where processing is based on consent
To exercise any of these rights, contact us at contact@hexagon-studio.com. We will respond within 30 days.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
09 Security
We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Our server infrastructure is hardened with firewall rules, intrusion prevention, and encrypted connections (SSL/TLS).
No method of transmission over the internet is 100% secure. If you believe your data has been compromised, please contact us immediately.
10 Children
Our services are not directed at children under the age of 13. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected such data, we will delete it promptly.
11 Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our services or legal requirements. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.
12 Contact Us
If you have any questions, concerns, or requests relating to this Privacy Policy or how we handle your personal data, please contact us: