Privacy policy

1. Who we are

Hexagon Studio Ltd is a UK consultancy that designs and builds custom systems for businesses. We are the data controller for personal data collected through this website and while running our own business.

If you have any questions about how we handle your data, email contact@hexagon-studio.com.

2. What we collect

Website contact form

• Your name and email address
• The content of your message
• The type of project you selected, if any

Website chat assistant

• The content of your messages
• Your name or email address, if you share them during the conversation
• A summary of your enquiry, kept for follow-up

Systems and tools we build or host for clients

When we build, host or maintain a system or web tool for a client, any personal data processed by it is handled on that client's behalf. In that role we act as a data processor, working under the client's instructions and a written agreement. Clients remain responsible for their own privacy obligations to their customers and users.

We don't collect special category data, such as health information, through this website.

3. How we use your data

• To reply to your enquiry and provide the services you ask for
• To arrange first conversations and plan projects
• To meet our contractual obligations to clients
• To comply with legal and regulatory obligations

We don't sell, rent or trade your personal data.

4. Legal basis for processing

Under UK GDPR, we rely on the following lawful bases:

• Contract: processing needed to prepare or perform a contract with you
• Legitimate interests: replying to enquiries and running our business, where this doesn't override your rights
• Legal obligation: where the law requires us to keep records
• Consent: where you have given it explicitly

5. Third-party services

We use third-party services that may process personal data on our behalf:

• Hosting and infrastructure: the servers that run this website and our systems, located in the UK or EU where possible
• AI processing: language model services that power the chat assistant. Data is processed under the provider's data processing terms, and we don't opt in to any model training
• Database and storage: services that store enquiry records and conversation context securely
• Email and project tools: services we use to communicate with clients and manage projects

Where data is transferred outside the UK, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Addendum or Standard Contractual Clauses. Details of the providers used in a specific project are available on request.

6. How long we keep data

• Contact form enquiries: up to 2 years, then deleted or anonymised
• Chat assistant conversations: up to 12 months from your last message
• Enquiry records: up to 2 years, or until you ask us to delete them
• Client project data: for the length of the engagement plus up to 2 years, unless the client's agreement says otherwise
• Contracts, invoices and billing records: 6 years from the end of the financial year they relate to, as UK tax and company law require

You can ask us to delete your data at any time by emailing contact@hexagon-studio.com.

7. Cookies and browser storage

This website doesn't use cookies, analytics or advertising trackers. Fonts are served from our own server, so visiting the site doesn't send your details to font providers.

The chat assistant stores a random session reference in your browser's session storage, so it can keep a conversation together while you move between pages. It contains no personal details and is removed when you close the tab.

If this changes, we'll update this policy and add a notice to the site.

8. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Erase your data, where this applies
• Restrict processing in certain circumstances
• Receive your data in a structured, machine-readable format
• Object to processing based on legitimate interests
• Withdraw consent at any time, where processing relies on it

To use any of these rights, email contact@hexagon-studio.com. We'll respond within one month.

You can also complain to the Information Commissioner's Office at ico.org.uk.

9. Security

We use appropriate technical and organisational measures to protect personal data from unauthorised access, loss or disclosure. Our servers are protected by firewall rules and intrusion prevention, and all connections are encrypted.

No method of sending data over the internet is completely secure. If you think your data has been compromised, contact us immediately.

10. Children

Our services aren't aimed at children under 13, and we don't knowingly collect their personal data. If we find we have, we'll delete it promptly.

11. Changes to this policy

We may update this policy to reflect changes to our services or the law. When we do, we'll change the date at the top of this page.

12. Contact us

For questions or requests about this policy or your personal data: