Privacy Policy

Last updated: 19 October 2026

1. Who we are

Authentika Studio is a sole-trader creative marketing business based in Norwich, Norfolk, United Kingdom. Our data controller contact is:

Tadas Kirtiklis
Authentika Studio
Norwich, Norfolk, United Kingdom
hello@authentika.studio

2. What personal data we collect

We may collect and process the following categories of personal data:

• Contact and enquiry data: name, email address, phone number, and any information you provide in a contact or consultation form.
• Communications data: emails, messages, or other correspondence you send us.
• Website usage data: IP address, browser type and version, pages visited, time and date of visit, and referring URL, collected automatically via server logs or analytics tools.
• Business information: company name, industry, and project details provided during a consultation or project engagement.

We do not collect special category data (e.g. health, financial, or biometric data).

3. How we collect your data

We collect personal data when you:

• complete and submit a contact or consultation form on our website;
• email or message us directly;
• engage us for marketing or creative services; or
• browse our website (usage data collected automatically).

4. Lawful basis for processing

We process your personal data on the following lawful bases under UK GDPR Article 6:

• Legitimate interests (Article 6(1)(f)): to respond to enquiries, manage client relationships, and operate our business.
• Contract (Article 6(1)(b)): where processing is necessary to perform a contract with you or take steps prior to entering into one.
• Consent (Article 6(1)(a)): where you have specifically agreed to receive marketing communications from us. You may withdraw consent at any time.
• Legal obligation (Article 6(1)(c)): where we are required by law to retain or process certain information (e.g. for tax purposes).

5. How we use your data

We use your personal data to:

• respond to your enquiries and provide information about our services;
• deliver the creative or marketing services you have engaged us for;
• send service updates and relevant communications relating to your project;
• improve our website and services;
• comply with legal and regulatory obligations; and
• send marketing communications where you have consented.

We will never sell your personal data to third parties.

6. Who we share your data with

We use the following third-party services, which receive personal data when you use our website. We do not sell your data to anyone.

• Google Analytics 4 (Google Ireland Limited) — measures how the site is used. It receives your IP address, the pages you view and technical information about your browser, and it sets cookies on your device. Advertising features, ad personalisation and Google Signals are switched off. Google may process this data on servers outside the UK, including in the United States, under the UK extension to the EU–US Data Privacy Framework and standard contractual clauses.
• Web3Forms — delivers our contact form to our inbox. It receives everything you put in the form: your name, company, email address, phone number and message.
• ipapi.co — receives your IP address once, only if you start filling in the contact form, so that the phone field can offer the right international dialling code.
• Gumlet — hosts and plays the videos embedded on some pages. Where a video is present, its player receives your IP address and collects its own playback analytics and error reports.
• Unsplash and Iconify — deliver some images and icons. They receive your IP address as part of serving those files.
• Our hosting — the website runs on a virtual server we manage ourselves. Its logs record IP addresses, requested pages and timestamps.

We also use an email provider to send and receive messages, and professional advisers and HMRC where we are required to share records. All processors are required to handle your data securely and only for the purposes we specify.

7. How long we keep your data

We retain personal data only for as long as necessary:

• Enquiry data: up to 12 months if no contract is formed, or for the duration of the client relationship plus 6 years thereafter to meet legal obligations.
• Financial and contractual records: 6 years as required by HMRC.
• Website analytics data: 14 months in Google Analytics, after which Google deletes the underlying event data. Aggregated reports may be kept for longer.
• Server logs: up to 30 days.

8. Cookies and analytics

We want to be straightforward about this. Google Analytics starts when a page on this site loads, and it sets cookies on your device at that point. We do not ask first. We run it to understand which pages are useful, on the basis of our legitimate interests under Article 6(1)(f) of the UK GDPR.

You should know that the Information Commissioner’s Office takes the view that analytics cookies are not strictly necessary and should therefore be set only with consent under the Privacy and Electronic Communications Regulations. We have chosen to run analytics from the first visit and to give you a clear, immediate way to switch it off, rather than to ask for consent through a banner. We would rather tell you exactly what happens than describe something we do not do.

We do not run advertising, we do not sell your data, and ad personalisation and Google Signals are switched off, so your visits are not used to build an advertising or cross-device profile.

If your browser sends a Global Privacy Control signal, we treat that as an objection under Article 21 and do not measure your visit at all.

Our Cookie Policy lists every cookie by name, what it does and how long it lasts. You can also block or delete cookies in your browser settings at any time.

9. Your rights under UK GDPR

You have the following rights in relation to your personal data:

• Right of access: to request a copy of the data we hold about you.
• Right to rectification: to ask us to correct inaccurate data.
• Right to erasure: to ask us to delete your data where there is no compelling reason to continue processing it.
• Right to restrict processing: to ask us to limit how we use your data.
• Right to data portability: to receive your data in a structured, machine-readable format where technically feasible.
• Right to object: to object to processing based on legitimate interests or for direct marketing purposes.
• Rights related to automated decision-making: we do not carry out solely automated decision-making that produces legal or similarly significant effects.

To exercise any of these rights, please contact us at hello@authentika.studio. We will respond within one month of receiving your request.

10. Right to lodge a complaint

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office (ICO):

Website: ico.org.uk
Phone: 0303 123 1113

We would, however, appreciate the chance to address your concerns before you contact the ICO.

11. Security

We take appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, disclosure, alteration, or destruction. All data is transmitted over encrypted connections (HTTPS).

12. Third-party links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies before providing any personal data.

13. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will reflect any changes. We encourage you to review this policy periodically.

14. Contact us

For any questions or concerns about this Privacy Policy or our data practices, please contact:

Authentika Studio
hello@authentika.studio