Privacy Policy

1. Who we are

Blume Studio (“we”, “us”, “our”) is a creative consultancy registered in England. For any privacy-related questions, you can reach us at privacy@blume-studio.com.

We are the data controller for personal data collected through this website and our services. This means we decide how and why your personal data is processed.

2. What data we collect

We collect the following categories of personal data:

Data you provide directly

When you submit our contact form, we collect your name, email address, project type, budget range, and project brief. This information is necessary to respond to your enquiry and assess how we can help.

Data collected automatically

When you visit our website, we may collect technical data including your IP address, browser type and version, device type, operating system, referring URL, pages visited, and the date and time of your visit. This data is collected through cookies and similar technologies, subject to your preferences.

Data from working relationships

If you become a client, we may additionally hold your business name, billing address, payment details (processed by our payment provider — we do not store card numbers), project files, communications history, and any other information exchanged during the course of our work together.

3. How we use your data

We process your personal data for the following purposes:

To respond to enquiries — when you submit our contact form, we use your details to reply and discuss your project. The legal basis is our legitimate interest in responding to prospective clients.

To deliver our services — if we enter into a working relationship, we process your data as necessary to perform our contract with you.

To improve our website — if you consent to analytics cookies, we use anonymised usage data to understand how visitors interact with our site and improve the experience. The legal basis is your consent.

To send communications — if you opt in to receive updates from us, we may send occasional emails about our work, journal posts, or studio news. The legal basis is your consent, and you can unsubscribe at any time.

To comply with legal obligations — we may process data where required by law, for example in relation to tax records or responding to lawful requests from authorities.

4. Cookies

Our website uses cookies — small text files stored on your device — to function properly and, with your permission, to understand how you use the site.

Essential cookies are required for the website to function and cannot be disabled. They handle things like remembering your cookie preferences and maintaining session state.

Analytics cookies help us understand how visitors interact with our website by collecting anonymised usage data. These are only set if you consent.

Marketing cookies may be used for personalised advertising across platforms. These are only set if you consent.

You can manage your cookie preferences at any time through our privacy settings page.

5. How we share your data

We do not sell your personal data. We may share it with the following categories of third parties, only as necessary:

Email service providers — we use Resend to process contact form submissions and deliver emails on our behalf.

Hosting and infrastructure — our website is hosted on Vercel. Your technical data (IP address, request logs) may be processed by Vercel as part of serving the website.

Analytics providers — if you consent to analytics cookies, anonymised usage data may be shared with our analytics provider.

Professional advisors — we may share data with our accountants or legal advisors where necessary.

All third-party processors are contractually bound to handle your data securely and only for the purposes we specify.

6. International transfers

Some of our service providers (such as Vercel and Resend) are based in the United States. Where your data is transferred outside the UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK Information Commissioner's Office.

7. How long we keep your data

Contact form submissions — we retain enquiry data for up to 12 months after our last communication, unless a working relationship begins.

Client data — we retain project files and communications for up to 6 years after a project concludes, in line with HMRC record-keeping requirements.

Analytics data — anonymised analytics data is retained for up to 26 months.

Marketing preferences — we retain your consent records for as long as you remain subscribed, plus 12 months after unsubscribing.

8. Your rights

Under UK data protection law (UK GDPR and the Data Protection Act 2018), you have the following rights:

Access — you can request a copy of the personal data we hold about you.

Rectification — you can ask us to correct inaccurate or incomplete data.

Erasure — you can ask us to delete your personal data, subject to any legal obligations we have to retain it.

Restriction — you can ask us to limit how we process your data in certain circumstances.

Portability — you can request your data in a structured, machine-readable format.

Objection — you can object to processing based on legitimate interests.

Withdraw consent — where processing is based on your consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, email us at jess@blume-studio.com. We will respond within one month. You can also manage some preferences directly through our privacy settings.

9. Data security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. This includes using HTTPS encryption, secure email providers, and limiting access to personal data to authorised team members only.

However, no method of transmission over the internet is completely secure. While we strive to protect your data, we cannot guarantee its absolute security.

10. Children's privacy

Our website and services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will delete it promptly.

11. Changes to this policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically. If we make significant changes that affect how we process your personal data, we will notify you directly where possible.

12. Complaints

If you have concerns about how we handle your data, please contact us first at jess@blume-studio.com and we will do our best to resolve the issue.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection. You can contact the ICO at ico.org.uk or by phone on 0303 123 1113.