Legal

Privacy Policy

Last updated: 16 July 2026  |  Compliant with UK GDPR & Data Protection Act 2018

1. Who We Are

Xyna Design ("the Studio", "we", "us", "our") is a self-employed graphic design studio operated as a sole trader, registered in England and Wales. Our principal place of business is 12 Bermondsey Street, Southwark, London SE1 3TX.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Xyna Design is the data controller of the personal data collected through this website and in the course of providing design services.

Xyna Design is registered with the Information Commissioner's Office (ICO) in the UK. Our ICO registration number is [ZB000000]. You can verify our registration at ico.org.uk.

2. Personal Data We Collect

Information you provide directly

• Contact enquiries: When you contact us via email or the website contact form, we collect your name, email address, telephone number, company name, and the content of your message.
• Project briefs: Information provided when commissioning work, including business details, project requirements, and any personal data contained in materials you supply.
• Financial information: Billing name and address for invoice purposes. We do not store payment card details; payments are processed via secure third-party platforms.

Information collected automatically

• Usage data: IP address, browser type, device type, pages visited, time on site, and referral source, collected via analytics tools.
• Cookies: See Section 9 (Cookies & Tracking) for full details.

3. How We Use Your Data

We use the personal data we collect for the following purposes:

• To respond to your enquiries and manage our client relationship with you.
• To provide the graphic design and related services you have commissioned.
• To issue invoices and manage payments.
• To comply with our legal and contractual obligations.
• To improve our website and services through analysis of usage data.
• To send project-related communications (we do not send unsolicited marketing emails).

We do not use your personal data for automated decision-making or profiling.

4. Legal Basis for Processing

Under UK GDPR, we process your personal data on the following legal grounds:

• Contract (Article 6(1)(b)): Processing necessary to enter into or perform a contract with you, including responding to project enquiries and delivering commissioned services.
• Legitimate Interests (Article 6(1)(f)): Processing necessary for our legitimate business interests, including website analytics and portfolio maintenance, provided these interests are not overridden by your rights and interests.
• Legal Obligation (Article 6(1)(c)): Processing required to comply with applicable law, including tax and accounting obligations.
• Consent (Article 6(1)(a)): Where you have provided explicit consent, such as via the GDPR consent checkbox on our contact form. You may withdraw your consent at any time.

5. Data Sharing

We do not sell, rent, or otherwise transfer your personal data to third parties for their marketing purposes.

We may share your personal data with:

• Accountants and financial advisers: To prepare accounts and comply with tax obligations (under legal obligation).
• Cloud service providers: We use encrypted cloud storage (such as Google Drive or equivalent) to store project files securely. These providers act as data processors under agreements that comply with UK GDPR.
• Communication tools: Email and video conferencing platforms used to deliver the service.
• Legal authorities: Where required by law, court order, or other governmental or regulatory authority.

We do not transfer personal data outside the United Kingdom or the European Economic Area without ensuring that adequate safeguards are in place, as required by UK GDPR Chapter V.

6. Data Retention

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by law:

• Client project files and correspondence: Retained for 7 years following completion of a project, in accordance with HMRC requirements for financial records.
• General enquiries (non-clients): Retained for 2 years from the date of last contact, after which they are securely deleted unless a project has commenced.
• Website analytics data: Retained in accordance with the data retention settings of the relevant analytics platform (typically 26 months).

When data is no longer required, we delete or anonymise it securely.

7. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, disclosure, or destruction. These measures include:

• Encrypted storage for all client files and personal data.
• Secure, password-protected access to all devices and accounts holding personal data.
• Use of reputable, GDPR-compliant third-party service providers.
• Regular review of our data security practices.

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO as required by UK GDPR Article 33/34.

8. Your Rights Under UK GDPR

Under the UK GDPR, you have the following rights regarding your personal data:

• Right of Access (Article 15): You have the right to request a copy of the personal data we hold about you (a Subject Access Request).
• Right to Rectification (Article 16): You have the right to request that inaccurate or incomplete personal data is corrected.
• Right to Erasure / "Right to be Forgotten" (Article 17): You may request that we delete your personal data, subject to our legal obligations to retain certain records.
• Right to Restriction of Processing (Article 18): You may request that we restrict the processing of your data in certain circumstances.
• Right to Data Portability (Article 20): Where processing is based on consent or contract and carried out by automated means, you may request your data in a structured, machine-readable format.
• Right to Object (Article 21): You may object to processing based on legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your rights.
• Right to withdraw consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, please contact us at hello@xynadesign.co.uk or by post to our London address. We will respond within one calendar month of receiving your request, as required by UK GDPR.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues: ico.org.uk/make-a-complaint or by telephone on 0303 123 1113.

9. Cookies & Tracking

Our website may use cookies and similar tracking technologies. Cookies are small text files stored on your device when you visit our website.

Types of cookies we use

• Strictly Necessary Cookies: Required for the website to function correctly. These cannot be disabled.
• Analytics Cookies: Used to understand how visitors interact with our website (e.g. pages visited, time spent). These are only placed with your consent.
• Preference Cookies: Used to remember your settings and preferences. These are only placed with your consent.

We do not use advertising or tracking cookies that follow you across other websites.

You can control and delete cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our website. For more information on managing cookies, visit aboutcookies.org.

10. Children's Privacy

Our website and services are not directed at children under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child, we will delete such data promptly. If you believe we may have collected data from or about a child, please contact us immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in applicable law. When we make changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

For significant changes that materially affect how we process your personal data, we will notify you by email where we hold your contact details.

12. How to Contact Us

For any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

• Email: hello@xynadesign.co.uk
• Post: Xyna Design, 12 Bermondsey Street, Southwark, London SE1 3TX

We aim to respond to all data protection queries within 5 business days, and to all formal rights requests within one calendar month as required by UK GDPR.