Privacy Notice

Who is responsible

Morphos Studio, contactable at [email protected], is the controller of the personal data described here. There is no separate data protection officer; enquiries about data are handled directly by the studio.

What we collect

• Enquiry data — the name, email address, country, website address and project details you send us, plus anything you attach or write to us afterwards.
• Correspondence — emails, meeting notes and files exchanged while a project is discussed or delivered.
• Project data — material you supply for a website (copy, photography, product data, access credentials) and the work we produce from it.
• Usage data — anonymised page views and referring links, collected without advertising identifiers.
• Technical data — IP address, browser and device type, and the timestamps recorded by our hosting provider when this site is served.

Why we use it

• To answer your enquiry and, if we work together, to deliver the project — the legal basis is performance of a contract or steps taken at your request before one.
• To keep the site working and secure — technical logs and abuse prevention, on the basis of our legitimate interest in a functioning, safe service.
• To send occasional studio updates — only where you have asked for them, and every message carries a one-click unsubscribe.
• To meet legal and accounting obligations — invoices and tax records, on the basis of legal obligation.

What we do not do

We do not sell your data. We do not rent, share or trade your email address or project material with advertisers, lead brokers or data resellers. We do not use your project material to train models. We do not run advertising or cross-site tracking cookies on this site.

Cookies and storage

This site sets no marketing or analytics cookies. The only browser storage used is strictly functional: remembering a language preference, and the security tokens that keep a form submission attached to your own session. Blocking that storage does not break the site; it may only cause a form to be re-checked.

Who else sees it

We keep the number of third parties deliberately small. Data may be processed by our hosting and content delivery provider (Cloudflare), our email provider, and our accounting software — each under their own contractual safeguards. Where data leaves the UK or Switzerland, transfers rely on adequacy decisions or standard contractual clauses. A current list of processors is available on request.

How long we keep it

• Enquiry correspondence that does not lead to a project — 24 months from the last exchange.
• Active client project material — for the duration of the project and 24 months after handover, then returned or deleted on request.
• Invoices and accounting records — the statutory retention period in the relevant jurisdiction (currently ten years in the UK).
• Server logs — a maximum of 30 days.

Your rights

Depending on where you live you may have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent at any time. To exercise any of these, email [email protected]. We answer within 30 days. If you are in the UK or Switzerland you may also complain to the ICO or the FDPIC; we would rather you came to us first.

Security

Access to client material is limited to the people working on the project. Credentials are stored in a password manager rather than in documents or email, sites are served over HTTPS, and access is revoked when a project closes. No system is perfect; if a breach ever affected your data we would tell you directly and promptly.

Changes

If this notice changes in a way that affects you, the date below changes with it and material changes are flagged to anyone we are actively corresponding with.

Last updated: 17 October 2026