What we do with your data, plainly.
If you fill in our form, email us, or just visit the site, this page tells you exactly where your information goes, who else sees it, and how long it stays there.
The data controller, in legal terms.
LevelFive Studio Ltd is the data controller for the personal data described on this page. Our registered company number, registered office, and ICO data protection registration number will be shown in the site footer once incorporation is complete. Until then, email any privacy query to [email protected]. A real person reads that inbox and replies.
"Personal data" on this page means information about you as an individual, in the sense the UK GDPR uses the term. This notice covers the UK GDPR and the Data Protection Act 2018.
The enquiry form, your emails, and analytics you choose.
-
Enquiry form submissions
When you fill in the form on /contact, we receive your name, work email, company name, role, the kind of help you are asking for, an indicative budget, your timing, a description of the problem, and anything else you tell us. We use this to reply to your enquiry and to scope a piece of work with you. Lawful basis: legitimate interest, namely responding to a business enquiry that you initiated.
-
Email correspondence
If you email [email protected] directly, we receive whatever you put in the message and any signature block attached. Same lawful basis, same purpose.
-
Analytics, only with your consent
We use Google Analytics, run through Google Tag Manager, to see which pages get read. It does not run, and sets no cookie, until you pick "Analytics" in the cookie banner. If you decline, no cookie is set and nothing is recorded against you; Google still receives a small, cookieless signal, a feature it calls Consent Mode, used only to model overall traffic trends. Lawful basis: consent, given or withheld through the banner.
-
Server logs
Our hosting and edge providers, Amazon Web Services and Cloudflare, keep short-term server logs for security and abuse prevention, including IP addresses of requests. These are processed under each provider's own terms, on retention schedules that each provider sets. We do not query or export these logs in the ordinary course of business.
Six processors, named.
-
Resend
Our transactional email provider. When you submit the enquiry form, your answers are sent to [email protected] through Resend. Resend processes this data under its own terms, with the standard contractual clauses covering any transfer outside the UK. Its hosting is in the United States.
-
Google Workspace
Our business email provider. The enquiry that arrives at [email protected] sits in a Google Workspace inbox, our replies to you are sent from it, and any email you send us directly lands there too. Google processes this data under its own terms, and we have set the Workspace data region to Europe, so it is held in the EU.
-
Amazon Web Services
Hosts this site and runs the enquiry form handler. The site is served from AWS, and your enquiry is received and processed by a function in the London (eu-west-2) region, so the form submission itself is handled in the UK. AWS processes this data under its own terms, with the standard contractual clauses covering any transfer outside the UK.
-
Cloudflare
Our DNS and edge network. Cloudflare resolves the domain and sits in front of the site, passing visitor requests through to the AWS origin. Cloudflare processes data under its own terms, including the standard contractual clauses for any transfers outside the UK.
-
Google Analytics
Our analytics, described above, run through Google Tag Manager. Google only receives this data if you consent to analytics cookies in the banner. Google processes it under its own terms, with the standard contractual clauses covering the transfer to the United States.
-
CookieYes
Runs the cookie banner and remembers your choice, so we do not ask you again on every visit. This needs one cookie even if you decline everything else, since a browser with nowhere to store "no" would be asked on every page. CookieYes processes this under its own terms.
No advertising pixels, no list buying.
We do not sell data, do not buy contact lists, and do not run any third-party advertising pixels or advertising cookies on the site. If we ever add a new processor, this page is updated before it goes live.
One click to change your choice.
Click the small cookie icon in the corner of the page at any time to reopen the banner and change what you have allowed.
Only as long as it is useful.
We keep active enquiries and live client records for as long as the relationship is active, plus six years after the last contact. The six years matches the limitation period under English contract law. Ask us to delete your record sooner and, unless a live engagement or a legal duty makes us hold on to it, we delete it within thirty days.
The two Google Analytics cookies described above last up to two years. The CookieYes cookie that remembers your choice lasts up to a year, then the banner asks you again.
What you can ask us to do.
-
Access
Ask for a copy of the personal data we hold about you.
-
Rectification
Ask us to correct anything that is wrong or out of date.
-
Erasure
Ask us to delete your data, subject to any legal duty we have to retain it.
-
Restriction
Ask us to pause processing while a query is resolved.
-
Objection
Object to processing carried out under legitimate interest, including direct marketing if we ever start any.
-
Portability
Ask for a copy of the data you have given us in a machine-readable format.
One email, replied to within a working week.
Email [email protected] with the request. We reply within a working week, and act within one calendar month, which is the statutory deadline. There is no charge for the first request, and we will not ask you to justify it.
When data leaves the UK.
The site and the enquiry form handler are hosted on AWS in London, so that processing stays in the UK. Some of the other processors above host data outside the UK, principally in the EU and the United States. Those transfers run under the European Commission's standard contractual clauses, the UK international data transfer addendum, or an equivalent mechanism approved by the ICO. We do not transfer personal data to any country without one of those safeguards in place.
If you think we have handled your data badly.
Email us first at [email protected]. We would rather hear about a problem and fix it than have you pursue a complaint cold. If we do not put it right, you have the right to complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk or by phone on 0303 123 1113.
This page changes when our practice changes.
We update this notice whenever we add a new processor, change what we collect, or change how long we keep it. Material changes get flagged at the top of the page for at least sixty days. Last reviewed on 18 August 2026.
Question this page does not answer?
or email us directly at [email protected]