What we do with your data, plainly.
If you fill in our form, email us, or just visit the site, this page tells you exactly where your information goes, who else sees it, and how long it stays there.
The data controller, in legal terms.
LevelFive Studio Ltd is the data controller for the personal data described on this page. Our registered company number, registered office, and ICO data protection registration number will be shown in the site footer once incorporation is complete. Until then, email any privacy query to [email protected]. A real person reads that inbox and replies.
"Personal data" on this page means information about you as an individual, in the sense the UK GDPR uses the term. This notice covers the UK GDPR and the Data Protection Act 2018.
Two routes only: the enquiry form and analytics.
-
Enquiry form submissions
When you fill in the form on /contact, we receive your name, work email, company name, role, the kind of help you are asking for, an indicative budget, your timing, a description of the problem, and anything else you tell us. We use this to reply to your enquiry and to scope a piece of work with you. Lawful basis: legitimate interest, namely responding to a business enquiry that you initiated.
-
Email correspondence
If you email [email protected] directly, we receive whatever you put in the message and any signature block attached. Same lawful basis, same purpose.
-
Aggregate site analytics
Plausible records anonymous, aggregate visit counts. It does not set cookies, does not fingerprint your browser, and does not link visits to a named person. Its data is held in the EU. We use it to see which pages get read. Lawful basis: legitimate interest in understanding aggregate site traffic. This is also why there is no cookie banner on the site.
-
Server logs
Our hosting and edge providers, Amazon Web Services and Cloudflare, keep short-term server logs for security and abuse prevention, including IP addresses of requests. These are processed under each provider's own terms, on retention schedules that each provider sets. We do not query or export these logs in the ordinary course of business.
Five processors, named.
-
Resend
Our transactional email provider. When you submit the enquiry form, your answers are sent to [email protected] through Resend. Resend processes this data under its own terms, with the standard contractual clauses covering any transfer outside the UK. Its hosting is in the United States.
-
Google Workspace
Our business email provider. The enquiry that arrives at [email protected] sits in a Google Workspace inbox, our replies to you are sent from it, and any email you send us directly lands there too. Google processes this data under its own terms, and we have set the Workspace data region to Europe, so it is held in the EU.
-
Amazon Web Services
Hosts this site and runs the enquiry form handler. The site is served from AWS, and your enquiry is received and processed by a function in the London (eu-west-2) region, so the form submission itself is handled in the UK. AWS processes this data under its own terms, with the standard contractual clauses covering any transfer outside the UK.
-
Cloudflare
Our DNS and edge network. Cloudflare resolves the domain and sits in front of the site, passing visitor requests through to the AWS origin. Cloudflare processes data under its own terms, including the standard contractual clauses for any transfers outside the UK.
-
Plausible
Our analytics, described above. Plausible, operated by Plausible Insights OÜ, records anonymous, aggregate visit counts with no cookies and no personal data stored. Its servers are in the EU. Plausible processes this data under its own terms.
No advertising pixels, no list buying.
We do not sell data, do not buy contact lists, and do not run any third-party advertising pixels on the site. If we ever add a new processor, this page is updated before it goes live.
Only as long as it is useful.
We keep active enquiries and live client records for as long as the relationship is active, plus six years after the last contact. The six years matches the limitation period under English contract law. Ask us to delete your record sooner and, unless a live engagement or a legal duty makes us hold on to it, we delete it within thirty days.
Plausible keeps the aggregate analytics on a short retention schedule, set out in its own privacy policy.
What you can ask us to do.
-
Access
Ask for a copy of the personal data we hold about you.
-
Rectification
Ask us to correct anything that is wrong or out of date.
-
Erasure
Ask us to delete your data, subject to any legal duty we have to retain it.
-
Restriction
Ask us to pause processing while a query is resolved.
-
Objection
Object to processing carried out under legitimate interest, including direct marketing if we ever start any.
-
Portability
Ask for a copy of the data you have given us in a machine-readable format.
One email, replied to within a working week.
Email [email protected] with the request. We reply within a working week, and act within one calendar month, which is the statutory deadline. There is no charge for the first request, and we will not ask you to justify it.
When data leaves the UK.
The site and the enquiry form handler are hosted on AWS in London, so that processing stays in the UK. Some of the other processors above host data outside the UK, principally in the EU and the United States. Those transfers run under the European Commission's standard contractual clauses, the UK international data transfer addendum, or an equivalent mechanism approved by the ICO. We do not transfer personal data to any country without one of those safeguards in place.
If you think we have handled your data badly.
Email us first at [email protected]. We would rather hear about a problem and fix it than have you pursue a complaint cold. If we do not put it right, you have the right to complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk or by phone on 0303 123 1113.
This page changes when our practice changes.
We update this notice whenever we add a new processor, change what we collect, or change how long we keep it. Material changes get flagged at the top of the page for at least sixty days. Last reviewed on 4 June 2026.
Question this page does not answer?
or email us directly at [email protected]