◈ LEGAL // 01 / LEGAL
Privacy Policy
How Nebula Craft Design Ltd collects, uses, and protects personal data, written under UK GDPR and the Data Protection Act 2018.
01Introduction
Nebula Craft Design Ltd ("we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and disclose personal data when you visit www.nebulacraftdesign.com, contact us through our website, or otherwise engage with our studio.
We process personal data in accordance with the United Kingdom General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).
02Who we are
Nebula Craft Design Ltd is the data controller responsible for your personal data. We are a company registered in England and Wales.
03Personal data we collect
We only collect personal data that is necessary for the purposes set out in this policy. The categories of data we may collect are:
Contact and enquiry data
- Name
- Email address
- Company or organisation name (optional)
- Project type, current stage, priorities, timeline, budget, and brief submitted through the project enquiry form
Technical and usage data
- IP address and request metadata processed at the hosting edge for security and delivery
- Device, browser, and operating system metadata included in a request
- The route requested and referring URL where supplied by the browser
We do not use third-party advertising cookies, behavioural tracking, or advertising profiles. The public site uses Cloudflare Web Analytics for aggregate website measurement. Technical logs necessary for website security, performance, rate limiting, form delivery, and infrastructure operation are processed at the Cloudflare edge.
04How we collect your data
- Directly from you when you complete our contact form or email us at Contact email
- Automatically when you browse our website, through technical request data and the browser storage described in our Cookie Policy.
- From third-party platforms only when you have expressly permitted them to share that data with us (for example, if you contact us through a social network).
05Lawful basis for processing
Under UK GDPR, we must have a valid lawful basis to process your personal data. We rely on the following bases:
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries submitted via our contact form or email | Legitimate interests, to reply to your message and discuss potential work |
| Negotiating and entering into a client engagement | Contract, steps prior to entering into a contract with you |
| Fulfilling a signed client agreement | Contract |
| Complying with legal, accounting, or tax obligations | Legal obligation |
| Defending or pursuing legal claims | Legitimate interests, to protect our rights |
Where we rely on legitimate interests, we assess those interests against your rights and freedoms.
06How we use your data
We use your personal data only for the following purposes:
- To respond to your enquiry and provide the information or proposal you requested.
- To negotiate, prepare, and deliver design and development services where we enter into a client engagement.
- To send transactional emails relating to projects, invoices, or service updates.
- To maintain accurate business records as required by law.
- To monitor and improve the performance, security, and user experience of our website.
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
08International transfers
Where a provider processes personal data outside the United Kingdom, we rely on an applicable adequacy decision or another safeguard appropriate to that arrangement. The relevant provider documentation may describe the applicable transfer mechanism.
You can request a copy of the safeguards we use by contacting us at Contact email
09Data retention
We retain personal data only for as long as is necessary for the purposes we collected it.
| Data category | Retention period |
|---|---|
| Project enquiry submission and delivery state | 30 days after completion or the final retryable attempt, then automatically deleted |
| Enquiries and correspondence | For as long as reasonably necessary to handle the enquiry or business relationship, then deleted unless legal, accounting, regulatory, or claims-related obligations require longer |
| Client project records and correspondence | For as long as reasonably necessary for the business relationship and applicable legal, accounting, regulatory, or claims-related obligations |
| Invoices and accounting records | For the period required by applicable accounting, tax, and legal obligations, generally at least six years where relevant |
When the retention period expires, we securely delete or irreversibly anonymise the relevant data.
10Your rights under UK GDPR
You have a number of rights in relation to the personal data we hold about you. These rights are not absolute and may be subject to exemptions, but in general you have the right to:
To exercise any of these rights, please email us at Contact email We will respond within one calendar month. We do not charge a fee unless your request is manifestly unfounded or excessive.
We may ask you for proof of identity before acting on your request, to ensure your data is not disclosed to anyone other than you.
11Complaints
If you are unhappy with the way we have handled your personal data, please contact us first so we can try to resolve the issue.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.
12Security
We take the security of your personal data seriously. We use a combination of technical and organisational measures appropriate to the nature of the data and the risk of harm, including:
- HTTPS encryption across our entire website
- Access controls and authentication on internal systems
- Reputable hosting and email providers with strong security posture
- Regular review of our processing activities and supplier arrangements
No method of transmission over the internet is completely secure. If you have reason to believe your interaction with us is no longer secure, please contact us immediately.
13Children
Our website and services are intended for businesses and adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.
14Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The "Effective date" at the top of this page indicates when the policy was last revised.
Material changes will be communicated through a prominent notice on our website. We encourage you to review this policy periodically.
15Contact us
If you have any questions about this Privacy Policy or our handling of your personal data, please contact us: