Privacy Policy

1. About This Privacy Policy

This Privacy Policy explains how AURIA Digital Studio (“AURIA”, “we”, “us” or “our”) collects, uses, stores and protects personal information when you interact with us.

AURIA Digital Studio is a trading name of Savannah Cummins.

For the purposes of applicable UK data protection legislation, the person responsible for determining how and why personal information is processed by AURIA is the relevant data controller.

This Privacy Policy applies when you:

• visit auriastudio.co.uk;
• submit an enquiry through our Website;
• contact us by email or another communication method;
• request a quotation;
• purchase or use our services;
• become a Client; or
• otherwise interact with AURIA.

You can contact us regarding privacy at contact@auriastudio.co.uk.

2. Personal Information We Collect

The information we collect depends upon how you interact with AURIA.

Identity and contact information

• your name;
• email address;
• telephone number, where provided;
• business or brand name;
• job title or role, where relevant; and
• business contact details.

Enquiry and project information

• the service you are interested in;
• your existing website address;
• information submitted through our enquiry form;
• your project requirements;
• brand preferences;
• project briefs;
• correspondence;
• feedback and approvals; and
• information necessary to provide the requested services.

Account and website information

Where required to provide our services, this may include information or access relating to:

• Shopify;
• domains;
• websites;
• business accounts;
• applications;
• integrations; and
• other platforms used in connection with your project.

Transaction and payment information

• invoices;
• amounts paid or payable;
• payment status;
• billing information; and
• transaction records.

We do not need to store complete payment-card details where payments are processed by a third-party payment provider.

Technical information

This may include:

• IP address;
• browser type;
• device information;
• operating system;
• pages visited;
• referring website;
• approximate location derived from technical information; and
• information collected using cookies or similar technologies.

3. How We Collect Information

We may collect personal information:

• directly from you;
• through our Website;
• through our enquiry form;
• when you contact us by email;
• during project discussions;
• when you purchase services;
• through invoices and payment records;
• when you provide access or information necessary for a project;
• automatically through cookies and similar technologies; and
• from third-party services where necessary to provide our services.

4. How We Use Personal Information

We may use your personal information to:

• respond to enquiries;
• communicate with prospective and existing Clients;
• prepare quotations and proposals;
• determine project requirements;
• enter into and manage contracts;
• provide website design, branding, Care+ and other services;
• manage projects;
• communicate about project progress;
• provide customer support;
• maintain Client websites where support has been purchased;
• issue and manage invoices;
• maintain business and accounting records;
• administer and improve our Website;
• protect our Website and business against fraud, misuse and security threats;
• comply with legal and regulatory obligations;
• establish, exercise or defend legal claims; and
• send marketing communications where we are legally permitted to do so.

We will not use personal information for purposes that are incompatible with the reason it was collected unless permitted or required by law.

5. Our Lawful Bases for Processing

Under UK data protection law, we need a lawful basis for processing personal information.

Contract

Where processing is necessary to enter into or perform a contract with you. For example, managing a website design project you have purchased.

Legitimate interests

Where processing is necessary for our legitimate business interests and those interests are not overridden by your rights. This may include responding to business enquiries, administering our business, improving our services, protecting our systems and maintaining appropriate business records.

Legal obligation

Where we need to process or retain information to comply with a legal requirement, such as tax and accounting obligations.

Consent

Where you have given us permission to process information for a particular purpose and consent is the appropriate lawful basis.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not make processing that occurred before withdrawal unlawful.

6. Client Website Access and Personal Data

As part of a website design or support project, a Client may provide AURIA with access to their Shopify store or other systems.

Those systems may contain personal information relating to the Client's customers, staff or other individuals.

Where AURIA processes personal information solely on a Client's instructions for the purpose of providing services, the Client may be the data controller and AURIA may act as a data processor.

Where applicable, the Client remains responsible for ensuring that it has a lawful basis for processing its customers' personal information and for complying with its own data protection obligations.

AURIA will only access Client systems and personal information to the extent reasonably necessary to provide the agreed services.

7. Sharing Personal Information

We do not sell personal information.

We may share personal information where reasonably necessary with service providers that help us operate our business or provide our services.

Depending upon the services used, these may include providers of:

• website hosting and ecommerce services;
• Shopify services;
• email;
• cloud storage;
• accounting or invoicing software;
• payment processing;
• analytics;
• website applications and integrations;
• domain services; and
• professional services.

We may also disclose personal information:

• where required by law;
• to comply with a court order or lawful request;
• to establish, exercise or defend legal rights;
• to protect AURIA, our Clients or others against fraud or security threats; or
• in connection with a future sale, transfer or restructuring of the business where legally permitted.

Where third parties process information on our behalf, we will take reasonable steps to use appropriate service providers and arrangements.

8. Shopify

AURIA's Website and/or Client projects may use services provided by Shopify.

Where you interact with a Shopify-powered website, Shopify may process information in accordance with its own privacy practices.

Client websites created by AURIA remain the responsibility of the relevant Client once operated by that Client, including responsibility for having an appropriate privacy policy and cookie arrangements for their own customers.

9. International Data Transfers

Some service providers used by AURIA may process or store personal information outside the United Kingdom.

Where UK data protection law requires safeguards for an international transfer, we will rely upon an appropriate lawful transfer mechanism or safeguards provided for under applicable data protection legislation.

10. How Long We Keep Personal Information

We keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including satisfying legal, accounting, tax, contractual and dispute-resolution requirements.

Different information may therefore be retained for different periods.

For example:

• unsuccessful or inactive enquiries may be deleted when they are no longer reasonably required;
• Client and project correspondence may be retained for an appropriate period following completion;
• invoices, transaction records and accounting information may be retained for the period required by applicable tax and accounting law; and
• information relevant to a dispute or legal claim may be retained until the matter and relevant limitation periods have expired.

We may securely delete or anonymise information when it is no longer required.

11. Security

We take reasonable technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration, loss or destruction.

However, no internet-based service or electronic storage system can be guaranteed to be completely secure.

Clients are also responsible for maintaining appropriate security over passwords, accounts and login credentials under their control.

12. Passwords and Account Access

Where you provide AURIA with access to Shopify or another service for the purpose of completing a project, access will be used only as reasonably necessary to perform the agreed work.

Where possible, we may request collaborator, staff or delegated access rather than asking Clients to disclose personal passwords.

You should remove access that is no longer required following completion of the relevant services.

13. Cookies

Our Website may use cookies and similar technologies.

Cookies are small files placed on your device that may be used to:

• enable essential Website functionality;
• remember preferences;
• understand how visitors use the Website;
• measure Website performance; and
• support other Website features.

Some cookies are essential for the Website to operate. Other cookies, such as certain analytics or advertising cookies, may require your consent before being placed on your device.

Where required, you will be provided with cookie choices through our Website.

You can also control cookies through your browser settings, although disabling certain cookies may affect Website functionality.

14. Analytics

We may use analytics services to understand how visitors interact with our Website.

Depending upon our configuration, analytics providers may collect technical information such as pages viewed, device type, approximate location, referral source and interaction information.

Where consent is legally required for analytics technologies, they will only be activated after the appropriate consent has been obtained.

15. Marketing

We may contact you regarding AURIA services where:

• you have asked us to do so;
• you have provided consent; or
• another lawful basis permits the communication.

Where required by law, we will obtain consent before sending electronic direct marketing.

You can unsubscribe from marketing communications at any time using an unsubscribe facility provided in the communication or by contacting contact@auriastudio.co.uk.

Service communications relating to an active enquiry, contract, project, invoice or Care+ service are not marketing communications and may still be sent where necessary.

16. Your Data Protection Rights

Depending upon the circumstances, UK data protection law may give you rights including the right to:

• be informed about how your information is used;
• request access to personal information held about you;
• request correction of inaccurate or incomplete information;
• request deletion of personal information in certain circumstances;
• request restriction of processing in certain circumstances;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing is based upon consent; and
• raise concerns about how your information is being processed.

These rights are not absolute and exemptions may apply.

We may need to verify your identity before acting upon a request.

To exercise a data protection right, contact contact@auriastudio.co.uk.

17. Automated Decision-Making

AURIA does not currently use personal information to make solely automated decisions that produce legal or similarly significant effects on individuals.

If this changes, this Privacy Policy will be updated as appropriate.

18. Children

AURIA's services are intended for businesses and individuals seeking professional digital design services and are not directed at children.

We do not knowingly seek to collect personal information from children through our Website.

19. Third-Party Links

Our Website may contain links to third-party websites or services.

AURIA is not responsible for the privacy practices of websites or services we do not control.

You should review the privacy information provided by the relevant third party before providing personal information to them.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our business, Website, services or legal obligations.

The latest version will be published on our Website and the “Last updated” date will be amended accordingly.

21. Complaints

If you have concerns about how AURIA has handled your personal information, please contact us first at contact@auriastudio.co.uk.

We will aim to investigate and respond appropriately.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection regulator.

Visit the Information Commissioner's Office

22. Contact Details