Privacy Policy
Hexotic Studios ("we", "us", "our") is committed to protecting your privacy and handling your personal data responsibly and transparently. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and the rights you have over your data.
This policy applies to visitors of our website, prospective clients, active clients, and anyone who interacts with us through our services.
We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Last updated: July 03, 2026
1. Who We Are
Hexotic Studios is a content agency registered in the United Kingdom.
Business address: Address: 124 City Road London EC1V 2NX United Kingdom
General contact: hello@hexotic.com
Privacy contact / data requests: privacy@hexotic.com
For the purposes of UK GDPR, Hexotic Studios is the data controller of any personal data collected through our website and services.
2. What Data We Collect
We collect and process the following categories of personal data, depending on how you interact with us:
2.1 Website Visitors
Information you submit through our contact form (name, email address, message content, and any other details you provide)
Information you submit when booking a call with us through embedded scheduling tools (name, email, chosen time slot, and any details you add)
Information you submit when subscribing to our newsletter (name, email address)
Basic technical and usage data collected through cookies and analytics tools (see Section 8)
2.2 Clients
When you engage us for services, we collect:
Full name and job title
Company name
Email address and phone number
Billing address and VAT details (for invoicing)
Brand assets, files, references, and creative materials you share with us
Communications between us (emails, messages, meeting notes, project correspondence)
2.3 Payment Information
We do not store your payment card details. All payments are processed by third-party payment providers (such as Stripe or your bank), who handle card data directly under their own security standards and privacy policies.
3. How We Use Your Data (Legal Bases)
We only use your personal data where we have a lawful basis to do so under UK GDPR. Specifically:
3.1 To provide our services (Legal basis: performance of a contract)
Communicating with you about your project
Delivering the agreed work
Issuing invoices and processing payments
3.2 To respond to enquiries (Legal basis: legitimate interests)
Replying to messages sent via the contact form
Following up on booked calls
Discussing potential engagements
3.3 To send marketing communications (Legal basis: consent, or legitimate interests for existing clients)
Sending occasional email updates, newsletters, and offers related to our services
You can unsubscribe at any time using the link in every marketing email, or by emailing privacy@hexotic.com
3.4 To comply with legal obligations (Legal basis: legal obligation)
Keeping accounting and tax records as required by HMRC
Responding to lawful requests from authorities
3.5 To improve our website and services (Legal basis: legitimate interests)
Analysing website usage through analytics tools
Understanding how visitors interact with our content
4. Who We Share Your Data With
We do not sell your personal data. We only share it with trusted third parties who help us run our business, and only where necessary.
The main third-party services we use include:
Google Workspace (Google LLC) — email, document storage, and collaboration
Framer (Framer B.V.) — hosting of this website and any submitted form data
Payment processors (such as Stripe and banking providers) — handling client payments
Scheduling tools (such as Calendly or Cal.com, if used) — booking calls
Email marketing platforms (if used for newsletters) — sending marketing communications
Each of these providers processes personal data under their own privacy policies and is contractually required to protect your data in line with UK GDPR standards.
We may also disclose personal data where required by law, court order, or lawful request from a public authority.
5. International Data Transfers
Because we work with clients worldwide, and because some of our service providers (such as Google) are based outside the UK, your personal data may be transferred to and processed in countries outside the United Kingdom and European Economic Area (EEA).
Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, including:
Transfers to countries deemed adequate by the UK government
Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner’s Office (ICO)
Other lawful transfer mechanisms permitted under UK GDPR
By engaging with our services, you acknowledge that your personal data may be transferred internationally under these safeguards.
6. How Long We Keep Your Data
We retain personal data only for as long as necessary to fulfil the purposes it was collected for, or to comply with legal obligations.
Our standard retention periods are:
Contact form submissions and enquiries: up to 24 months from the date of submission, unless a working relationship is established
Newsletter subscribers: until you unsubscribe, plus a short period afterwards for record-keeping
Active client data: for the duration of the engagement
Past client records (including invoices and communications): 6 years after the end of the engagement, in line with UK tax and accounting requirements (HMRC)
Website analytics data: in line with the retention settings of the analytics provider used (typically 14–26 months)
After the retention period expires, personal data is securely deleted or anonymised.
7. Your Rights Under UK GDPR
You have the following rights over your personal data:
Right to be informed — to know what data we collect and how we use it (this policy)
Right of access — to request a copy of the personal data we hold about you
Right to rectification — to have inaccurate or incomplete data corrected
Right to erasure (“right to be forgotten”) — to request deletion of your data in certain circumstances
Right to restrict processing — to limit how we use your data
Right to data portability — to receive your data in a portable format
Right to object — to object to certain processing, including direct marketing
Right to withdraw consent — where processing is based on consent, you can withdraw it at any time
Rights related to automated decision-making — we do not use automated decision-making or profiling
To exercise any of these rights, please email privacy@hexotic.com. We will respond within one month, as required by law.
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO):
Website: ico.org.uk
Phone: 0303 123 1113
We would appreciate the chance to address your concerns directly before you contact the ICO, so please consider reaching out to us first.
8. Cookies and Analytics
Our website uses cookies and similar technologies to provide functionality and understand how visitors use the site.
8.1 Types of Cookies We Use
Essential cookies — required for the website to function properly (cannot be disabled)
Analytics cookies — help us understand visitor behaviour, page performance, and how to improve the site (e.g., Google Analytics)
Functional cookies — remember preferences and improve your experience
8.2 Managing Cookies
When you first visit our site, you will be shown a cookie banner allowing you to accept or manage cookie preferences. You can also control cookies through your browser settings at any time.
Disabling certain cookies may affect the functionality of the website.
9. Data Security
We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect data against unauthorised access, loss, misuse, alteration, or disclosure. These measures include:
Secure, password-protected access to our systems
Encrypted data transmission where applicable
Working with reputable third-party providers who meet recognised security standards
However, no method of electronic storage or transmission over the internet is 100% secure. While we do our best to protect your data, we cannot guarantee absolute security.
10. Children’s Privacy
Our services are directed at businesses and adults. We do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us at privacy@hexotic.com and we will delete it promptly.
11. Third-Party Links
Our website may contain links to third-party websites, tools, or services. We are not responsible for the privacy practices or content of these third parties. We encourage you to read the privacy policies of any external sites you visit.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. The “Last updated” date at the top of this policy will always reflect the latest revision. We encourage you to review this policy periodically.
For material changes, we will make reasonable efforts to notify you directly where appropriate.
13. Contact Us
For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact us at:
privacy@hexotic.com
For general enquiries: hello@hexotic.com
By using our website or engaging our services, you acknowledge that you have read and understood this Privacy Policy.
