top of page
A star

Privacy Policy

Who we are

Star & Shale is an independent creative digital studio based in Surbiton, England, offering branding, graphic design and digital strategy. In this policy, "we", "us" and "our" mean Star & Shale.

We are the data controller for the personal information described here. That means we decide how and why it is used, and we are responsible for protecting it under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

This policy covers our website, starandshale.com, our Instagram account @starandshale, and the way we handle information from enquiries, prospective clients and clients.

If you have any questions about this policy or your information, email us at starandshale@gmail.com.

What data we collect

We only collect what we need to respond to you and deliver our services.

Information you give us

  • Contact form and email enquiries: your name, email address, business name, phone number (if given) and the details of your enquiry, including requests for a free discovery call.

  • Messages on Instagram or other platforms: your username and anything you choose to send us.

  • Client information: contact details, billing details, project briefs, brand assets, logins you choose to share for the work, and our correspondence with you.

Information collected automatically

  • Website usage data: your IP address, browser and device type, pages visited and time on site, collected through cookies and similar technologies (see Cookies below).

Information from other sources

  • Business prospecting: if we contact you about our services, we may have found your name, role and business contact details on your company website, social media profile or other public business directories.

We do not knowingly collect special category data (such as health or religious information). Please don't send it to us unless it is genuinely needed for a project.

How we use your infomation

UK GDPR requires a lawful basis for each use of personal data. Ours are set out below.

What we do - Lawful basis

​

Reply to enquiries and arrange discovery calls - Legitimate interests (responding to people who contact us), or steps taken at your request before entering a contract

Prepare proposals, deliver projects and manage our working relationship - Performance of a contract

Send invoices, keep accounts and records - Legal obligation (tax and accounting law) and performance of a contract

Contact businesses that may benefit from our services - Legitimate interests (growing our business), within the limits PECR sets for business email

Understand how visitors use our website and improve it - Consent, given through our cookie banner

Keep our website and systems secure, and handle disputes or legal claims- Legitimate interests (protecting our business)

Prospecting emails.

We only email business contacts about services relevant to their role. Every email tells you how to opt out, and if you ask us to stop, we will add you to a suppression list so we don't contact you again. We do not send marketing newsletters.

We do not sell your personal information, and we do not use it for automated decision-making or profiling that has legal or similarly significant effects on you.

Who we share it with

Star & Shale is run by one person and we don't use subcontractors. We share information only with trusted service providers who help us run the business, and only as much as they need.

Provider - What they do for us

Wix - Website hosting and contact forms

Google (Gmail, Google Drive, Google Analytics) - Email, secure storage of client files, and website analytics

Notion - Project and client management

FreeAgent - Invoicing and accounting

Meta (Instagram) - Messages sent to us on Instagram

These providers act on our instructions and must keep your information secure. If you buy our services through a marketplace such as Fiverr, that platform's own privacy policy also applies.

We may also share information with our accountant, professional advisers, HMRC or other authorities where the law requires it, or with a buyer if the business is ever sold.

International transfers. Some of these providers store data outside the UK, including in the United States. Where they do, the transfer is protected by safeguards recognised under UK law, such as the UK–US Data Bridge or the ICO's International Data Transfer Agreement.

How long we keep your data

We keep personal information only as long as we need it.

Information - How long

Enquiries that don't become projects - 12 months from our last contact

Prospecting contact details - 12 months from our last contact, unless you become a client

Opt-out requests - Indefinitely, so we never contact you again

Client project files and correspondence - 6 years after the project ends

Invoices and accounting records - 6 years after the end of the financial year they relate to

Website analytics - Up to 14 months

After these periods we securely delete or anonymise the information.

Security. We protect your information with strong passwords and two-factor authentication on our accounts, restricted sharing on client files, and reputable providers with their own security standards. No system is completely secure, but if a breach ever puts your information at risk, we will tell you and the ICO where the law requires.

Your rights

Under UK data protection law you have the right to:

  • Access a copy of the personal information we hold about you

  • Correct information that is wrong or incomplete

  • Erase your information in certain circumstances

  • Restrict how we use your information

  • Object to our use of it, including for direct marketing (this right is absolute)

  • Data portability: receive information you gave us in a reusable format, or have it sent to another organisation

  • Withdraw consent at any time, where we rely on it (for example, analytics cookies)

To use any of these rights, email starandshale@gmail.com. There's no charge in most cases. We'll respond within one month, and may ask you to confirm your identity first.

Complaints. If you're unhappy with how we've handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

Other things to know

Children. Our services are for adults and businesses. We don't knowingly collect information from anyone under 18.

Links to other websites. Our site may link to other websites, such as Instagram or client sites in our portfolio. We aren't responsible for how they handle your information, so please read their privacy policies.

Changes to this policy. We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.

Contact us

Star & Shale
Surbiton, England
Email: starandshale@gmail.com
Last updated: 30 October 2026

bottom of page