Privacy Policy

1. Introduction

Beyond HNGT Ltd ("I", "me", "my", "the Studio") is committed to protecting your privacy. This Privacy Policy explains how I collect, use, and protect your personal information when you visit hg.studio (the "Website").

This policy complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information I Collect

2.1 Information Collected Automatically

When you visit this Website, I may automatically collect:

• IP Address: Your Internet Protocol address, which may indicate your approximate geographic location
• Browser Information: Including browser type, version, and user agent string
• Device Information: Operating system and device type
• Access Timestamps: The date and time of each visit
• Pages Viewed: Which pages you accessed on the Website
• Referral Source: How you arrived at the Website

2.2 Information You Provide

2.2.1 Contact Form Enquiries

When you submit a contact form on the Website, I collect your name, email address, and the content of your message. This information is used solely to respond to your enquiry. Submitting a contact form does not subscribe you to any marketing communications.

2.2.2 Newsletter & Marketing

If you choose to subscribe to my newsletter or marketing emails, I collect your name and email address. Newsletter subscription requires separate, explicit consent and uses a double opt-in process. You will receive a confirmation email to verify your subscription before any marketing emails are sent.

You can unsubscribe at any time by clicking the "unsubscribe" link in any marketing email, or by contacting me at legal@hg.studio.

2.2.3 Appointment Booking

When you book a discovery call or appointment via Calendly, I collect your name, email address, and booking details (date, time, and meeting preferences).

2.3 Analytics

2.3.1 Vercel Analytics & Speed Insights

This Website uses Vercel Analytics and Vercel Speed Insights to monitor website performance and understand usage patterns. These tools do not use cookies and do not store any personally identifiable information. They operate under Legitimate Interest (GDPR Article 6(1)(f)) and do not require your consent.

Vercel Analytics & Speed Insights collect:

• Page views
• Web Vitals performance metrics (e.g. LCP, FID, CLS)
• Device type (aggregated)
• Country-level location
• Referral source

All data is aggregated and anonymised. For more information, see Vercel's Analytics Privacy Policy.

2.3.2 Google Analytics 4

This Website also uses Google Analytics 4 (GA4) to understand how visitors use the site. GA4 only loads after you provide consent via the cookie banner.

When consent is given, GA4 collects:

• Page views and navigation paths
• Session duration and engagement metrics
• Device and browser information
• IP address (anonymised by default in GA4)
• Approximate geographic location (country/city level)

Analytics data is retained for 14 months in Google Analytics. I do not share personally identifiable information with Google for marketing purposes.

For more information, see Google's Privacy Policy.

2.4 Third-Party Services

The following third-party services may process your personal data on my behalf:

All processors are required to comply with GDPR and have appropriate data processing agreements in place.

3. How I Use Your Information

I use the information collected for the following purposes:

4. Data Sharing

I do not sell, rent, or trade your personal data to any third parties.

I may share your data with:

• Analytics providers: Vercel Inc (for privacy-friendly analytics, without consent) and Google (for website analytics, with your consent)
• Email delivery services: Resend and Web3Forms (for processing contact form submissions)
• Appointment scheduling: Calendly (for booking discovery calls)
• Email marketing: MailerLite (for sending communications you have opted into)
• Customer relationship management: CRM provider (for managing client relationships)
• Hosting provider: Vercel Inc (who processes data on my behalf to host and deliver the Website)
• Professional advisers: If required for legal or accounting purposes
• Legal authorities: If required by law or to protect my rights

All processors are required to comply with GDPR and have appropriate data processing agreements in place.

5. Data Retention

I retain personal data only for as long as necessary:

• Google Analytics data: Up to 14 months (Google Analytics retention setting)
• Vercel Analytics data: Aggregated and anonymised; retained per Vercel's retention policies (not linked to individual users)
• Contact enquiries: Retained for up to 3 years or until the purpose is fulfilled
• Email marketing data: Retained until you unsubscribe or request deletion
• Booking data: Retained by Calendly per their retention policy
• Legal records: Retained as required by applicable law

6. International Transfers

Your data may be processed in countries outside the United Kingdom. The following services process data in the locations specified:

• Google LLC (United States): covered by the UK Extension to the EU-US Data Privacy Framework
• Calendly (United States): Standard Contractual Clauses apply
• Resend (United States): Standard Contractual Clauses apply
• Web3Forms (United States): Standard Contractual Clauses apply
• Vercel Inc (United States): UK Extension to the EU-US Data Privacy Framework
• MailerLite (Lithuania, EU): no international transfer required

Where data is transferred outside the UK, I ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

7. Cookies

Essential cookies are used without consent as they are necessary for the Website to function. Analytics cookies are only set after you provide consent via our cookie banner. You can change your preferences at any time by clicking "Cookie Settings" in the footer.

8. Your Rights

Under the UK GDPR, you have the following rights:

8.1 Right of Access

You can request a copy of the personal data I hold about you.

8.2 Right to Rectification

You can request correction of any inaccurate personal data.

8.3 Right to Erasure

You can request deletion of your personal data in certain circumstances.

8.4 Right to Restriction of Processing

You can request that I restrict the processing of your personal data.

8.5 Right to Data Portability

You can request your data in a structured, commonly used format.

8.6 Right to Object

You can object to processing based on legitimate interests.

8.7 Right to Withdraw Consent

You can withdraw consent at any time for the following:

• Analytics cookies (Google Analytics 4): Click "Cookie Settings" in the website footer to change your cookie preferences.
• Marketing emails: Click the "unsubscribe" link in any marketing email, or contact me at legal@hg.studio.

Note: Vercel Analytics and Speed Insights operate under Legitimate Interest and do not require your consent. However, your Right to Object (Section 8.6) still applies. You can contact me to raise an objection at any time.

8.8 How to Exercise Your Rights

To exercise any of these rights, contact me at:

Email: legal@hg.studio

I will respond within one month and may ask you to verify your identity.

8.9 Right to Complain

If you are unhappy with how I have handled your data, you can lodge a complaint with the Information Commissioner's Office (ICO):

9. Security

I implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption of data in transit (HTTPS/TLS)
• Secure hosting infrastructure
• Regular review of security practices
• Limited access to personal data

10. Third-Party Links

This Website may contain links to external sites. I am not responsible for the privacy practices of those sites. Please review their privacy policies before providing any personal information.

11. Changes to This Policy

I may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date.

12. Contact

If you have any questions about this Privacy Policy or how your data is processed, please contact: