This Privacy Notice (“Privacy Notice”) applies to the processing of personal data in connection with the provision of the Quietly Studio website at (the “Site”), and the goods and services that we offer, the latter of which we describe as our services (“Services”). We respect the privacy of every person who visits our Site and whose personal data we process as part of our Services and we are committed to ensuring a safe online experience for all.

This Privacy Notice explains our approach to any personal data that we might collect directly from you, or to which we have been given access by one of our clients. This Privacy Notice also sets out your rights in respect of our processing of your personal data.

To be clear, where we collect personal data directly from you, we act as a data controller, which gives us a certain set of obligations in respect of that data. Where, as part of our Services, we are given access to personal data collected by our clients, we act as a data processor.

When we talk about “personal data”, we mean any information which relates to an identified or identifiable living individual, such as a name, an email address, or an online identifier (such as an IP address or cookie ID).

This Privacy Notice is intended to assist you in making informed decisions when using the Site and our Services. Please take a moment to read and understand it. It should be read in conjunction with our Cookie Policy.

This Privacy Notice only applies to the ways that we use personal data as a data controller or a data processor when we provide our Services. It does not apply to the ways that our clients use the personal data of their own customers.

The Site and our Services are made available by Quietly Studio Limited (“Quietly Studio)”, “we”, “us, “our”). Quietly Studio is the data controller responsible for your personal data.

Quietly Studio Limited (company no: 11425049) is an English company with its registered office at 42 Redchurch Street, London, E2 7DP

If you have any questions about this Privacy Notice or want to exercise your rights set out in this Privacy Notice, you can contact us by:
‍
sending an email to info@quietly-studio.com
writing to Quietly Studio, 42 Redchurch Street, London E2 7DP

This section applies solely to where we act as a data processor. For information about how we process personal data as a data processor on behalf of our clients please see Section 5.

We collect personal data for one or more of the following processes:
‍
1.    To initiate and complete commercial transactions with our clients.
2.    To provide Services to our clients.
3.    To communicate with prospective employees.
4.    Website management

Client transactions and services
This covers the first two purposes.

Personal data we process for these purposes are name, physical address, email address and telephone number. The lawful basis for processing this personal data is Contract, as set out in Article 6(b) UKGDPR.

Personal data processed for these purposes are retained for the duration of the client contract plus 6 years.

This personal data is for internal use only and is not shared with third parties except where they act as Cloud Service Providers (CSPs) for our IT infrastructure.

Prospective employees
Personal data we process for this purpose are name, email address, telephone number, and curriculum vitae.

The lawful basis for processing this personal data is Contract, as set out in Article 6(b) UKGDPR.

Personal data processed for this purpose is retained for 1 year.

This personal data is for internal use only and is not shared with third parties except where they act as Cloud Service Providers (CSPs) for our IT infrastructure.

Website management
We use Google Analytics on our website which may collect personal data from site visitors, including cookie IDs, Client IDs, IP addresses, search, and browser history.
‍
The lawful basis for processing this personal data is Consent, as set out in Article 6(a) UKGDPR. Personal data processed for this purpose is retained for up to 2 years depending on the specific cookie. This personal data is shared with Google. For more information about this please see out our cookies policy.
‍

When we provide our Services to our clients, they may give us access to their marketing lists (Client Personal Data). In such cases, each client (as the data processor) is responsible for determining the types of personal data collected, the period for which it is retained, the lawful basis for processing and all the other information about how the data is processed. All of that information should be presented in their privacy notices.

Although we have access to Client Personal Data, we do not access or otherwise process that personal data for any reason other than:

– Where we run a competition involving a client’s customers, we access the relevant customer list to select winners.
‍
– Where we trigger the sending of marketing collateral developed by us and uploaded onto the client’s email service. We technically process the personal data because
we send the email from the client’s email service (after securing the client’s permission to do so) but do nothing else with the personal data.

We do not other extract Client Personal Data for processing on our systems or any other systems.

We do not transfer Client Personal Data outside of the systems that they already control.

We do not analyse Client Personal Data, such as email engagement data. Instead, we use aggregate reporting analytics data (which is not personal data since is it aggregated) provided by the client’s email service.

As the data controller, our clients are also ultimately responsible for Data Subject Rights, so our process for managing Data Subject Rights in respect of this personal data is to pass rights queries to the relevant data controller/client and await instruction from them.

This Privacy Notice does not apply to your interaction with services provided by third parties.
‍
Our Site may contain links to third party websites and services, such as Instagram, Spotify, and LinkedIn. We do not collect or use personal data collected by such third parties.

When you use a link to go from our Site to another website (even if you don’t leave our Site) or you request a service from a third party, this Privacy Notice shall not apply to the processing of your personal data carried out by the relevant third party provider.

Your browsing and interactions on any other websites, or your dealings with any other third party service provider, is subject to that website’s or third party service provider’s own rules and policies.

We do not monitor, control or endorse the privacy practices of any third parties.
‍

We will only share personal data with others when we are legally permitted to do so. When we share personal data with others, we put contractual arrangements and security mechanisms in place to protect the personal data shared and to comply with our data protection, confidentiality and security standards and obligations.

When processing your personal data, we may need to share it with third parties (including other entities within our group of companies) as follows:

– Third-party organisations that provide applications/functionality, data processing or IT services: We share personal data with third parties who support us in providing our Services and help provide, run and manage our internal IT systems. Such third parties may include, for example, providers of information technology, cloud-based software as a service providers, identity management, website hosting and management, data analysis, data back-up, security, and storage services. The servers powering and facilitating that cloud infrastructure are in secure data centres around the world, and personal data may be stored in any one of them. We also share your personal data with third-party service providers to assist us with insight analytics. These providers are described in our Cookie Policy.

– Auditors, lawyers, accountants and other professional advisers: We share personal data with professional services firms who advise and assist us in relation to the lawful and effective management of our organisation and in relation to any disputes we may become involved in.

– Law enforcement or other government and regulatory agencies and bodies: We share personal data with law enforcement or other government and regulatory agencies or other third parties as required by, and in accordance with, applicable law or regulation.

– Sharing with other third parties: Occasionally, we may receive requests from third parties with authority to obtain disclosure of personal data, such as to check that we are complying with applicable law and regulation, to investigate an alleged crime, or to establish, exercise or defend legal rights. We will only fulfil requests for personal data where we are permitted to do so in accordance with applicable law or regulation.

We are committed to keeping the personal data you provide to us secure and we will take reasonable precautions to protect your personal data from loss, misuse or alteration.

We have implemented information security policies, rules and technical measures to protect the personal data that we have under our control from:

- unauthorised access;
- improper use or disclosure;
- unauthorised modification; and
- unlawful destruction or accidental loss.

All our employees and data processors (i.e. those who process your personal data on our behalf, for the purposes listed above) who have access to and are associated with the processing of personal data are obliged to respect the confidentiality of the personal data of all users of our Site and our Services.
‍

We do not specifically target our Site or our Services at children.
‍

You have the following rights in relation to the personal data we hold about you. If you would like to exercise any of these rights, please contact us using the details set out on the page footers.

Your right of access
If you ask us, we will confirm whether we are processing your personal data and, if so, provide you with a copy of that personal data (along with certain other details). If you require additional copies, we may charge a reasonable fee for producing those additional copies.

‍Your right to rectification
If the personal data we hold about you is inaccurate or incomplete, you are entitled to have it rectified. If we have shared your personal data with others, we’ll let them know about the rectification where possible. If you ask us, where possible and lawful to do so, we will also tell you who we’ve shared your personal data with so that you can contact them directly.

‍Your right to erasure
You can ask us to delete or remove your personal data in some circumstances, such as where we no longer need it or where you withdraw your consent (where applicable). If we have shared your personal data with others, we will let them know about the erasure where possible. If you ask us, where it is possible and lawful for us to do so, we will also tell you who we have shared your personal data with so that you can contact them directly.

Your right to restrict processing
You can ask us to ‘block’ or suppress the processing of your personal data in certain circumstances such as where you contest the accuracy of that personal data or you object to us processing it for a particular purpose. This may not mean that we will stop storing your personal data but, where we do keep it, we will tell you if we remove any restriction that we have placed on your personal data to stop us processing it further. If we’ve shared your personal data with others, we’ll let them know about the restriction where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly.

Your right to data portability
You have the right, in certain circumstances, to obtain personal data you have provided to us (in a structured, commonly used and machine readable format) and to reuse it elsewhere or to ask us to transfer it to a third party of your choice.

Your right to object
You can ask us to stop processing your personal data, and we will do so, if we are:

- relying on our own or someone else’s legitimate interest to process your personal data, except if we can demonstrate compelling legal grounds for the processing; or
- processing your personal data for the purposes direct marketing.

Your rights in relation to automated decision-making and profiling
You have the right not to be subject to a decision when it is based on automatic processing, including profiling, if it produces a legal effect or similarly significantly affects you, unless such profiling is necessary for the entering into, or the performance of, a contract between you and us.

Your right to withdraw consent
If we rely on your consent (or explicit consent) as our legal basis for processing your personal data, you have the right to withdraw that consent at any time. You can exercise your right of withdrawal by contacting us using our contact details in the “Get in touch” section above or by using any other opt-out mechanism we may provide, such as an unsubscribe link in an email.

Your right to lodge a complaint with the supervisory authority
If you have a concern about any aspect of our privacy practices, including the way we have handled your personal data, please contact us using the contact details provided in the “How to contact us” section above. You can also report any issues or concerns to a national supervisory authority in the Member State of your residence or the place of the alleged infringement. As we are incorporated in the UK, our regulatory authority is https://ico.org.uk.

We may make changes to this Privacy Notice from time to time

To ensure that you are always aware of how we use your personal data, we will update this Privacy Notice from time to time to reflect any changes or proposed changes to our use of your personal data. We may also make changes to comply with changes in applicable law or regulatory requirements.

We will notify you by e-mail of any significant changes to this Privacy Notice. However, we encourage you to review this Privacy Notice periodically to be informed of how we use your personal data.

Last updated 25 August 2023