Who we are
Nine Marketing Studios Ltd (trading as “Studio Nine”, and referred to here as “we”, “us” or “our”) operates studionine.agency and the Studio Nine Lab shop at lab.studionine.agency. We are a private limited company registered in England and Wales (company number 10970197), and we are the data controller for the personal data described in this policy.
For any privacy question or to exercise your rights, email hello@studionine.agency.
The short version
Both sites are privacy-first. We do not set advertising, analytics or cross-site tracking cookies, we do not sell or share your personal information, and we do not use it for targeted advertising. We process what you choose to send us (an enquiry, an order, a mailing-list sign-up) and aggregated, cookieless visit statistics that never store your IP address.
The data we process, and why
Enquiries you send us
When you send the contact form, we receive your name, email address, any company name you give, your message, and the page you sent it from. We store it securely in our website’s database so the studio team can read and reply to it, and we may receive a copy by email. If you email us directly, we receive your name, email address and message in the usual way. We use these details only to respond to you and manage your enquiry. The lawful basis is our legitimate interest in responding to people who contact us.
Orders from the Lab shop
When you buy from the Lab, we receive your name, email address, phone number (if you give one), delivery address, what you ordered and how much you paid. Payment is taken by Stripe: we never see or store your card details. We use your details to fulfil and deliver your order, send you order emails (confirmation, download links, shipping and delivery updates), handle returns and refunds, and keep the accounting records the law requires. For downloads, we also record that you agreed at checkout to receive them straight away (which is why change-of-mind refunds don’t apply to them). The lawful bases are performing our contract with you and our legal obligations.
The Lab mailing list and “notify me” lists
If you join the Lab mailing list, or ask to be told when a product is available, we store your email address and which list you joined. We use it only to send you what you signed up for. You can unsubscribe at any time from any email or by writing to us, and we will remove you. The lawful basis is your consent.
Visit statistics (both sites)
We use Vercel Web Analytics and Vercel Speed Insights to understand, in aggregate, which pages people visit and how the sites perform. We also run our own cookieless visit counter, which records totals only: views per page per hour, the referring website (domain only), the type of device, and an approximate location (country, region and city) taken from our hosting provider’s network information. It does not store IP addresses, set cookies, store anything on your device, or keep any record that one person did one thing. Unique visitors are counted with an anonymous code that changes every day, is deleted when the day ends, and cannot be traced back to you. It does not count visits from browsers sending “Do Not Track” or Global Privacy Control. The lawful basis is our legitimate interest in understanding and improving the sites.
Private proposals
Some pages (for example a proposal we have prepared for a client) are protected by a password. When you enter it, your browser keeps a strictly necessary sign-in cookie for that page for up to seven days. We record only how many times each proposal is opened, not who opened it.
Hosting and security logs
Our hosting provider, Vercel Inc., processes standard technical information (such as IP address and browser type) as part of delivering and securing the sites. This is necessary for the sites to work and to protect them from abuse.
Cookies
We do not use tracking, advertising or analytics cookies. See our Cookie Policy for exactly what is stored and why.
Who we share data with
We do not sell personal data, and we do not share it for advertising. We share it only with the service providers that help us run the sites and serve you, each processing it on our behalf under appropriate terms:
- Vercel Inc.: hosting and aggregated analytics.
- Turso: our database (enquiries, orders, mailing lists and visit totals), hosted in the EU.
- Stripe: payments for Lab orders.
- Resend and our email provider: sending order and account emails, and receiving yours.
- Delivery companies (such as Royal Mail): your name and delivery address, only to deliver a Lab order.
International transfers
Some of our providers (including Vercel, Stripe and Resend) may process data outside the UK and EEA. Where they do, we rely on appropriate safeguards such as UK/EU adequacy decisions or standard contractual clauses.
How long we keep it
- Enquiries: only as long as needed to deal with them and for our ordinary business records, then deleted.
- Orders: six years from the end of the financial year of the sale, as UK tax law requires.
- Mailing lists: until you unsubscribe.
- Visit statistics: aggregated and not tied to you; deleted after about thirteen months.
Your rights
Under UK GDPR you have the right to access, correct, delete, restrict or object to our processing of your personal data, to data portability, and to withdraw consent at any time. To exercise any of these, email hello@studionine.agency. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, though we would appreciate the chance to help first.
Your privacy choices (including California)
We do not sell personal information and do not share it for cross-context behavioural advertising, as those terms are defined by the California Consumer Privacy Act (CCPA), and we have not done so in the last twelve months. We do not use or disclose sensitive personal information beyond what is needed to provide our services.
Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal (for example Firefox with the setting on, Brave or DuckDuckGo), we treat it as a request to opt out of the sale and sharing of your personal information, and we also stop counting your visit. If you are in California, the site shows a small “Opt-Out Preference Signal Honored” notice so you can see the signal has been received.
California residents can ask us what personal information we hold about them, ask us to correct or delete it, and opt out of its sale or sharing (which we do not do). Email hello@studionine.agency; we will confirm your request and respond within 45 days, and you may use an authorised agent. We will never treat you differently for exercising these rights.
Security
We take reasonable technical and organisational measures to protect personal data, including serving both sites over HTTPS, keeping card details with Stripe, and limiting who can access enquiries and orders.
Children
These sites are not directed at children under 16, and we do not knowingly collect their personal data.
Changes to this privacy policy
We may update this policy from time to time. The “last updated” date at the top reflects the current version.
We provide this policy as general information about our data practices; it is not legal advice. If you need a policy for your own organisation, take advice suited to your circumstances.