Privacy Policy

This notice explains what Grid Design does with personal information. It covers this website, griddesign.co.uk, and Margin, our client portal at margin.griddesign.co.uk, together with our dealings with prospective clients, clients, contractors and suppliers.

It does not cover personal data we handle on behalf of a client as part of a project. In that situation the client decides what happens to the data and we act on their instructions. See GDPR & Data Protection for how that works.

Who we are

Grid Design Agency Limited is the data controller for the information described in this notice. We are registered with the Information Commissioner's Office as a data controller.

If you have any question about this notice or about your information, email dataprotection@griddesign.co.uk and a person will answer you.

What we collect

We collect very little, and almost all of it is information you type into a form, an email or the portal yourself.

When you contact us

• Your name
• Your email address
• Your telephone number, if you give it
• Your company or organisation, if you give it
• Whatever you choose to tell us about your project in the message

When you visit the website

Our hosting provider records standard server logs, being the requesting IP address, the page requested, the time and the browser's user-agent string, as part of serving the site and keeping it secure. We do not use these to build a picture of individual visitors, and they are held for a short period by the host.

We measure page views and page load speed using privacy-first tools that set no cookies, store no identifier, and cannot follow you to other websites. They record that a page was viewed, roughly which country from, which site referred you, and how quickly the page loaded. They do not identify you, and because they cannot, we do not need to ask your permission for them. There is no tag manager, no advertising pixel, and no cross-site tracking script anywhere on this site. The same tools record certain anonymous on-page actions in the same way, for example that a contact button was pressed, that a piece of writing was read to the end, or that the brief was completed, always as a count of the action, never tied to a person.

When you use Margin

Margin is the private workspace at margin.griddesign.co.uk where we run projects with our clients and our contractors. There is no public sign-up. You have an account only because someone at Grid Design Agency, or the studio you work with, invited you by email.

For everyone with an account we hold:

• Your name
• Your email address
• Your telephone number, where you give it
• Your job title and the organisation you work for
• Which projects you are involved in, and your role on them
• The messages, comments and feedback you write in the platform
• The files you upload
• A record of your sign-in activity, kept so that we can keep the account secure

For contractors we also hold:

• Time logged against projects
• Your agreed rates and the amounts payable to you

Rates and payment figures are used to pay you and to cost our own projects.

Why we use your information, and the lawful basis

To answer your enquiry and discuss your project. Our lawful basis is legitimate interests: you contacted us and expect a reply. Where the conversation becomes a proposal, the basis is that we are taking steps at your request before entering a contract.

To deliver work under a contract. The basis is performance of that contract.

To run Margin and the projects inside it. To give you access, show you the right work, carry your messages and feedback to the right people, and hold the files a project needs. Where you or your organisation is under contract with us, the basis is performance of that contract. Where you are named as a contact by an organisation we contract with, rather than being a party yourself, the basis is legitimate interests: running the project we have been engaged to deliver, in a way that keeps everyone working from the same information.

To pay contractors. The basis is performance of contract, and legal obligation for the accounting records themselves.

To send invoices and keep accounting records. The basis is legal obligation.

To keep the website and the platform running and secure. The basis is legitimate interests: they need to work and they need not to be attacked.

To send occasional updates about our work. Only where you have asked for them, or where you are an existing client and the update relates to what we do for you. You can stop these at any time. Having an account in Margin does not sign you up to anything, and we do not use what is in Margin to advertise to you.

Signing in to Margin

You sign in either with a six-digit code we email to the address on your invitation, or, if you choose it, with your Google account. The code is valid for a short period and then expires. There is no password.

If you sign in with Google, we receive your name, your email address and your Google account identifier, so that we can match you to your invitation. We do not receive your Google password, and we cannot see anything else in your Google account unless you connect it yourself.

You can also connect your Google calendar to Margin so that project dates appear alongside your own. This is off unless you turn it on, it is limited to the calendars you choose to connect, and you can disconnect it at any time. Disconnecting stops any further access.

Cookies

This website does not set cookies.

That is unusual enough to be worth stating plainly rather than burying in a table. There is no analytics cookie, no advertising cookie, no consent-management cookie, and consequently no cookie banner, because there is nothing to ask you about.

We store two small, functional things in your browser, and only these: which accent colour the bar at the foot of the page is currently showing, so it stays the same as you move around; and, if you choose it, a flag remembering that you have opted out of the anonymous page-view count. Neither holds any identifier, neither is ever sent to us or to anyone else, and both sit in ordinary browser storage rather than in a cookie.

The page-view and page-speed measurement described above needs no cookie and no consent, because it cannot identify you. Even so, you can opt this browser out of the anonymous count at any time, and opt it back in the same way. It takes effect immediately.

Margin sets strictly necessary cookies only.

Margin sets two kinds of cookie and no others: a sign-in session cookie, which is what keeps you signed in as you move between pages, and short-lived security tokens, which protect the forms in the platform against being submitted from somewhere else without your knowledge.

There are no analytics cookies in Margin. There are no tracking cookies. There are no third-party cookies of any kind. Nothing in Margin follows you to another website, and nothing about you is shared with an advertising network, because we do not use one.

Under the Privacy and Electronic Communications Regulations, cookies that are strictly necessary to provide a service the user has asked for are exempt from the consent requirement. Keeping you signed in to a portal you asked to sign in to, and protecting that session, is exactly that. Margin therefore does not show a cookie banner, and does not need one.

If we ever add anything to either site that does need consent, this notice will be updated before it goes live and you will be asked first.

Who we share it with

We do not sell personal information, we do not trade it, and we do not share it for anybody else's marketing. We do not use it for advertising or for profiling, and no decision that affects you is made about you by automated means.

We use a small number of established service providers to run the website, the platform and the business. Your information may sit inside their systems, and each of them processes it on our written instructions.

Running this website and Margin:

• Vercel, hosting for the website and the platform, and storage for files uploaded to Margin, in the European Union
• Neon, the database behind the website and the platform, in London, United Kingdom
• Resend, delivery of transactional email such as sign-in codes, invitations and notifications, from within the European Economic Area
• Google, optional sign-in and the optional calendar connection, where you choose to use them

Running the business:

• Google Workspace, email, calendar and file storage
• Slack, project communication
• Notion, project documentation and notes
• Figma, design files and prototypes
• FreeAgent, invoicing and accounting records
• Our AI provider, generating the draft in the brief writer, described below

We will also disclose information where the law requires it, or to our professional advisers where we need advice.

Where your information is held

In the United Kingdom and the European Economic Area. The database behind the website and the platform is held in the United Kingdom. The website, the platform and files uploaded to Margin are held in the European Union. Notification and sign-in email is delivered from within the European Economic Area.

Some of the business tools above are based in the United States. Where information reaches them, the transfer is covered either by a UK adequacy decision or by the EU Standard Contractual Clauses with the UK Addendum, which are the safeguards UK data protection law provides for.

A current list of our sub-processors, with the location and safeguard for each, is available from dataprotection@griddesign.co.uk.

How long we keep it

• Enquiries that do not become projects, up to 24 months, then deleted
• Client and contractor records, project files, messages and uploads in Margin, for the life of the engagement and 7 years afterwards, which is the period our accounting and insurance obligations require
• Contractor time logs and payment records, 7 years, as part of our accounting records
• Accounting records generally, 7 years, as required by law
• Sign-in codes, a short period, then they expire and are discarded
• Sign-in activity records, 12 months
• Marketing contacts, until you unsubscribe, and then only enough to make sure we do not contact you again
• Server logs, a short period set by our host

If you leave a project or an organisation, tell us and we will close your Margin account. Closing an account removes your access. The project record itself, including the messages and files that form part of the work, is kept for the period above, because it is a record of work done under a contract.

How we protect it

The measures we apply to our own information are the same ones we apply to our clients':

• Multi-factor authentication on email, cloud storage, design tooling and hosting
• Sign-in to Margin by emailed code or Google, with no password for anyone to reuse or leak
• A managed password manager, with no shared credentials
• Least-privilege access, revoked the day an engagement ends
• Encryption in transit and at rest in our managed cloud services
• Written confidentiality and data protection terms with every subcontractor

Artificial intelligence

We do not put client confidential information or personal data into an AI tool without the client's prior written agreement. Where AI tooling is agreed, we confirm which tools are in use and that model training on our inputs is switched off, and everything it produces is reviewed by a person before it is delivered.

The brief writer on this site. Our brief writer asks you four questions and drafts a project brief from your answers. To do that, what you type is sent to a third party AI provider that generates the draft. Your answers are not used to train their models, the draft is stored with us, and a person here reads it.

If you would rather not have your answers processed that way, use the contact form or email us instead. You will get the same reply from the same people.

Your rights

Under UK data protection law you have the right to:

• Ask what personal information we hold about you, and get a copy
• Have inaccurate information corrected
• Ask us to delete information, where there is no good reason for us to keep it
• Object to processing based on legitimate interests
• Ask us to restrict processing while a question about it is resolved
• Ask for your information in a portable format, where it was provided by you and is processed by automated means
• Withdraw consent at any time, where consent is the basis we relied on

Email dataprotection@griddesign.co.uk to use any of these. We will respond within one calendar month. There is no charge.

Marketing

We do not buy lists and we do not send unsolicited bulk email. If you do hear from us, there is an unsubscribe in every message and we act on it immediately.

Children

This website and Margin are aimed at businesses. We do not knowingly collect information about anyone under 18. If you believe we hold information about a child, tell us and we will delete it.

Other websites

This site links out to client work, to profiles and occasionally to articles. Those sites have their own privacy notices and we are not responsible for what they do. Following a link means leaving the protection of this one.

Changes

We update this notice when what we do changes. The date at the top of the page is the date of the current version. If a change is significant, we will make that clear rather than quietly amending the text.

Complaints

Please raise it with us first at dataprotection@griddesign.co.uk. Most things are quicker to fix directly, and we would rather know.

You also have the right to complain to the Information Commissioner's Office at any time, at ico.org.uk/make-a-complaint or on 0303 123 1113. Complaining to us does not affect that right.