Privacy & Cookies

This notice explains what Grid Design does with personal information when you visit griddesign.co.uk or get in touch with us. It covers this website and our dealings with prospective clients, clients and suppliers.

It does not cover personal data we handle on behalf of a client as part of a project. In that situation the client decides what happens to the data and we act on their instructions — see GDPR & Data Protection for how that works.

Who we are

Grid Design Agency Limited is the data controller for the information described in this notice. We are registered with the Information Commissioner's Office as a data controller.

If you have any question about this notice or about your information, email dataprotection@griddesign.co.uk and a person will answer you.

What we collect

We collect very little, and almost all of it is information you type into a form or an email yourself.

When you contact us

• Your name
• Your email address
• Your telephone number, if you give it
• Your company or organisation, if you give it
• Whatever you choose to tell us about your project in the message

When you visit the website

Our hosting provider records standard server logs — the requesting IP address, the page requested, the time, the browser's user-agent string — as part of serving the site and keeping it secure. We do not use these to build a picture of individual visitors, and they are held for a short period by the host.

We measure page views using a privacy-first analytics tool that sets no cookies, stores no identifier, and cannot follow you to other websites. It records that a page was viewed, roughly which country from, and which site referred you. It does not identify you, and because it cannot, we do not need to ask your permission for it. There is no tag manager, no advertising pixel, and no cross-site tracking script anywhere on this site. It also records certain anonymous on-page actions in the same way — for example that a contact button was pressed, that a piece of writing was read to the end, or that the brief was completed — always as a count of the action, never tied to a person.

Cookies

This website does not set cookies.

That is unusual enough to be worth stating plainly rather than burying in a table. There is no analytics cookie, no advertising cookie, no consent-management cookie — and consequently no cookie banner, because there is nothing to ask you about.

We store two small, functional things in your browser, and only these: which accent colour the bar at the foot of the page is currently showing, so it stays the same as you move around; and, if you choose it, a flag remembering that you have opted out of the anonymous page-view count. Neither holds any identifier, neither is ever sent to us or to anyone else, and both sit in ordinary browser storage rather than in a cookie.

The page-view measurement described above needs no cookie and no consent, because it cannot identify you. Even so, you can opt this browser out of the anonymous count at any time, and opt it back in the same way — it takes effect immediately. If we ever add anything that does need consent, this notice will be updated before it goes live and you will be asked first.

Why we use your information, and the lawful basis

• To answer your enquiry and discuss your project. Our lawful basis is legitimate interests: you contacted us and expect a reply. Where the conversation becomes a proposal, the basis is that we are taking steps at your request before entering a contract.
• To deliver work under a contract. The basis is performance of that contract.
• To send invoices and keep accounting records. The basis is legal obligation.
• To keep the website running and secure. The basis is legitimate interests: it needs to work and it needs not to be attacked.
• To send occasional updates about our work. Only where you have asked for them, or where you are an existing client and the update relates to what we do for you. You can stop these at any time.

Who we share it with

We do not sell personal information, we do not trade it, and we do not share it for anybody else's marketing.

We use a small number of established service providers to run the business, and your information may sit inside their systems:

• Google Workspace — email, calendar and file storage
• Slack — project communication
• Notion — project documentation and notes
• Figma — design files and prototypes
• FreeAgent — invoicing and accounting records
• Our hosting provider — running this website, its database and the delivery of notification email
• Our AI provider — generating the draft in the brief writer, described below

Each of these processes information on our instructions under a written agreement. We will also disclose information where the law requires it, or to our professional advisers where we need advice.

Where your information is held

Primarily in the United Kingdom and the European Economic Area. The database behind this website is held in the United Kingdom, and notification email is delivered from within the European Economic Area. Some of the providers above are based in the United States. Where information reaches them, the transfer is covered either by a UK adequacy decision or by the EU Standard Contractual Clauses with the UK Addendum, which are the safeguards UK data protection law provides for.

A current list of our sub-processors, with the location and safeguard for each, is available from dataprotection@griddesign.co.uk.

How long we keep it

• Enquiries that do not become projects — up to 24 months, then deleted
• Client records and project files — for the life of the engagement and 7 years afterwards, which is the period our accounting and insurance obligations require
• Accounting records — 7 years, as required by law
• Marketing contacts — until you unsubscribe, and then only enough to make sure we do not contact you again
• Server logs — a short period set by our host

How we protect it

The measures we apply to our own information are the same ones we apply to our clients':

• Multi-factor authentication on email, cloud storage, design tooling and hosting
• A managed password manager, with no shared credentials
• Least-privilege access, revoked the day an engagement ends
• Encryption in transit and at rest in our managed cloud services
• Written confidentiality and data protection terms with every subcontractor

Artificial intelligence

We do not put client confidential information or personal data into an AI tool without the client's prior written agreement. Where AI tooling is agreed, we confirm which tools are in use and that model training on our inputs is switched off, and everything it produces is reviewed by a person before it is delivered.

The brief writer on this site. Our brief writer asks you four questions and drafts a project brief from your answers. To do that, what you type is sent to a third party AI provider that generates the draft. Your answers are not used to train their models, the draft is stored with us, and a person here reads it.

If you would rather not have your answers processed that way, use the contact form or email us instead. You will get the same reply from the same people.

Your rights

Under UK data protection law you have the right to:

• Ask what personal information we hold about you, and get a copy
• Have inaccurate information corrected
• Ask us to delete information, where there is no good reason for us to keep it
• Object to processing based on legitimate interests
• Ask us to restrict processing while a question about it is resolved
• Ask for your information in a portable format, where it was provided by you and is processed by automated means
• Withdraw consent at any time, where consent is the basis we relied on

Email dataprotection@griddesign.co.uk to use any of these. We will respond within one calendar month. There is no charge.

Marketing

We do not buy lists and we do not send unsolicited bulk email. If you do hear from us, there is an unsubscribe in every message and we act on it immediately.

Children

This website is aimed at businesses. We do not knowingly collect information about anyone under 18. If you believe we hold information about a child, tell us and we will delete it.

Other websites

This site links out to client work, to profiles and occasionally to articles. Those sites have their own privacy notices and we are not responsible for what they do. Following a link means leaving the protection of this one.

Changes

We update this notice when what we do changes. The date at the top of the page is the date of the current version. If a change is significant, we will make that clear rather than quietly amending the text.

Complaints

Please raise it with us first at dataprotection@griddesign.co.uk — most things are quicker to fix directly, and we would rather know.

You also have the right to complain to the Information Commissioner's Office at any time, at ico.org.uk/make-a-complaint or on 0303 123 1113. Complaining to us does not affect that right.