privacy policy
Last updated: 4 October 2026
Flying Duck Studio Lab Ltd (“Flying Duck”, “we”, “us”) is a creative studio registered in England and Wales, company number 14254195. Our registered office is 10 Princess Street, Hebden Bridge, HX7 8HG. Our studio is at Room 4, The Birchcliffe Centre, Hebden Bridge.
We are the controller for the personal data described in this policy. We are registered with the Information Commissioner’s Office (ICO) under registration number C2050446.
This policy covers this website, our creative studio, our work for clients and public bodies, and the events and workshops we run. We also run two other projects, each with its own privacy notice:
- Spanish Decoded (Spanish courses and the Spanish Playgroup), a trading name of Flying Duck Studio Lab Ltd: Spanish Decoded Privacy Notice
- Square Lens Alliance, whose data is managed by Flying Duck Studio Lab Ltd: Square Lens Alliance Privacy Policy
Questions or requests: contact@flyingduckstudiolab.co.uk or 07517 060213. Our Director, Alejandra Merino Lobato, is responsible for data protection.
what we collect and why
Website visitors
- What we collect: Device and browser information, IP address, pages visited, cookie identifiers
- Why: To run the website securely and understand how it is used
- Lawful basis: Legitimate interests for essential functions; consent for analytics and marketing cookies
People who contact us or request a quote
- What we collect: Name, email, phone, organisation and your message
- Why: To reply and, if you ask, prepare a proposal
- Lawful basis: Legitimate interests; steps before a contract
Clients and their staff
- What we collect: Contact details, project information, invoicing details
- Why: To deliver projects, manage the relationship and invoice
- Lawful basis: Contract; legal obligation (accounting records)
Event and workshop participants
- What we collect: Name, contact details, organisation, access needs, and photos or film where you agree
- Why: To run the event, meet access needs and, where a funder requires it, report on participation
- Lawful basis: Contract or legitimate interests; explicit consent for access needs and equality monitoring; consent for photos and film
Newsletter subscribers
- What we collect: Name and email address, and whether you open our emails
- Why: To send news about our work and events
- Lawful basis: Consent, or the soft opt-in for existing clients; you can unsubscribe at any time
Freelancers and applicants
- What we collect: CV, contact details, references, right-to-work and, for some roles, DBS check information
- Why: To assess applications, engage freelancers and keep people safe
- Lawful basis: Steps before a contract; legal obligation; for DBS information, the conditions in the Data Protection Act 2018
We only collect what we need. We do not sell personal data, and we do not use it for automated decisions that have legal or similar effects on you.
children
This website is not aimed at children, and we do not knowingly collect children’s data through it. When a project involves children, we work under the commissioning organisation’s safeguarding and consent arrangements, and we never film or photograph a child without a parent’s or carer’s written consent.
who we share data with
We use trusted service providers who process data on our behalf under written terms:
- Website: WordPress and Elementor, our web hosting provider, and NitroPack (performance)
- Forms, contact management and newsletter: HubSpot and Gravity Forms
- Website analytics: Google Analytics (only with your consent)
- Email, documents and file storage: Google Workspace
- Payments and accounting: Stripe and Xero
We share data with clients or funders only where needed to deliver or report on a project, with professional advisers such as our accountant and insurer, and with the police, local authority or other agencies where the law requires it or to protect someone from harm.
Some providers, including Google, HubSpot and Stripe, may process data outside the UK, for example in the United States. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum to protect your data.
cookies
Our website uses essential cookies to work and, only if you agree, analytics and marketing cookies (Google Analytics and HubSpot). Embedded videos from Vimeo and YouTube may set their own cookies. You can change your choice at any time through the cookie banner or your browser settings. See our Cookie Policy for details.
how long we keep data
- Accounting records, invoices and contracts: 6 years after the end of the financial year they relate to
- Client project files: as agreed in the contract, otherwise 6 years after completion
- Event registrations: 2 years after the event, unless a funder requires longer
- Enquiries that do not lead to work: 2 years
- Unsuccessful applicants: 6 months after the decision
- Newsletter: until you unsubscribe
Safeguarding and accident records may be kept longer where guidance or the law requires it.
We use secure, access-controlled systems, multi-factor authentication where available, up-to-date software and encrypted connections (HTTPS). Only people who need access to personal data have it. If a data breach is likely to put your rights at risk, we will report it to the ICO within 72 hours and tell you without undue delay where the risk is high.
your rights
You have the right to access the personal data we hold about you, have inaccurate data corrected, have your data deleted, restrict or object to how we use it (including for direct marketing), receive your data in a portable format, and withdraw consent at any time where we rely on consent.
To make a request, email contact@flyingduckstudiolab.co.uk. We will reply within one month and will not normally charge.
If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, 0303 123 1113.
We review this policy at least once a year and when our activities change. The date at the top shows when it was last updated.
