Privacy Notice

This notice explains how this site collects and uses your personal data when you visit erlen.co.uk or get in touch. We keep it plain and we keep it short, because that's how privacy should be.

Who we are

Erlen Masson ("we", "us", "our") is the "data controller" responsible for your personal data on this site.

For anything privacy-related, contact us at erlen@bydefault.studio.

The data we collect

When you contact us. If you use our contact form, we collect the details you give us, typically your name, email address, company, and whatever you write in your message. We use this to respond to you and to discuss potential work.

When you browse the site. Like most websites, we collect limited technical and usage data through Google Analytics, for example pages visited, approximate location, device and browser type, and how you arrived. This is collected via cookies, which you can control as described in our Cookie Policy.

Embedded content. Most video on this site is self-hosted (streamed from Cloudflare) and involves no third-party player. A small number of case studies embed a Vimeo player, loaded in Vimeo's do-not-track mode; when you play one of those videos, Vimeo may process technical data about you (such as your IP address) to deliver it, as if you'd visited their site directly. We don't control that, see "Who we share it with" below.

We do not knowingly collect data from children, and we don't ask you for special-category data (such as health, ethnicity, or beliefs).

Why we use it, and our legal basis

Under UK GDPR we need a lawful basis for using your data:

• To respond to enquiries and discuss work: our legitimate interest in answering people who contact us, and taking steps toward a possible contract.
• To understand and improve the site: our legitimate interest in seeing how the site is used. You can control analytics cookies at any time (see our Cookie Policy).
• To send you information you've asked for: your consent, which you can withdraw at any time.
• To meet legal and accounting obligations, and to protect our rights: compliance with the law and our legitimate interests.

Who we share it with

We don't sell your data, and we don't share it for anyone else's marketing. We do use trusted service providers who process personal data on our behalf and on our instructions, so that we can run this site. These fall into the following categories:

• our website hosting, infrastructure, and video streaming provider (Cloudflare);
• our analytics provider (Google Analytics, provided by Google);
• our email tools (Google Workspace);
• video hosting (Vimeo) for a small amount of embedded content.

We may also disclose data if the law requires it, or where necessary to establish, exercise, or defend our legal rights. We can provide the names of the specific providers we use on request.

International transfers

Some of our providers (including Cloudflare, Google, and Vimeo) are based outside the UK, typically in the United States. Where your data is transferred abroad, we rely on appropriate safeguards, such as the UK's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, so it stays protected.

How long we keep it

We don't keep personal data longer than we need it. In practice:

• Enquiry and contact data: kept while we deal with your enquiry and for up to 24 months after our last contact, then deleted. If we begin working together, your data is kept for the duration of our engagement under our client agreement.
• Client and financial records: where we enter into a contract, related records (including invoices) are kept for 6 years after the end of the relationship, to meet HMRC, accounting, and legal obligations.
• Analytics data: Google Analytics retains user and event level data for 14 months, after which it is automatically deleted. Aggregated, anonymised reporting may be kept for longer.

Your rights

Under UK GDPR you have the right to: access your data; have it corrected; have it deleted; restrict or object to how we use it; ask for portability; and withdraw consent at any time where we rely on it. To exercise any of these, email us at erlen@bydefault.studio and we'll respond within one month.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk, though we'd appreciate the chance to put things right first.

Changes to this notice

We may update this notice from time to time. The "last updated" date above shows the current version.