Privacy Policy

Deuce Studio — https://deucestudio.com

Last updated: February 2026

Who we are

This website is operated by Deuce Studio (“we”, “us”, “our”). We are a design studio based in the United Kingdom, and our website address is https://deucestudio.com.

We are the data controller for the personal data we collect through this website. This means we decide how and why your personal data is processed, and we are responsible for keeping it safe.

If you have any questions about this privacy policy or how we handle your personal data, you can contact us at:

• Email: info@deucestudio.com
• Postal address: Studio 116, The Pill Box, 115 Coventry Rd, London E2 6GG

What this policy covers

This privacy policy explains what personal data we collect when you visit our website, why we collect it, how we use it, who we share it with, and what rights you have. It covers:

• Information you give us directly (for example, through our contact form)
• Information collected automatically when you browse our site (for example, through cookies and analytics tools)
• How third-party services we use on this website process your data

We have written this policy in plain English, as recommended by the Information Commissioner’s Office (ICO). If anything is unclear, please contact us and we will be happy to explain.

What personal data we collect and why

Information you provide through our contact form

Our website has a contact form that allows you to get in touch with us. When you submit the form, we collect:

Data collected	Why we collect it
Your name	So we know who we are speaking to and can address you personally
Your email address	So we can reply to your enquiry
Your message	So we can understand and respond to your enquiry
Your IP address	Collected automatically by our web server when you submit the form, for security and spam prevention purposes
Date and time of submission	To keep a record of when the enquiry was made

Lawful basis: We process this data on the basis of legitimate interests (Article 6(1)(f) UK GDPR). Our legitimate interest is to respond to enquiries from prospective clients and other contacts. We consider this a reasonable expectation — when you contact us, you expect us to use your details to reply. You can object to this processing at any time (see “Your rights” below).

How long we keep it: We retain contact form submissions for up to 2 years after your last communication with us, unless we need to keep them longer for legal reasons or an ongoing business relationship. We then securely delete them.

 

If you fail to provide personal data

Where we need personal data to respond to your enquiry (for example, your email address so we can reply), and you do not provide it, we will not be able to respond to you. We will only ever ask for information that is necessary for the purpose at hand.

Information collected automatically when you visit our site

When you browse our website, certain data is collected automatically by the technologies described below.

Cookies and similar technologies

A cookie is a small text file that is placed on your device (computer, phone, or tablet) when you visit a website. Cookies serve various purposes, including remembering your preferences, understanding how you use a site, and providing analytics data.

Under the Privacy and Electronic Communications Regulations (PECR), we are required to obtain your consent before placing non-essential cookies on your device. Essential cookies that are strictly necessary for the website to function do not require consent.

Cookies used on this website

Strictly necessary cookies (no consent required)

These cookies are essential for the website to operate. They do not collect personal data used for marketing or analytics purposes.

Cookie	Purpose	Duration	Set by
wordpress_test_cookie	Checks whether your browser accepts cookies (only set on our login page, not during normal browsing)	Session	WordPress
wordpress_[hash]	Stores authentication details for logged-in administrators only. Not set for ordinary visitors.	Session or 14 days	WordPress
wordpress_logged_in_[hash]	Indicates logged-in status for site administrators only. Not set for ordinary visitors.	Session or 14 days	WordPress
wp-settings-{time}-[UID]	Stores admin interface preferences for logged-in administrators only. Not set for ordinary visitors.	1 year	WordPress

Analytics cookies (consent required)

We use Google Analytics 4 (GA4) to understand how visitors use our website. This helps us improve the site and the experience we offer. Google Analytics sets the following cookies:

Cookie	Purpose	Duration	Set by
_ga	Distinguishes unique visitors by assigning a randomly generated pseudonymous identifier (Client ID). Does not contain personally identifiable information.	Up to 2 years (capped at 400 days by modern browsers)	Google Analytics (first-party)
_ga_[container-id]	Maintains session state — records when your session started, how many pages you’ve viewed, and similar session information for the specific GA4 property.	Up to 2 years (capped at 400 days by modern browsers)	Google Analytics (first-party)

These cookies are only set after you give your consent. If you do not consent, no Google Analytics cookies will be placed on your device and no analytics data will be collected about your visit.

Apollo.io tracking (consent required)

We use Apollo.io, a business-to-business (B2B) sales intelligence platform, to understand which companies may be interested in our design services. The Apollo.io tracking script is loaded on our website and may use cookies and similar technologies to collect data about your visit.

Apollo.io collects the following data automatically:

• Your IP address (used to identify the company or organisation you may be browsing from, through a technique known as reverse IP lookup)
• Pages visited on our website
• Device and browser information (device type, operating system, browser type)
• Referring page (the website you came from)
• Date, time, and duration of your visit
• Country, time zone, and language settings

Important: Apollo.io identifies visiting companies and organisations, not individual people. It does not collect your name, email address, or other directly identifying personal data through the tracking script. However, your IP address is considered personal data under UK GDPR.

These tracking technologies are only activated after you give your consent. If you do not consent, the Apollo.io tracking script will not operate.

Managing your cookie preferences

When you first visit our website, you will be presented with a cookie consent banner that allows you to accept or reject non-essential cookies.

You can also control cookies through your browser settings. Most browsers allow you to block or delete cookies. Please note that if you block all cookies, some parts of the website may not function as intended. Instructions for managing cookies in common browsers:

• Chrome: Settings → Privacy and Security → Cookies
• Firefox: Settings → Privacy & Security → Cookies and Site Data
• Safari: Preferences → Privacy → Manage Website Data
• Edge: Settings → Cookies and Site Permissions

Google Analytics in more detail

We use Google Analytics 4 (GA4), provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), to collect anonymised statistical data about how our website is used.

What Google Analytics collects

When you consent to analytics cookies, GA4 collects:

• Pages you visit and how long you spend on them
• How you arrived at our site (e.g. from a search engine, social media, or a direct link)
• Your general geographic location (city-level, derived from your IP address)
• Device and browser type, operating system, and screen resolution
• Interactions such as clicks, scrolls, and file downloads

What Google Analytics does NOT collect

• Your IP address is not stored. GA4 uses your IP address solely to determine your approximate geographic location and then immediately discards it. IP anonymisation is on by default in GA4 and cannot be disabled.
• Google Analytics does not collect your name, email address, or any other directly identifying personal information. We do not send any such information to Google.

Data retention

We have configured Google Analytics to retain user-level and event-level data for 14 months. Aggregated statistical reports (which cannot identify individuals) are retained indefinitely.

Google’s role

Google acts as our data processor for Google Analytics data. Google processes data in accordance with its Ads Data Processing Terms and does not use data collected through Google Analytics for its own advertising purposes unless separate advertising features are enabled (we do not use Google advertising features on this site).

Apollo.io in more detail

We use Apollo.io, provided by ZenLeads Inc. (d/b/a Apollo.io, 440 N Barranca Ave #4750, Covina, CA 91723, United States), as a B2B sales intelligence tool.

Why we use Apollo.io

As a design studio, we use Apollo.io to understand which types of businesses are interested in our work. This helps us focus our business development efforts. The service identifies companies visiting our website — for example, it might tell us that “a visitor from Company X viewed our portfolio page” — but it does not tell us which specific individual at that company visited.

How Apollo.io processes your data

When you consent to tracking, Apollo.io processes your IP address and browsing data to match your visit to a known company. Apollo.io maintains a database of business contact information. Once a visiting company is identified, we may use Apollo.io’s database to find publicly available professional contact details for relevant people at that organisation.

Apollo.io acts as our data processor for the website visitor data it collects on our behalf. Apollo.io may also act as an independent data controller for data it holds in its own business contact database.

Data retention

Apollo.io retains data for as long as it is useful for providing its services. You can request deletion of your data by contacting Apollo.io’s privacy team at privacy@apollo.io or through their Privacy Centre at https://www.apollo.io/company/privacy-center.

Lawful bases for processing

Under UK GDPR, we must have a valid legal reason (a “lawful basis”) for processing your personal data. The lawful bases we rely on are:

Legitimate interests (Article 6(1)(f) UK GDPR)

We rely on legitimate interests for:

• Responding to contact form enquiries. Our legitimate interest is to communicate with people who reach out to us about our design services. We consider this a reasonable expectation when someone contacts us.
• Website analytics (Google Analytics). Our legitimate interest is to understand how visitors use our website so we can improve it. We mitigate the impact on your privacy by using anonymised data (IP addresses are never stored) and limiting data retention.
• B2B sales intelligence (Apollo.io). Our legitimate interest is to identify potential business clients by understanding which companies visit our site. This is limited to company-level identification and is a standard B2B business practice. We mitigate the impact on your privacy by only activating tracking with your consent.
• Website security. Our legitimate interest is to protect our website from spam, hacking, and other threats. This includes processing IP addresses logged by our web server.

Where we rely on legitimate interests, we have conducted a balancing assessment to ensure our interests do not override your rights and freedoms. You have the right to object to processing based on legitimate interests at any time (see “Your rights” below).

Consent (Article 6(1)(a) UK GDPR)

We rely on your consent for:

• Setting non-essential cookies, including Google Analytics cookies and Apollo.io tracking cookies. You give consent through our cookie consent mechanism. You can withdraw your consent at any time by updating your cookie preferences.

Where we rely on consent, you have the right to withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis which allows us to do so.

Third-party services and data sharing

We use a number of third-party services to operate our website. Each of these may process some of your personal data. We do not sell your personal data to anyone.

Google (Google Analytics)

• Provider: Google Ireland Limited / Google LLC
• Purpose: Website analytics
• Data shared: Pseudonymous browsing data (pages visited, session data, device information, approximate location). IP addresses are used for geolocation only and not stored.
• Privacy policy: https://policies.google.com/privacy

Apollo.io

• Provider: ZenLeads Inc. (d/b/a Apollo.io)
• Purpose: B2B website visitor identification and sales intelligence
• Data shared: IP address, pages visited, device and browser information, referrer data
• Privacy policy: https://www.apollo.io/privacy-policy

Website hosting

• Provider: Cloudways
• Purpose: Hosting and serving our website
• Data shared: Your IP address and request data are processed by our hosting provider’s servers as part of delivering the website to your browser. This is a technical necessity.
• Privacy policy: https://www.digitalocean.com/legal/privacy-policy

International data transfers

Some of the third-party services we use are based outside the United Kingdom. This means your personal data may be transferred to, and processed in, countries outside the UK — including the United States.

We ensure that any international transfers of personal data are protected by appropriate safeguards as required by UK GDPR:

Transfers to the United States

Google (Google Analytics): Google LLC is certified under the UK Extension to the EU-US Data Privacy Framework (DPF). The UK government has recognised the UK DPF as providing an adequate level of protection for personal data. Google also uses Standard Contractual Clauses (SCCs) as an additional safeguard, along with technical measures including encryption in transit and at rest.

Apollo.io: Apollo.io (ZenLeads Inc.) is certified under the UK Extension to the EU-US Data Privacy Framework (DPF). Apollo.io also incorporates the UK International Data Transfer Addendum (UK IDTA) published by the ICO, as well as EU Standard Contractual Clauses (SCCs), into its Data Processing Agreement. Apollo.io holds ISO 27001 and SOC 2 Type II certifications.

If you would like more information about the safeguards in place for international transfers, please contact us.

Data retention

We do not keep your personal data for longer than we need it. Our retention periods are:

Data type	Retention period
Contact form submissions	Up to 2 years after your last communication with us, then securely deleted
Google Analytics data (user-level and event-level)	14 months, after which it is automatically deleted by Google. Aggregated, non-identifiable reports are retained indefinitely.
Apollo.io website visitor data	Retained by Apollo.io for as long as it is useful for providing their services. You can request deletion at any time.
WordPress admin login cookies	Session duration or up to 14 days (if “Remember Me” is selected)
Web server logs (including IP addresses)	30-Days

When data reaches the end of its retention period, we securely delete or anonymise it.

Your rights under UK GDPR

Under the UK General Data Protection Regulation, you have the following rights in relation to your personal data. These rights apply regardless of where you are located, as long as we process your data under UK GDPR.

Right of access — You have the right to request a copy of the personal data we hold about you. We will provide this free of charge within one month.

Right to rectification — If any personal data we hold about you is inaccurate or incomplete, you have the right to ask us to correct or complete it.

Right to erasure (“right to be forgotten”) — You have the right to ask us to delete your personal data in certain circumstances, for example if it is no longer necessary for the purpose we collected it, or if you withdraw your consent.

Right to restrict processing — You have the right to ask us to limit how we use your personal data in certain circumstances, for example while we are investigating a complaint you have made about accuracy.

Right to data portability — Where we process your data based on consent or for the performance of a contract, and the processing is carried out by automated means, you have the right to receive your data in a structured, commonly used, and machine-readable format, and to have it transferred to another controller.

Right to object — You have the right to object to processing based on legitimate interests. If you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms. You also have an absolute right to object to processing for direct marketing purposes.

Rights related to automated decision-making — We do not carry out any automated decision-making or profiling that produces legal or similarly significant effects on you.

Right to withdraw consent — Where we process your data based on your consent (for example, for non-essential cookies), you can withdraw your consent at any time. You can do this by updating your cookie preferences on our website or by contacting us directly.

How to exercise your rights

To exercise any of these rights, please contact us at:

• Email: info@deucestudio.com
• Post: Studio 116, The Pill Box, 115 Coventry Rd, London E2 6GG

We will respond to your request within one calendar month. In exceptional circumstances (for example, if your request is particularly complex), we may extend this by a further two months, but we will let you know within the first month if this is the case.

We may ask you to verify your identity before processing your request, to protect your data from unauthorised access.

There is no fee for exercising your rights in most circumstances. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse to act on it, but we will explain our reasons.

Your right to complain

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection.

You can contact the ICO at:

• Website: https://ico.org.uk
• Telephone: 0303 123 1113
• Live chat: Available on the ICO website
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would appreciate the opportunity to address your concerns before you contact the ICO. Please reach out to us first and we will do our best to resolve the issue.

Links to other websites

Our website may contain links to other websites, including the websites of clients whose work we showcase in our portfolio. This privacy policy applies only to https://deucestudio.com. We are not responsible for the privacy practices of other websites, and we encourage you to read their privacy policies.

Changes to this privacy policy

We may update this privacy policy from time to time to reflect changes in our data practices, the services we use, or the law. When we make significant changes, we will update the “Last updated” date at the top of this page.

We encourage you to review this page periodically. Where changes are significant, we may also notify you through a notice on our website.

Contact us

If you have any questions, concerns, or requests regarding this privacy policy or our data practices, please contact us:

• Business name: Deuce Studio
• Email: info@deucestudio.com
• Postal address: Studio 116, The Pill Box, 115 Coventry Rd, London E2 6GG
• Website: https://deucestudio.com