This privacy notice explains how Lem Studio collects, uses, stores and shares personal information.
1. Who we are
Lem Studio is operated by Dominic Plant trading as Lem Studio, 30 Glebeville, Leek, Staffordshire, ST13 5QU, United Kingdom.
Email: dom@lemstudio.co.uk
Dominic Plant trading as Lem Studio is the controller responsible for the personal information described in this notice.
2. The information we collect
Depending on how you interact with Lem Studio, we may collect the following information.
Enquiries and prospective clients
- Your name, company or organisation, email address and telephone number where supplied
- The service or package in which you are interested
- Project requirements and other information entered into the enquiry form
- Correspondence about your enquiry and your marketing preferences
- The source, date and time of your enquiry and the privacy-notice version presented when you submitted it
- Necessary request, security and anti-abuse information, potentially including IP address and request metadata
Please do not include passwords, payment-card information, special-category information or other unnecessary sensitive information in the free-text enquiry field.
Clients and project contacts
- Identity, business contact, billing and correspondence information
- Proposals, Statements of Work, contracts, project requirements, content, files, feedback and approvals
- Website, domain, hosting and account information
- Project communications, invoice references, amounts and payment status
- Information needed to provide, launch and hand over a website
- Complaints, disputes and related correspondence
Electronic acceptance
Where you accept a proposal, Statement of Work or Client Terms electronically, we may collect your name, email address, company, authority declaration, agreement declarations, acceptance date and time, accepted document references and versions, cryptographic hashes, and relevant technical and audit information.
Customer portal and website editor
When a customer account, portal or website editor is used, we may process your account email address, account and project permissions, login requests and timestamps, short-lived one-time codes or magic-link tokens, associated token records, login and security logs, and records of changes made through the editor.
One-time-code and magic-link emails are transactional security messages, not marketing.
Invoices and accounting
Once Lem Studio begins trading, we may process client and billing information, invoice references, dates and amounts, payment status, bank-transfer references, and accounting and tax records. Lem Studio does not currently use Stripe or PayPal. Initial client payments will be made by bank transfer using details supplied on an invoice.
Business-to-business marketing
Where permitted, we may process a business name, contact name and role, work email address, business telephone number, the public source of the information, company or entity classification, outreach-relevance and legitimate-interest notes, marketing preferences and objections, do-not-contact status, suppression reason and date, and previous outreach or correspondence.
Lem Studio does not buy indiscriminate consumer marketing lists and does not currently operate a bulk email mailing list.
Credentials and access
Website projects may occasionally require temporary access to client systems. Wherever practical, clients should create delegated user accounts rather than sharing primary passwords. Credentials should be shared using an appropriate encrypted secret-sharing method and should not be placed in ordinary email, CRM notes, GitHub issues, chat messages or project documents. Lem Studio will use access only for the relevant project purpose and will delete, return or ask the client to revoke it when no longer needed.
3. How we use personal information and our lawful bases
Responding to enquiries
We use enquiry information to respond, understand the proposed project, provide relevant information or a quotation, take steps towards entering a contract, and prevent spam, abuse and security incidents. Our lawful bases are steps at your request before entering into a contract and our legitimate interests in responding to genuine business enquiries, maintaining records and protecting our systems.
Providing client services
We use client information to prepare and administer proposals, Statements of Work and agreements; design, develop, launch and hand over websites; communicate about projects; manage revisions, approvals and support; maintain project and acceptance records; handle payments; and resolve complaints or disputes.
Our lawful bases are contract, legitimate interests in project administration, record keeping, evidencing agreements and protecting legal rights, and legal obligation where records must be retained for accounting, tax or other requirements.
Customer accounts and authentication
We use account and authentication information to provide appropriate access, deliver transactional login codes and links, verify login attempts, protect accounts and investigate suspected abuse. Our lawful bases are contract and our legitimate interests in secure access control and protecting client systems.
Consent-based marketing
If you voluntarily select an optional marketing checkbox, we may send occasional information about Lem Studio services, products, offers or discounts. Our lawful basis is consent. You may withdraw consent at any time by contacting dom@lemstudio.co.uk. Withdrawal does not affect processing that took place before consent was withdrawn.
Individually selected B2B outreach
Lem Studio may send relevant business-to-business marketing to contacts at limited companies, LLPs and other corporate subscribers where permitted by PECR and where Lem Studio has assessed that its legitimate interests are not overridden by the individual's rights.
Lem Studio does not send unsolicited electronic marketing to sole traders or ordinary partnerships unless consent or another legally valid route applies. The lawful basis under UK GDPR is legitimate interests, specifically introducing relevant Lem Studio services to businesses that may reasonably benefit from them.
Before cold calling, Lem Studio will screen relevant telephone numbers against the TPS, CTPS and its internal do-not-contact records. Every objection and opt-out will be respected. You can object to direct marketing at any time by replying to the communication or contacting dom@lemstudio.co.uk.
Legal claims and complaints
We may use relevant information to respond to complaints, establish what was agreed, obtain professional advice, and bring, defend or settle legal claims. Our lawful basis is our legitimate interests in protecting legal rights and resolving disputes.
4. Where we obtain personal information
We may obtain information directly from you; from someone authorised to act for your business; through our enquiry form, customer portal or website editor; through project and contract communications; from public business websites, Companies House, public registers, professional platforms and public business directories; from referrals and business introductions; and from relevant providers used to operate the website and CRM.
When information is obtained from a public source for B2B outreach, Lem Studio will record the source where reasonably practicable.
5. How long we retain information
We retain personal information only for as long as reasonably needed for its purpose, including legal, accounting, security and reporting requirements.
Enquiries and prospective clients
Unsuccessful enquiries, outreach leads and contact-form submissions are normally retained for up to 12 months after the most recent meaningful contact. They may be retained longer where discussions remain active, you ask us to contact you later, a complaint or dispute exists, retention is needed to protect legal rights, or a minimal suppression record is required. The 12-month review is currently carried out administratively rather than by automatic deletion.
Client records
Relevant contracts, acceptance evidence, Statements of Work, invoices, payment records and records needed for accounting, taxation or legal claims may normally be retained for six years after the relevant transaction or end of the client relationship. This does not mean every project file or message is retained for six years. Operational information will be deleted when no longer reasonably required.
Credentials
Credentials and temporary access information will be deleted, returned or revoked as soon as they are no longer required and will not be retained as ordinary long-term project records.
Authentication information
One-time codes and magic-link tokens are short-lived. Associated account, login and security records may be retained for a reasonable period to maintain security, investigate incidents and evidence authorised access.
Marketing and suppression records
Consent-based marketing information is retained until consent is withdrawn or the information is no longer required. If you object, unsubscribe or ask not to be contacted, Lem Studio may retain a minimal suppression record for as long as reasonably necessary to respect that preference. Suppression records may survive deletion of an ordinary lead record.
Technical records and backups
Security and request logs are retained only for the period reasonably required for abuse prevention, troubleshooting, service security and incident investigation, subject to provider controls. Information may remain in protected backups for a limited period after removal from active systems. Backups will not be routinely restored except for disaster recovery, security or business-continuity purposes.
7. International transfers
Some providers used by Lem Studio are headquartered outside the United Kingdom or operate infrastructure in multiple countries. Personal information may therefore be processed outside the UK.
Where UK data-protection law requires a safeguard, Lem Studio relies on the provider's applicable mechanism, which may include UK adequacy regulations or a recognised UK data bridge, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another safeguard permitted by UK law.
Contact dom@lemstudio.co.uk for further information about safeguards relevant to your information.
8. Security
Lem Studio uses proportionate technical and organisational measures intended to protect personal information. These may include restricted administrative access, role-based or delegated access, multi-factor authentication, secure connections, short-lived authentication tokens, private storage, encrypted secret sharing, access and acceptance audit records, provider security controls, data minimisation, credential revocation and deletion at handover, and protected backups where maintained.
No online service or storage system can be guaranteed completely secure.
10. Special-category and children's information
Lem Studio does not intentionally request health, biometric, genetic, political, religious, philosophical, trade-union, sex-life, sexual-orientation or criminal-offence information. Please do not provide such information unless genuinely necessary and Lem Studio has agreed an appropriate way to handle it.
Our services are intended for businesses and adults acting on their behalf. They are not directed at children.
11. Automated decision-making
Lem Studio does not currently use personal information to make solely automated decisions that produce legal or similarly significant effects. Automated validation, spam prevention and security checks may apply to form submissions and login attempts, but are used to protect systems rather than make significant decisions about individuals.
12. Your data-protection rights
Depending on the circumstances and lawful basis, you may have the right to ask for access to your personal information; ask for inaccurate or incomplete information to be corrected or completed; ask for information to be deleted; ask for processing to be restricted; object to processing; receive certain information in a portable format; withdraw consent; and complain about our use of your information.
These rights are not absolute and exemptions may apply. You have an absolute right to object to personal information being used for direct marketing.
To exercise a right, contact dom@lemstudio.co.uk. Lem Studio may need to verify your identity. Requests will normally be answered within one month, subject to any lawful extension or exemption.
13. Complaints
Please raise concerns first with Dominic Plant trading as Lem Studio at 30 Glebeville, Leek, Staffordshire, ST13 5QU or dom@lemstudio.co.uk.
If you remain dissatisfied, you may complain to the Information Commissioner's Office: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF; telephone 0303 123 1113; website https://ico.org.uk/make-a-complaint/. You may also have the right to seek a remedy through the courts.
14. Changes to this notice
Lem Studio may update this notice when its services, providers, legal obligations or processing activities change. The current version will be published on the Lem Studio website with its effective date and version number. Material changes will be communicated where reasonably appropriate.