GDPR Notice

Who we are

[Company legal name] is a company organized in [State], United States. For questions about this notice or to exercise your rights, contact us at [your privacy contact].

Personal data we process

We process the categories of personal data described in our Privacy Policy — principally the contact and project information you submit through our intake form or share during an engagement, together with limited technical data collected automatically when you visit the site.

Legal bases for processing

Under the GDPR and UK GDPR, we rely on the following legal bases:

• Consent — for example, when you submit the intake form or opt in to communications. You may withdraw consent at any time.
• Performance of a contract — to scope, deliver, and bill for an engagement you have requested or entered into.
• Legitimate interests — to operate, secure, and improve the site, where those interests are not overridden by your rights and freedoms.
• Legal obligation — to comply with applicable tax, accounting, and other legal requirements.

Your rights

If you are in the EEA or the UK, you have the following rights regarding your personal data:

• Access — to obtain confirmation of, and a copy of, the personal data we hold about you;
• Rectification — to have inaccurate or incomplete data corrected;
• Erasure — to have your data deleted in certain circumstances;
• Restriction — to limit how we process your data in certain circumstances;
• Objection — to object to processing based on our legitimate interests;
• Portability — to receive certain data in a portable format; and
• Withdraw consent — where processing is based on consent, at any time, without affecting prior processing.

How to exercise your rights

To exercise any of these rights, contact us at [your privacy contact]. We may need to verify your identity before responding. We will respond within the timeframe required by law (generally one month, which may be extended for complex requests). Exercising your rights is free in most cases.

International transfers

Because we are based in the United States, your personal data is transferred to and processed in the United States. Where we transfer EEA or UK personal data, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum. You may request a copy of the relevant safeguards by contacting us.

Automated decision-making

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. A person reviews any qualification of project inquiries.

Retention

We retain personal data only as long as necessary for the purposes set out in our Privacy Policy, including engagement and tax records kept for [retention period — e.g. 7 years for engagement and tax records].

Right to lodge a complaint

If you believe our processing of your personal data infringes data protection law, you have the right to lodge a complaint with your local supervisory authority. In the UK, this is the Information Commissioner's Office (ICO). We would, however, appreciate the chance to address your concerns first.

EU/UK representative

Where required under Article 27 of the GDPR or UK GDPR, our representative's contact details are: [EU/UK representative — appoint and insert if required].