Privacy Policy
Last updated: 3 November 2026 · Version 1.0
This Privacy Policy explains how (“we”, “us” or “our”) collects, uses, stores and protects personal data when you visit this website, contact us, or discuss a potential project with us. It is intended to provide the information required by the UK GDPR, the Data Protection Act 2018 and, where applicable, the EU General Data Protection Regulation (“GDPR”).
1. Who is responsible for your data?
is the data controller for the personal data described in this notice. Our registered office is . Our trading address is 20–22 Wenlock Road, London, N1 7GU, United Kingdom.
For privacy questions or to exercise your rights, contact us using the following plain-text details:
Email: info@aelvorinthessara.com
Phone: +44 20 7946 0852
We have not appointed a data protection officer for the processing described on this website. If this changes, this notice will be updated with the relevant contact details.
2. What personal data may we process?
Depending on how you interact with us, we may process:
- identity and contact data, such as your name, role, company, email address and telephone number;
- project and correspondence data, including your brief, requirements, budget, meeting notes, messages and attachments;
- commercial and administrative data, such as proposals, invoices, payment records and contract information;
- technical data needed to operate and secure the website, such as IP address, browser type, device information, approximate location derived from IP, request timestamps and server logs; and
- preferences and consent records, where you make a privacy or cookie choice.
Please do not send special-category data, identity documents, financial account credentials or other sensitive information through this website unless we specifically request it and explain why it is needed.
3. How we collect personal data
We may collect data directly from you when you email, telephone or otherwise contact us; when you provide a project brief or business information; and when we enter into a contract or maintain business records. We may also receive limited technical data automatically from the browser and hosting infrastructure when the website is requested.
4. Purposes and lawful bases
We process data only for specified, explicit and legitimate purposes, and only to the extent reasonably necessary. The applicable lawful basis depends on the context:
| Purpose | Typical data | Lawful basis |
|---|---|---|
| Responding to an enquiry or project request | Identity, contact and project details | Taking steps at your request before entering into a contract; or our legitimate interest in responding to business enquiries. |
| Providing agreed design services | Contact, project, contract and billing data | Performance of a contract. |
| Accounts, tax, legal and compliance records | Identity, transaction and contract data | Compliance with a legal obligation. |
| Website security, troubleshooting and service improvement | Technical data and server logs | Our legitimate interest in operating, securing and improving a reliable website, balanced against your rights. |
| Optional marketing communications | Contact details and consent record | Your consent, where required. You may withdraw it at any time. |
Where we rely on legitimate interests, we consider the purpose, necessity and impact of the processing and do not override your fundamental rights and freedoms. We will not use your data for a new incompatible purpose without providing further information or obtaining consent where required.
5. Cookies and similar technologies
This static website does not currently use advertising cookies, analytics cookies, social-media pixels or behavioural profiling. Strictly necessary technical logs may be created by the hosting environment to deliver and protect the site. See our Cookie Policy for more detail.
6. Who may receive your data?
We may disclose personal data to carefully selected providers who help us host, secure, communicate through, maintain or administer the website and our business. They may process data only on our instructions and under appropriate confidentiality and data-processing arrangements. We may also disclose data to professional advisers, insurers, auditors, banks, public authorities or law-enforcement bodies where necessary, lawful or required.
We do not sell personal data and do not share it for third-party advertising.
7. International transfers
Some providers may process information outside the UK or European Economic Area. Where a restricted transfer occurs, we will use a lawful transfer mechanism such as an adequacy decision, the UK International Data Transfer Agreement or Addendum, EU Standard Contractual Clauses, and supplementary safeguards where appropriate. You may request further information about relevant safeguards using the contact details above.
8. How long do we keep data?
We keep personal data only for as long as necessary for the purpose collected, to perform a contract, resolve a dispute, establish or defend legal claims, maintain accounting records, or comply with a legal obligation. As a general guide, enquiry correspondence is normally reviewed and deleted or anonymised after 24 months of inactivity; project and contract records are retained for the duration of the relationship and then for the applicable legal, accounting or limitation period; and technical logs are retained for the period set by the hosting provider’s security and operational policy.
Retention periods may be extended where a claim, investigation or legal hold requires it. Data is securely deleted or anonymised when no longer needed.
9. Security
We use measures appropriate to the risk, including access controls, least-privilege access, secure credentials, backups where appropriate, confidentiality obligations, software maintenance and procedures for handling suspected incidents. No internet transmission or storage system can be guaranteed completely secure, so please use reasonable care when sending information.
10. Your rights
Subject to applicable exceptions and verification requirements, you may have the right to:
- ask for access to your personal data and a copy of it;
- ask us to correct inaccurate or incomplete data;
- ask us to erase data where there is no good reason for us to continue processing it;
- ask us to restrict processing in certain circumstances;
- object to processing based on legitimate interests, including direct marketing;
- receive certain data in a structured, commonly used and machine-readable format;
- withdraw consent at any time where consent is the legal basis; and
- object to or request safeguards around solely automated decisions that produce legal or similarly significant effects.
To exercise a right, contact us at info@aelvorinthessara.com with enough information to identify the relevant request. We normally respond without undue delay and within one month, although the law permits an extension of up to two further months for complex or numerous requests. We may ask for proportionate identity verification and may charge a reasonable fee or refuse a request only where permitted by law.
11. Complaints
We ask that you contact us first so we can investigate and resolve your concern. You also have the right to complain to the supervisory authority in the country where you live, work or believe an infringement occurred. In the UK, this is the Information Commissioner’s Office (ICO). In the EEA, you may contact the relevant national data protection authority.
12. Children
This website and our services are intended for businesses and adults. We do not knowingly seek to collect personal data from children. If you believe a child has provided personal data to us, please contact us so we can review and delete it where appropriate.
13. Changes to this notice
We may update this Privacy Policy when our processing, services, legal obligations or security practices change. The “last updated” date will show when the latest version was published. Where a material change affects your rights, we will provide additional notice where required.
This document is an informational template based on the processing described above. Final legal review by a licensed attorney is recommended before production deployment.