Privacy Policy — Kelva Studio

Who we are

Kelva Studio ("we", "us") is a web design studio operated by Max Aslaner as a sole trader. We are the data controller for the personal data described in this notice. Contact: hello@kelvastudio.com

What we collect

If you send an enquiry through the form on this site, that form asks for seven things: your name, email address, business type, timeline, budget range, location, and the message you write. Every field is yours to fill in as loosely as you like — none of it is verified against anything.

If you email us directly: your email address and whatever you choose to tell us about your business or project.

When the form is submitted, our server also reads the IP address the submission came from so it can cap how many enquiries one address sends in an hour. That is a spam control only: the address is held in memory, is never written to a database or attached to your enquiry, and disappears within the hour. Separately, our host (Vercel) records standard technical data about requests to this site in its own server logs, including IP address, browser type, and the page requested.

If we contact you as a prospective client: your business name, a business contact address, and publicly available information about your business, such as your website, Companies House record, or social media.

If you become a client: the content and project information needed to build and run your website.

We do not knowingly collect special category data and ask that you do not send it to us.

Why we use it, and our lawful basis

To reply to enquiries and provide quotes — legitimate interest. You approached us about work, so answering is the thing you asked for. The tick box on the form confirms you want a reply; it is not the basis we rely on, so nothing you sent becomes unusable if you later change your mind about being contacted.

To carry out low-volume, individually researched outreach to businesses we believe would benefit from our services — legitimate interest in offering relevant business-to-business services. You can object at any time.

To deliver and support a project you have engaged us for — performance of our contract with you.

To stop the enquiry form being abused and to keep the site standing up — legitimate interest in the security of our own systems.

To meet accounting and legal obligations — legal obligation.

Cookies

This site sets no cookies at all. There is no analytics, no advertising, no tracking pixel, and no third-party embed — the fonts are served from this site rather than fetched from anyone else. That is why you were not asked to agree to anything when you arrived: with nothing to consent to, a cookie banner would be theatre.

Who we share it with

We do not sell your data. Three providers process it on our behalf: Resend (delivering the enquiry email), Cloudflare (email routing), and Vercel (hosting this site). Each acts only on our instructions. Beyond those, your enquiry lands in our own inbox and goes no further.

International transfers

All three of our providers — Resend, Cloudflare, and Vercel — are US companies, so data reaches the United States. Where it is transferred outside the UK we rely on UK adequacy regulations, including the UK extension to the EU–US Data Privacy Framework where a provider is certified under it, or on standard contractual protections such as the UK International Data Transfer Agreement.

Your rights

You can access, correct, or delete your data, object to or restrict processing, and request portability. You can object to marketing at any time and we will stop. Email hello@kelvastudio.com and we will action your request promptly.

Where we rely on your consent for anything, you can withdraw it at any time — just email us. Withdrawing stops any further processing that depended on that consent. It does not reach backwards: it does not make processing we already carried out beforehand unlawful, and a reply already sent stays sent.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, though we would appreciate the chance to put it right first.

How long we keep it

Prospect contact data: until you ask us to remove it, or 12 months after last contact if nothing comes of it.

Enquiry data: 12 months from last contact.

Client project records: the duration of the project plus 6 years for tax and accounting purposes.

The form's anti-spam record of your IP address: within the hour. Our host's technical server logs: kept by the host on its own schedule, which we neither control nor mine.

Changes to this notice

We may update this notice from time to time. The "last updated" date above shows the current version.