Privacy notice

This privacy notice tells you what to expect me to do with your personal information.

Last updated: 17 September 2026

Who I am

Fluunt & Friction Ltd is the data controller for the personal information described in this notice.

• Registered in England and Wales, company number 17450006
• Registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
• The studio works from Birmingham
• Email: [email protected]

Cookies and tracking

There are none. This website sets no cookies, runs no analytics and carries no tracking of any kind. No profile of your visit is built. The one thing it keeps in your browser is a handful of your questionnaire answer codes (which options you picked, never what you typed or who you are), held only until the page after the questionnaire has read them back to you, then deleted. They never leave your browser.

My hosting and network providers keep standard server logs, including IP addresses, to deliver the site and keep it secure. I do not use these to identify individual visitors.

What information I collect, use, and why

To provide and improve products and services for clients

• Names and contact details
• Addresses
• Occupation
• Transaction data, including details about payments to and from you and the services you have purchased
• Information relating to compliments or complaints
• Video recordings
• Audio recordings, for example calls
• Records of meetings and decisions
• Account access information

For the operation of client accounts

• Names and contact details
• Addresses
• Purchase or service history
• Account information, including registration details

To comply with legal requirements

• Name
• Contact information
• Client account information

For dealing with queries, complaints or claims

• Names and contact details
• Purchase or service history
• Call recordings
• Client accounts and records
• Financial transaction information
• Correspondence

Recording sessions

Working sessions and handover sessions are recorded, by video or audio, so that I can work from what was said rather than from my notes. I tell everyone present before recording starts, and anyone can ask me not to record. Recordings are transcribed on my own device, using software I built. The audio is not sent to any third-party transcription service.

Learning across projects

I keep anonymised observations from completed projects — patterns in what tends to be broken and what tends to work — so that the process improves. These are structured notes, not recordings or transcripts: no quotes, no names, and nothing that identifies a business or an individual. Clients are told about this before a project starts and can opt out without it affecting the work.

How enquiries are handled

Submissions through my enquiry form are sorted automatically by budget range, so that I know the scale of a project before we speak. That sorting has no effect on you beyond the order in which I read things, and every submission is read by me personally. No decision about you is made by software alone.

Lawful bases and data protection rights

Under UK data protection law, I must have a "lawful basis" for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO's website.

Which lawful basis I rely on may affect your data protection rights, which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO's website.

• Your right of access — You have the right to ask me for copies of your personal information. You can request other information such as details about where I get personal information from and who I share personal information with. There are some exemptions, which means you may not receive all the information you ask for.
• Your right to rectification — You have the right to ask me to correct or delete personal information you think is inaccurate or incomplete.
• Your right to erasure — You have the right to ask me to delete your personal information.
• Your right to restriction of processing — You have the right to ask me to limit how I can use your personal information.
• Your right to object to processing — You have the right to object to the processing of your personal data.
• Your right to data portability — You have the right to ask that I transfer the personal information you gave me to another organisation, or to you.
• Your right to withdraw consent — When I use consent as my lawful basis you have the right to withdraw your consent at any time.

If you make a request, I must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact me using the contact details at the top of this privacy notice.

My lawful bases

To provide and improve products and services for clients

Contract — I have to collect or use the information so I can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Legitimate interests — I'm collecting or using your information because it benefits you, my business or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. My legitimate interests are:

I use business contact details and project material — name, business email address, phone number, company name, and the brand, website and commercial information a client shares with me during a project — to design and deliver brand identity, website and campaign work, and to review completed projects so that the service improves over time. This is necessary because a design and brand consultancy cannot deliver a commissioned project, communicate with the people working on it, or learn from finished work without this information. What I use is limited to ordinary business information that clients provide knowingly for this purpose; it is not used to make automated decisions about anyone, it is not sold, and it is not shared for anyone else's marketing. Clients expect their information to be used to carry out and improve the work they have commissioned, so the benefit to their project and to the quality of the service outweighs the minimal impact on them. Anyone can object or ask me to stop using their information at any time.

For the operation of client accounts

Contract — I have to collect or use the information so I can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Legal obligation — I have to collect or use your information so I can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

To comply with legal requirements

Legal obligation — I have to collect or use your information so I can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

For dealing with queries, complaints or claims

Legitimate interests — All of your data protection rights may apply, except the right to portability. My legitimate interests are:

When someone raises a question, a complaint or a claim, I use the contact details and the details of the issue they give me so I can investigate it, respond, and put things right, and I keep a record of the exchange in case the matter is raised again or develops into a dispute. This is necessary because a query cannot be answered and a complaint cannot be resolved without the information the person provides, and a record is needed to deal with or defend any later claim. I use only the information relevant to the issue, keep it no longer than needed for that purpose, and do not use it for anything else. Handling the matter properly benefits the person raising it at least as much as it benefits me, so the impact on them is minimal, and they can object or ask me to erase their information at any time.

For more information on my use of legitimate interests as a lawful basis you can contact me using the contact details set out above.

Where I get personal information from

• Directly from you
• Publicly available sources
• Third parties: clients and prospective clients, who give me the contact details of colleagues, stakeholders or their own suppliers who need to be involved in a project — for example people taking part in a brand discovery workshop or approving work. People who refer a contact to me, such as an existing client or a business contact passing on the name and business email address of someone who may want to work with me.

How long I keep information

I keep personal information only for as long as I need it for the purpose I collected it for. When I no longer need it, I delete it or securely destroy it.

• Enquiries that do not lead to a project: 12 months from the last contact.
• Client project files, correspondence, contracts, briefs and project records: 6 years from the end of the engagement, so that I can deal with any claim arising from the work.
• Workshop recordings and transcripts: 12 months from the end of the engagement, unless the client asks me to delete them sooner.
• Anonymised observations drawn from completed projects: kept indefinitely. These contain no names, no quotes and nothing that identifies a business or an individual.
• Invoices, payment records and other financial records: 6 years from the end of the tax year they relate to, as required for UK tax purposes.
• Complaints and the records relating to them: 6 years from the date the complaint is closed.
• Contact details of prospective clients gathered from publicly available sources: 12 months from the last meaningful contact, or immediately on request.

Who I share information with

Data processors

Google Ireland Limited / Google LLC — provides my business email, calendar, contacts, file storage and document tools, so correspondence with clients and enquirers and the files created during a project are stored on their systems.

Netlify, Inc. — hosts my website and delivers it to visitors, and receives and stores the information people submit through my website enquiry form.

Cloudflare, Inc. — my domain registrar, and provides the DNS, content delivery and security layer in front of my website, so visitors' connection data, including IP addresses, passes through their network.

Resend (Plus Five Five, Inc.) — sends me the notification email when someone submits the enquiry form, which contains the details that person provided.

Calendly LLC — books the introductory call, and holds the name, email address and chosen time of anyone who books one.

Notion Labs, Inc. — provides the workspace where I keep project records, proposals, client and prospective client contact details, and notes about ongoing and completed work.

Others I share personal information with

• Professional or legal advisors
• Organisations I'm legally obliged to share personal information with
• Specialist collaborators I bring in to work on a project, who are given only what that piece of work requires
• Publicly on my website, social media or other marketing material, where a client has agreed to it

Sharing information outside the UK

Where necessary, I transfer personal information outside of the UK. When doing so, I comply with the UK GDPR, making sure appropriate safeguards are in place.

For further information, or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact me using the contact information provided above.

Where necessary, these data processors will in turn share personal information outside of the UK with their own sub-processors. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place.

How to complain

If you have any concerns about my use of your personal information, you can make a data protection complaint to me:

• Email: [email protected]
• Post: Fluunt & Friction Ltd, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ

If you remain unhappy with how I've used your data after raising a complaint with me, you can also complain to the ICO.

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint