This Privacy Policy applies to PHX-STUDIO (“we”, “us”, “our”), a digital studio based in Enfield, London, United Kingdom, operating the website https://phx-studio.com and related services including websites, spreadsheets, iOS apps, client portals, RSVP pages, and Fos Mou digital memorial pages.

Controller: PHX-STUDIO

Trading location: Enfield, Greater London, United Kingdom

Email: info@phx-studio.com

Phone: 07494 810431

Website: https://phx-studio.com

If you have questions about this policy or your personal data, contact us using the details above. We do not currently appoint a formal Data Protection Officer; privacy queries are handled by our service team.

This policy explains how we collect, use, store, share and protect personal data when you:

Division-specific policies add extra rules for Websites, Spreadsheets, iOS Apps, Portals, RSVP and Fos Mou. If there is a conflict, the more specific division policy applies to that service, and this Privacy Policy continues to apply to personal data.

• visit or use our websites and landing pages
• enquire about or purchase our services
• communicate with us by email, phone, form, messaging apps or social media
• use client portals, RSVP pages, apps or memorial pages we build or host
• supply content, credentials or business information needed to deliver a project.

A. Identity and contact data

B. Project and commercial data

C. Technical / website data

D. Special category / sensitive data (limited cases)

We do not seek special category data as a matter of course. Fos Mou memorial projects or client content may incidentally include health, religious, or other sensitive information about a deceased person or family. We process such information only where necessary to deliver the service you request, with appropriate care, and usually on the basis of explicit consent or another applicable lawful basis. See the Fos Mou Division Policy.

• Name, business name, job title
• Email address, telephone number
• Postal / service address where needed
• Account login identifiers for portals or apps
• Briefs, requirements, feedback and approvals
• Brand assets, copy, images and files you supply
• Invoices, payment status, quotes and contracts
• Support tickets and correspondence
• IP address, browser type, device type, approximate location derived from IP
• Pages visited, referral source, time on site
• Cookie and similar technology identifiers (see Cookies below)

• Directly from you (forms, email, phone, WhatsApp/Instagram DMs, meetings)
• From your authorised staff or agencies
• Automatically via our website, hosting and analytics tools
• From payment or invoicing providers when you pay us
• From public sources you ask us to use (e.g. Google Business information, public social profiles for a build)

Depending on the activity, we rely on one or more of:

• Contract – to quote, deliver, invoice and support services you request
• Legitimate interests – to run and improve our business, secure our systems, keep records, and respond to enquiries (balanced against your rights)
• Consent – for non-essential cookies/marketing where required, and for certain memorial/sensitive processing
• Legal obligation – tax, accounting, regulatory or law-enforcement requirements.

• Responding to enquiries and providing proposals
• Delivering design, development, hosting-related and support services
• Account, billing, debt recovery and bookkeeping
• Security, fraud prevention and troubleshooting
• Improving our website, packages and client experience
• Sending service messages (and marketing only where permitted)
• Complying with law and defending legal claims

Our site may use:

You can control cookies via your browser and any cookie banner we display. Blocking some cookies may affect site features.

• Strictly necessary cookies (security, load balancing, form function)
• Analytics cookies (e.g. to understand traffic) – used only with consent where required
• Preference / functional cookies

We share personal data only where needed, including with:

We do not sell personal data. Some providers may process data outside the UK. Where that happens we use appropriate safeguards (e.g. UK adequacy regulations or standard contractual clauses) as required.

• Hosting, domain and email providers (e.g. Hostinger or equivalent)
• Cloud storage, code repositories and project tools
• Payment processors / banks
• Analytics and security providers
• Professional advisers (accountants, solicitors, insurers)
• App stores (Apple) where apps are published
• Sub-contractors bound by confidentiality, where we engage them

We may retain anonymised or aggregated data indefinitely.

• Enquiry data: typically up to 24 months after last contact if no project starts
• Client project files: for the life of the commercial relationship plus up to 6 years (limitation / tax)
• Invoices and accounting records: at least 6 years
• Website logs / security logs: usually 30–180 days unless needed longer for incidents
• Memorial / RSVP content: for as long as the service remains active or as agreed in writing; see division policies

We use reasonable technical and organisational measures (access controls, strong passwords, TLS where appropriate, least-privilege access, backups). No method of transmission or storage is 100% secure. Please use strong unique passwords for any portal or admin access we provide and tell us promptly of suspected unauthorised access.

Under UK data protection law you may have the right to:

To exercise rights, email info@phx-studio.com. We may need to verify your identity. We aim to respond within one month.

• access your personal data
• rectify inaccurate data
• erase data in certain circumstances
• restrict or object to certain processing
• data portability (where applicable)
• withdraw consent where processing is based on consent
• complain to the Information Commissioner’s Office (ICO) – https://ico.org.uk

Our business services are aimed at adults and organisations. We do not knowingly market to children. Memorial or family pages may include information about minors only where a parent/guardian or authorised adult supplies it and requests publication.

We may send service updates related to an active project. We send promotional emails only with consent or soft opt-in where permitted for existing customers, and you can unsubscribe at any time.

Our site may link to third-party websites (Instagram, partner sites, client demos). Their privacy practices are their own.

We may update this policy from time to time. The “Last updated” date will change. Continued use of our site/services after updates constitutes notice of the revised policy where permitted by law. Material changes may be notified by email or site notice.

This Privacy Policy is governed by the laws of England and Wales. The courts of England and Wales have non-exclusive jurisdiction, without prejudice to mandatory consumer protections that may apply if you are a consumer.