Privacy Policy

Who we are

SOH Studio is a creative studio working with clients internationally. For anything in this policy, we are the controller of the personal information described below.

The quickest way to reach us about privacy, or about anything else, is hello@soh.studio.

What we collect

When you send an enquiry through this site, we collect what you type into the form. On the contact form that is your name, your email address, optionally your company, what you are working on, the type of project, your timeline and your message. On the film site's enquiry form it is your name, your email address, what you would like to talk about and your message.

That enquiry is emailed to our studio inbox. It is not saved into a database, and there is no client area, no account and no mailing list attached to it. If you ask us to delete it, deleting it from the inbox is the whole job.

We do keep a short technical record that the email was sent: the studio address it went to, the subject line, which template was used, whether delivery succeeded and when. The subject line is built from your name and the type of project, so your name is in that record even though your message is not.

Our hosting keeps standard server logs, which include IP addresses and browser details, for security and for diagnosing faults. We do not use them to build a picture of you.

Why we use it

To reply to you, to talk about work you are considering, and to do the work if we go ahead. Under UK and EU data protection law, that is either our legitimate interest in responding to someone who has contacted us, or the steps taken at your request before entering a contract.

We keep the delivery records so that we can tell the difference between an enquiry nobody answered and an enquiry that never arrived. That is our legitimate interest in a contact form that demonstrably works.

We do not use anything you send us to advertise to you, and we do not sell it, rent it or trade it. There is no marketing list to be added to.

Cookies and analytics

This site sets no advertising cookies and no tracking cookies, and it does not follow you to other sites.

We use Vercel Web Analytics to see which pages get read and roughly where readers arrive from. It is aggregate and cookieless: it does not identify you and it does not build a profile. That is why there is no cookie banner on this site, rather than an oversight.

The typeface is served from this site rather than from a font network, so loading a page here does not tell anyone else that you did.

There is a private area of this site for our own use, behind a login, and signing into it sets a session cookie. It is strictly necessary for staying signed in, and if you have not signed in you will never receive it.

Who else sees it

The suppliers who run the site for us, and only for that purpose: Vercel, who host it and provide the analytics described above; Resend, who deliver the enquiry emails; and the managed database that holds the delivery records. Each acts on our instructions and none of them is permitted to use your information for their own ends.

We also use ordinary business email to read and reply to what you send. If we go on to work together, we may need to share relevant details with collaborators on that project, and we will tell you who when it arises.

We will disclose information if the law requires it. If that ever happens we will tell you, unless we are prohibited from doing so.

Where it goes

We work internationally, and so do the suppliers above. Some of them are based in, or store data in, the United States, and an enquiry sent from Europe will be read outside it. Where information leaves the UK or the European Economic Area, it moves under the safeguards those rules require, which in practice means the standard contractual clauses in our agreements.

How long we keep it

Enquiries stay in our inbox for as long as the conversation is useful. If it does not turn into a project, we clear it out within two years. If it does, correspondence is kept for as long as the relationship runs and for six years after it ends, which is the period we may need it for tax and for defending a claim.

The delivery records are kept for twelve months and then deleted.

Your rights

You can ask us for a copy of what we hold about you, to correct it if it is wrong, to delete it, to restrict what we do with it, or to receive it in a portable form. You can object to us relying on legitimate interests, and where you do we will stop unless we have compelling grounds not to.

Ask by emailing hello@soh.studio. We will answer within one month, and there is no charge. We may need to check who you are first, which for an enquiry usually means replying from the address you wrote from.

If you think we have got this wrong, you are entitled to complain to your national data protection authority. We would rather you told us first and gave us the chance to fix it.

Changes

If this policy changes, the updated version appears here and the date at the top of the page changes with it. Where a change is significant and we hold a way to contact you, we will use it.