GDPR Compliant
Privacy Policy
At MTX Studio, we take your privacy seriously. This policy explains how we collect, use, and protect your personal information.
Last updated: 20 October 2026
Data Security
We use industry-standard encryption and security measures
Transparency
Clear information about what data we collect and why
Your Rights
Full control over your personal data and privacy choices
Data Controller
MTX STUDIO LTD
Bartle House, 9 Oxford Court, Manchester, M2 3WQ
Registered in England and Wales no. 15856187
Email: info@mtxstudio.com
Phone: +44 759 167 1763
Personal Information
When you contact us or use our services, we may collect:
- Name and contact details (email, phone number)
- Company name and business information
- Website details and technical requirements
- Communication preferences
- Details you submit via our contact form or lead magnets (for example the website health checklist)
- Payment information when you pay an invoice (processed securely by our payment provider — we do not store card details)
Technical Information
We automatically collect certain technical information when you visit our website:
- IP address and location data
- Browser type and version
- Device information
- Pages visited and time spent on our site
- Referring website information
Service Delivery
- Providing web design, support, brand, and growth services
- Responding to your inquiries and support requests
- Processing payments and managing accounts
- Delivering project updates and communications
Business Operations
- Improving our services and website functionality
- Analyzing website usage and performance
- Complying with legal and regulatory requirements
- Protecting against fraud, spam, and security threats (including bot protection and rate limiting)
Marketing
Newsletters and other marketing sent to individuals are sent only with consent. You can withdraw that consent at any time.
Emails to corporate subscribers (for example a company email address at a limited company) about our website services rely on legitimate interests. PECR regulation 22, which requires consent for some electronic mail marketing, does not apply to those corporate subscribers. Sole traders, and some partnerships, are individual subscribers. We treat them under the consent and soft opt-in rules rather than as corporate subscribers.
You can object to direct marketing at any time. See Prospective business contacts below for how that works when we have contacted you first.
- Sending relevant service updates and newsletters where we have consent
- Informing you about new features and services
- Providing promotional offers and discounts
MTX Studio Ltd finds and contacts prospective business contacts to offer website services. This section is our notice under UK GDPR Article 14, because we collect this information from sources other than you.
Data we collect
- Name and job title
- Business email address and business phone number
- Company details
- Publicly available information from the company website
- Website performance data, such as speed and technical quality signals
Where it comes from
- Companies House
- The company's own public website
- Web search results via the Brave Search API
- Google PageSpeed Insights, for site performance
Why we use it, and the lawful basis
We use this information to send B2B outreach about our website services. The lawful basis is legitimate interests (UK GDPR Article 6(1)(f)): introducing relevant website services to businesses that publish their details, and running a small studio. We balance that against the limited business contact data involved, the professional context of the message, and your absolute right to stop it. We do not use this route for newsletters to individuals.
Objecting to direct marketing
You have an absolute right to object to direct marketing at any time. Reply to the email, use the unsubscribe link, or email hello@mtxstudio.com. We will stop contacting you.
When you opt out we keep a minimal suppression list — the email address or domain only — so we do not contact you again. We delete the rest of the prospect record immediately.
How long we keep it
If you do not engage with us, we delete prospect data after 12 months. If you opt out, we delete it immediately except for the suppression entry, which we keep so the opt-out is honoured.
Under UK GDPR we process personal data only where we have a lawful basis:
- Contract — to take steps at your request before a contract, and to perform contracts for our services
- Legitimate interests — to operate and secure our website, respond to enquiries, prevent spam and abuse, improve our services, and contact prospective business contacts about our website services (see Prospective business contacts), where those interests are not overridden by your rights
- Consent — for non-essential cookies, analytics, and marketing where required; you can withdraw consent at any time
- Legal obligation — where we must keep records for tax, accounting, or other legal requirements
We do not sell, trade, or rent your personal information to third parties. We may share your data with:
Service Providers
- Hosting and infrastructure (Vercel) for the website and serverless functions
- Database (Supabase, EU/London region) for operational records such as outreach and suppression data
- Email (Fastmail) for studio email, and Resend for contact-form delivery and transactional mail
- Google PageSpeed Insights API, to read public website performance data for prospective business contacts
- Brave Search API, to find publicly available business information for prospective business contacts
- Content management (Sanity) for website and portfolio content
- Bot protection (Cloudflare Turnstile) on forms — may process IP address and device/browser signals to verify human submissions
- Rate limiting (Upstash Redis) when configured — stores short-lived request counters keyed by IP to prevent abuse of our APIs
- Analytics and advertising platforms (Google Analytics, Google Tag Manager, Google Ads, Google Search Console) when you consent via our cookie banner
- Payment processors for secure invoice and card transactions when arranged for a project
International Transfers
Some providers (including Vercel, Google — including PageSpeed Insights — Brave Search, Cloudflare, Resend, Fastmail, Sanity, and Upstash) may process data outside the UK. Supabase is used in the EU/London region. Where personal data is transferred outside the UK we rely on an appropriate safeguard, such as a UK adequacy regulation, the UK International Data Transfer Agreement (IDTA), or Standard Contractual Clauses, as applicable to that provider.
Legal Requirements
We may disclose your information if required by law, court order, or to protect our rights and property.
We implement appropriate technical and organizational measures to protect your personal data:
- SSL encryption for all data transmission
- Secure servers with regular security updates
- Limited access to personal data on a need-to-know basis
- Regular security audits and monitoring
- Staff training on data protection best practices
Under UK GDPR, you have the following rights regarding your personal data:
Right to Access
Request copies of your personal data
Right to Rectification
Request correction of inaccurate data
Right to Erasure
Request deletion of your data
Right to Portability
Request transfer of your data
Right to Object
Object to processing of your data
Right to Restrict
Request restriction of processing
We use cookies and similar technologies to enhance your experience on our website. For detailed information about our cookie usage, please see our Cookie Policy.
Types of Cookies We Use
- Essential cookies for website functionality
- Analytics cookies to understand website usage
- Preference cookies to remember your settings
- Marketing cookies (with your consent)
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:
- Active client data: Duration of service relationship plus 7 years for legal requirements
- Inquiry data: 2 years from last contact
- Prospective business contacts: 12 months without engagement, then deleted. On opt-out, deleted immediately except a minimal suppression entry (email address or domain) so we do not contact you again
- Website analytics: 26 months
- Marketing data: Until you unsubscribe or request deletion
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by:
- Posting the updated policy on our website
- Sending email notifications to active clients
- Updating the "Last updated" date at the top of this policy
Questions About Your Privacy?
If you have any questions about this Privacy Policy or how we handle your data, please contact us.