Privacy Policy

SH Studios · Last updated: 15 September 2026

SH Studios is committed to protecting your privacy. This policy explains what personal data we collect, how we use it, and the rights you have under the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

Who we are

SH Studios is the trading name of SH Studios Digital Ltd, a company registered in England and Wales (company number 17354895). SH Studios Digital Ltd is the data controller. We are registered with the Information Commissioner's Office under registration reference ZC225207.

We use two email domains and both belong to us: hello@shstudios.uk is our main business address, and hello@shstudiosdigital.uk is the address our outreach email is sent from and monitored on. If you received an email from @shstudiosdigital.uk and wanted to check it was really us, it was, and either address reaches us.

1. If you visit this website

We set one cookie without asking you first, and two analytics tools only if you say yes:

• sh-cookie-consent: a first-party cookie that remembers whether you accepted or rejected analytics, so we stop asking. It lasts 6 months and contains nothing but your answer. This is a strictly necessary cookie: it exists only to honour your choice, so it is set without consent.
• Google Analytics (_ga, _ga_*): anonymous usage statistics, provided by Google LLC. IP addresses are masked. These are set only if you press "Accept" on the cookie banner, and never before.
• Microsoft Clarity (_clck, _clsk): heatmaps and anonymous session recordings of how pages are used (clicks, scrolls and mouse movement), provided by Microsoft. Anything typed into a form is masked and never recorded, and recordings are kept for 30 days. Microsoft may also set its own cookies on its clarity.ms domain. Like Google Analytics, Clarity loads only if you press "Accept", and never before.

We run no ads and use no advertising cookies. You can change your mind at any time using the Cookies link in the footer of any page, which clears the stored choice and re-asks.

2. If you use the chat

The chat widget on this site sends what you type, plus the conversation so far, to OpenAI L.L.C. (USA) to generate a reply. Please do not put personal details in it that you would not put in an email. Under OpenAI's API terms your messages are not used to train their models. We do not store chat transcripts ourselves: the conversation lives in your browser tab and is gone when you close it.

3. If you fill in a form or email us

We collect your name, email address, business name, phone number if you give one, and whatever you write in the message. Forms on this site are processed by Netlify Forms (Netlify Inc.) on our behalf.

We use that information to:

• reply to you and quote for the work. Our lawful basis is that this is necessary to take steps at your request before entering into a contract (UK GDPR Article 6(1)(b));
• send you occasional tips and offers about websites and getting found on Google, unless you ticked the box on the form asking us not to. Our lawful basis is legitimate interests (Article 6(1)(f)), and under PECR regulation 22(3) we rely on the "soft opt-in": you contacted us about our services, we only market our own similar services, we offered you a simple way to refuse at the point you got in touch, and every message we send carries another one.

Ticking that box is recorded against your enquiry. If you tick it we do not add you to any marketing list at all. We only answer your question.

We never sell, rent or share your details with anyone else for their own marketing.

4. If you are a client

We hold the information needed to build, host and look after your website, invoice you and keep proper accounting records. Our lawful basis is performance of a contract (Article 6(1)(b)) and, for the accounting records, legal obligation (Article 6(1)(c)). Card payments are handled by Stripe; we never see or store your card number.

5. If we contacted you first (business outreach)

This section is the notice required by Article 14 of the UK GDPR, because we obtained your details from somewhere other than you.

What we hold. A business listing: business name, business email address, business phone number, business address, website address, trade or sector, and the public star rating and review count shown on Google. Where a business email address contains a person's name (for example tony@ plus the firm name), that is personal data and this policy applies to it.

Where we got it. Publicly accessible business sources only: the business's own website, its Google Business Profile / Google Maps listing, the Companies House register, and public business directories. We do not buy lists and we do not scrape personal social media.

Why. To offer web design and website care services to small businesses whose current website is missing, broken or dated. Our lawful basis is legitimate interests under Article 6(1)(f), our interest in marketing our services to businesses likely to want them. We have carried out and documented a legitimate interests assessment; you can ask us for it.

The marketing rules we apply (PECR). These are worth stating precisely, because they are often stated wrongly:

• PECR regulation 22, which bans unsolicited marketing email without consent, applies to individual subscribers. Regulation 2(1) defines "individual" as "a living individual and includes an unincorporated body of such individuals", which means sole traders and ordinary partnerships are individual subscribers and get the same protection as a private person.
• That rule does not apply to corporate subscribers: limited companies, LLPs, Scottish partnerships, corporations sole and other bodies with separate legal personality. PECR does not require their consent for marketing email.
• So we only send outreach email to businesses we have positively confirmed are corporate subscribers, by matching them against the Companies House register and recording the company number we matched. A business we have not checked, or could not match, is not emailed. Our system refuses to send to anything not marked as a confirmed corporate subscriber.
• Regulation 23 applies whoever we write to, and requires that we never disguise or conceal who we are, and that we give a valid address for opting out. Every outreach email we send carries our company name, registered number, place of registration, a link to this policy and an opt-out address.
• PECR does not strictly require us to honour a corporate subscriber's opt-out. We honour it anyway, permanently, and the UK GDPR right to object (below) applies regardless.

Telephone. Many of these records hold a business phone number, and we may call it to introduce ourselves and offer a free preview. Live marketing calls are governed by PECR regulation 21, which, unlike the email rule above, protects corporate and individual subscribers alike: a number registered with the Telephone Preference Service or the Corporate TPS must not be called for marketing, and neither must a number whose subscriber has told us not to call. If you tell us not to call, by any route including simply saying so on the phone, we record it and we stop. We never send marketing SMS.

WhatsApp. Where a business lists a mobile number, we may send it a short WhatsApp message from our business line or a founder's phone, to introduce ourselves and offer a free preview. Messages travel through WhatsApp, run by WhatsApp Ireland Ltd (part of Meta), under its own privacy policy. To object, reply STOP or tell us any other way: we add the number to our do-not-contact list and never message it again.

Your right to object. You can object to this at any time, and for direct marketing that right is absolute. We must stop, and we do not get to weigh it against our own interests (Article 21(2)–(3)). Use any of the routes in the box at the top of this page.

Being told. We hold records for a large number of businesses and, for most of them, we have no way to contact a named person without emailing the very address we are trying to justify emailing. Where notifying every record individually would involve disproportionate effort, Article 14(5)(b) allows us to make this information publicly available instead, which is what this page is. Every outreach email we send also links to this page at first contact.

Referrals. If someone refers a business to us, we may hold that business's name and a contact detail the referrer gave us. We use it only to make the introduction, and we delete it if it is unused within 90 days.

6. How long we keep things

• Chat transcripts: not stored by us.
• Website enquiries and form submissions: 12 months from your last contact with us, then deleted, unless you become a client, in which case the client rule below applies.
• Business outreach records: reviewed every 12 months. A business we have never successfully contacted, or which has had no activity for 24 months, is deleted at the next review.
• Do-not-contact list: kept indefinitely, on purpose. It holds the email address or phone number, the reason it was suppressed and, where we have it, the date. Nothing else. We keep it because deleting it is how a business that asked us to stop gets emailed again. This is itself a legitimate interest, and it is the narrowest possible record.
• Client records: 7 years after the end of the contract, to meet UK accounting and tax record-keeping requirements.
• Analytics: 14 months, per our Google Analytics retention setting.
• Microsoft Clarity session recordings: 30 days.

7. Who else touches your data

We keep this list short deliberately. These are our processors, acting only on our instructions:

• Netlify Inc.: website hosting and form submissions (USA)
• Supabase: the database holding client and prospect records
• Google LLC: Google Workspace email, and Google Analytics (USA)
• Hetzner Online GmbH: the server that runs our outreach system (Germany)
• Stripe: payments for clients
• OpenAI L.L.C.: powers the site chat (USA); international transfer under the UK IDTA / standard contractual clauses
• Anthropic PBC: AI tools we use to prepare our internal daily brief from our records, and draft messages (USA)
• Microsoft: Microsoft Clarity heatmaps and session recordings, only if you accept analytics cookies (data may be processed in the USA)
• one.com: hosts the @shstudios.uk mailboxes (EU)

Some of these are outside the UK. Where that is the case, the transfer is covered by an adequacy decision or by standard contractual clauses in our agreement with the provider. We do not sell, rent or otherwise pass your data to anyone for their own purposes.

We do not use automated decision-making that produces legal or similarly significant effects about you. We score business records to decide who is worth contacting, but a person decides what is actually sent.

8. Your rights

Under the UK GDPR you have the right to:

• be told what personal data we hold about you, and get a copy of it
• have inaccurate data corrected
• have your data erased ("right to be forgotten")
• object to processing for direct marketing at any time: this one is absolute and we must always comply (Article 21(2))
• object to other processing based on legitimate interests
• ask us to restrict how we use your data
• receive a copy of your data in a portable format
• withdraw consent where we relied on it (such as analytics cookies)

To exercise any of these, email hello@shstudios.uk. We will respond without undue delay and within one month, and it is free.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or call their helpline on 0303 123 1113. We would rather you told us first so we can put it right, but you do not have to.

Contact

SH Studios Digital Ltd · Southampton SO14 3QS · hello@shstudios.uk · shstudios.uk · registered in England and Wales, company number 17354895 · ICO registration ZC225207

See also: Terms & Conditions