Last updated: 19 May 2026 · Version 1.0
Alma Cara Studio is a UX-led operational design and strategy consultancy operated as a sole trader by Jade Boswell ("we", "us", "our").
Website: almacarastudio.com
Contact email: almacarastudio@gmail.com
ICO Registration Number: [tbc]
We are the data controller for personal data collected through this website. This means we are responsible for deciding how and why your personal data is used.
This policy applies to personal data collected through almacarastudio.com, including via the contact form and website analytics. It does not cover data processed as part of a client engagement — that is governed by a separate data processing agreement provided at the start of each engagement.
When you submit an enquiry through our contact form, we collect:
This form is powered by Netlify Forms. When you submit an enquiry, your data is processed by Netlify, Inc. (our hosting provider) before being delivered to us by email. Netlify is a US-based company and processes data under appropriate safeguards in accordance with UK GDPR. See Netlify's privacy policy for details.
We use Google Analytics to understand how visitors use our website. Google Analytics collects:
This data is aggregated and does not identify you personally. Google Analytics uses cookies to collect this information. For details of how Google handles this data, see Google's Privacy Policy.
We do not collect sensitive personal data (such as health, financial, or identity information) through this website. If you become a client, a separate policy governs the handling of any such data relevant to your engagement.
Under UK GDPR, we must have a lawful basis for processing your personal data. Our bases are:
Contact form enquiries — Legitimate interests: We have a legitimate interest in responding to business enquiries sent to us, and it is reasonable to expect that submitting a contact form implies consent to receive a reply.
Google Analytics — Consent: We only activate Google Analytics if you accept analytics cookies via the cookie consent banner displayed when you first visit the site. If you decline, no analytics cookies are set and no data is collected. You can withdraw your consent at any time (see Section 8).
If you would prefer we did not process your contact form data on the basis of legitimate interests, you have the right to object. See Section 8 for details.
We use the data we collect only for the following purposes:
We will not use your contact form data to add you to a mailing list, send you marketing, or share it with third parties for commercial purposes.
We do not sell your personal data. We share data only where necessary:
Netlify, Inc.: Our hosting provider processes contact form submissions and server log data on our behalf as a data processor. Netlify is based in the US and operates under appropriate UK GDPR transfer safeguards.
Google Analytics: Google LLC processes anonymised analytics data on our behalf. Google may transfer data outside the UK; this is covered by appropriate safeguards under UK GDPR.
All third-party processors are required to process your data only on our instructions and in accordance with applicable data protection law.
Where an enquiry leads to a client engagement, data relevant to that engagement is governed by the separate client data processing agreement, which sets a retention period of three years post-engagement.
You have the following rights in relation to your personal data:
Right of access: You can request a copy of the personal data we hold about you.
Right to rectification: You can ask us to correct inaccurate data.
Right to erasure: You can ask us to delete your data where there is no longer a lawful reason to retain it.
Right to restriction: You can ask us to limit how we use your data while a query is resolved.
Right to withdraw consent: Where we process your data on the basis of consent (Google Analytics), you can withdraw that consent at any time. To do so, click "Cookie Preferences" in the footer of any page. Withdrawal does not affect the lawfulness of any processing carried out before you withdrew consent.
Right to object: You can object to processing based on legitimate interests (contact form enquiries). We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.
Right to data portability: Where processing is based on consent or contract and carried out by automated means, you can request your data in a portable format.
To exercise any of these rights, contact us at almacarastudio@gmail.com. We will respond within one calendar month and will not charge a fee for reasonable requests.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
Cookies are small text files stored on your device when you visit a website. We use two categories of cookie:
Strictly necessary cookies: These are required for the website to function and are set automatically. They do not track you or collect personal data.
Analytics cookies (Google Analytics): These are only set if you accept analytics cookies via the consent banner displayed on your first visit. They help us understand how visitors use the site so we can improve it. If you decline, these cookies are not set and Google Analytics does not activate.
You can change your cookie preference at any time using the "Cookie Preferences" link in the footer. Declining or withdrawing consent will not affect your ability to use the website. You can also control cookies through your browser settings, though blocking all cookies may affect website functionality.
We take reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, or disclosure. Contact form data is transmitted via encrypted connections (HTTPS). Email correspondence is stored in a password-protected account.
No method of transmission over the internet is 100% secure. If you have concerns about sharing sensitive information via email or web form, please contact us to discuss alternatives.
Our website is accessible globally, but our services are provided to UK-based clients only. Where third-party processors (such as Google Analytics) transfer data outside the UK, they do so under mechanisms approved under UK GDPR, including adequacy decisions and standard contractual clauses.
Our website and services are not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has submitted personal data to us, please contact us and we will delete it promptly.
We may update this policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top of the page will always reflect the most recent version. We encourage you to review this policy periodically.
For any questions about this policy or to exercise your data rights, contact:
Jade Boswell
Alma Cara Studio
almacarastudio@gmail.com
almacarastudio.com