Privacy Policy

1. Who We Are

Moji Studio is a Liverpool based digital studio providing website design and development, branding, technical SEO, automation, ongoing website care, Google Business Profile support, and related digital services.

The data controller for this website is Moji Technologies Ltd, operating under the Moji Studio brand.

Moji Technologies Ltd is a private limited company registered in England and Wales with company number 17181491. Registered office: 66 Paul Street, London, England, United Kingdom, EC2A 4NA.

2. Personal Data We Collect

2.1 Contact form

• Name and email address
• Business name, and phone or WhatsApp number, if you give them
• The services you are interested in, your budget range, preferred timeline, and what branding, content, or images you already have
• Your project overview and anything else you write in the form
• Your confirmation that you agree to be contacted, the time you sent the form, the page you sent it from, and the version of this policy shown to you

2.2 Email and WhatsApp

• Email: your email address, name, and the content of your emails and any attachments
• WhatsApp: your phone number, your WhatsApp profile name, the content of your messages, and when they were sent
• Our replies to you, and notes our team adds about your enquiry or project

2.3 Technical and usage data

• Browser, device, and page usage data collected through Google Analytics, if you consent
• Cookie consent choices stored in your browser
• Anti-spam signals connected to form submissions, such as a hidden spam-trap field and how long the form was open
• Your IP address and browser details, which reach our hosting provider (Cloudflare) when you load a page

3. How We Use Personal Data

• To reply to your enquiry by email, phone, or WhatsApp, and to prepare proposals
• To keep a record of each enquiry and conversation in our customer management system (MojiCRM), so we can follow up, see what was agreed, and deal with any questions later
• To send an automatic email confirming we received your contact form enquiry
• To provide services and manage active client work
• To operate and secure the website and contact form, and to filter spam
• To understand site usage and improve the website, where analytics consent is given
• To keep records needed for contractual, tax, accounting, and legal purposes

We do not send marketing to people who contact us, and we do not make decisions about you by automated means.

4. Lawful Bases

Under UK GDPR and, where relevant, EU GDPR, we rely on these lawful bases:

• Replying to enquiries and preparing proposals: steps you ask us to take before entering a contract. If you contact us on behalf of a business, our legitimate interest in answering business enquiries.
• Keeping enquiry and conversation records and sending confirmation emails: our legitimate interest in keeping an accurate record of what customers asked and what we told them, so we can follow up and resolve questions.
• Providing services: performance of our contract with you, or with the business you work for (our legitimate interest in dealing with its staff).
• Website security and spam filtering: our legitimate interest in keeping the website and contact routes safe and usable.
• Optional analytics: your consent, which you can withdraw at any time in the cookie settings.
• Accounting and legal records: legal obligation.

You do not have to give us your details, but we cannot reply to an enquiry without a way to contact you.

5. Named Providers and Recipients

We do not sell your personal data. We share it only with the providers that run our website, email, WhatsApp, and customer records, and only for the purposes above. The contact form is processed at https://contact.mojistudio.co.uk/contact.

• Cloudflare: hosts this website (Cloudflare Pages), runs the contact form (Cloudflare Workers), and runs our customer management system (MojiCRM on Cloudflare Workers, D1 and R2), which stores enquiries and conversations. Cloudflare Email Routing and Email Sending pass business email into MojiCRM and send our emails, including automatic enquiry confirmations and the notice of each contact form enquiry to our mailbox.
• Proton: hosts our business mailbox, which receives email to our addresses and contact form notifications.
• Meta Platforms (WhatsApp Business Platform): carries WhatsApp messages between you and us when you message our WhatsApp business number. The messages are then kept in MojiCRM.
• Google (Google Analytics 4): optional website analytics, only if you accept analytics cookies.
• Professional advisers, payment providers, or authorities where legally required or necessary for service delivery.

6. International Transfers

Some of our providers process data outside the United Kingdom. Where they do, we rely on the safeguard listed below. You can ask us for more detail, or a copy of the relevant safeguard, using the contact details in section 13.

• Cloudflare: Cloudflare, Inc. is based in the US and runs a global network. Transfers rely on the UK Extension to the EU-US Data Privacy Framework, with the EU Standard Contractual Clauses and UK Addendum in Cloudflare's data processing addendum as a fallback.
• Proton: Proton AG is based in Switzerland and stores data in Switzerland, Germany and Norway, which the UK recognises as providing adequate protection (UK adequacy regulations).
• Meta Platforms (WhatsApp Business Platform): WhatsApp LLC (part of Meta) processes messages in the US and other countries. Transfers rely on the EU Standard Contractual Clauses with the UK Addendum, set out in WhatsApp's Business Data Transfer Addendum for the UK.
• Google (Google Analytics 4): Google Ireland Limited provides Google Analytics in the UK (Ireland has UK adequacy). Onward transfers to Google LLC in the US rely on the UK Extension to the EU-US Data Privacy Framework.

7. Retention

• Enquiries that do not go ahead: 12 months after the enquiry was last updated.
• Messages and conversations (contact form, email, and WhatsApp): 24 months after the message, unless they relate to a project or an open question.
• People we have talked to who did not become clients: 24 months after our last contact.
• Client and project records: for the duration of the project and 6 years after the final invoice or project close, for accounting and contractual record-keeping.
• Cookie consent preferences: until you update your choice or clear local browser storage.
• Website analytics data: up to 14 months from the last interaction in our analytics configuration.
• Spam-prevention signals: only for as long as needed to protect the form, investigate misuse, or keep the service secure.

8. Security

We use reasonable technical and organisational measures to protect personal data. No website, service provider, or method of internet transmission is completely secure, so we cannot guarantee absolute security.

9. Your Rights

Subject to applicable law, you may have the right to request access, correction, deletion, restriction, objection, portability, and withdrawal of consent where consent is the lawful basis.

You can exercise your rights by contacting us using the details below. We may need to verify your identity before responding.

To stop receiving WhatsApp messages from us, reply STOP. Reply START if you want to hear from us there again.

10. Cookies and Analytics

We use local browser storage for cookie preferences and optional Google Analytics for website measurement. For more detail on the technologies in use and how to manage them, see our Cookie Policy.

11. Children

Our website and services are not directed at children. We do not knowingly collect personal data from children through this website.

12. Changes to This Policy

We may update this policy to reflect changes in our services, website tools, providers, or legal obligations. The date at the top of this page shows the latest revision.

13. Contact

For privacy questions or rights requests, contact:

14. Complaints

If you are unhappy with how we handle personal data, you can contact us first and you also have the right to complain to the Information Commissioner's Office in the UK:ico.org.uk.