Privacy Policy

1. Introduction

This privacy policy explains how Graftstudio Ltd (“we”, “us”, “our”) collects, uses, stores, and protects your personal data when you visit our website at graftstudio.com, use our services, or otherwise interact with us.

We are committed to protecting your privacy and handling your data in an open, transparent manner. We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

About us

Graftstudio Ltd is a Shopify Plus development studio and Shopify Plus Partner in Newcastle upon Tyne. We build and look after Shopify Plus stores for direct-to-consumer and B2B brands, and work with design agencies that need Plus-level development on a build.

Company name: Graftstudio Ltd
Company number: 14649929
Registered address: Teapot Studio 12, Hoults Yard, Newcastle upon Tyne, NE6 2HL
Email: hello@graftstudio.com

2. What data we collect

The personal data we collect depends on how you interact with us. We may collect and process the following categories of information:

Information you provide directly

Contact form enquiries: your name, email address and message, plus anything else you choose to add: company, phone number, store URL, current platform, budget and the service you are interested in.
How you found us: when you send an enquiry or ask for a resource, we also receive the page you first landed on, the website that referred you, and any campaign tags in the link you followed (such as utm_source). This is held in your browser only for the length of your visit and reaches us only if you submit a form.
Resource sign-ups: your email address when you ask for a free resource, such as our Shopify speed and conversion checklist. We send you the resource and a short series of related emails, which you can unsubscribe from at any time.
Call bookings: your name, email address and anything you add when you book a call with us through Cal.com.
Email correspondence: any personal data included in emails you send to us.
Client onboarding: business details, billing information and project-related data provided during the course of a commercial engagement.

Information collected automatically

Google Analytics: if you accept analytics cookies, pages visited, referring website, device and browser type, approximate location and similar usage statistics.
Cookieless measurement: Vercel Web Analytics and Speed Insights count page views, form submissions and page performance without cookies and without identifying you.
Server log data: our hosting provider (Vercel) may automatically collect technical data including IP addresses, access times and request information for security and performance purposes.

Information from third parties

LinkedIn: if you connect with us through LinkedIn or interact with our LinkedIn content, we may receive basic profile information in accordance with LinkedIn’s privacy settings.

3. How we use your data

We use the personal data we collect for the following purposes:

To respond to your enquiries, including an automatic confirmation that we have received yours.
To deliver our services: Shopify Plus audits, development, migrations, custom themes, optimisation, and retained and fractional support.
To arrange and hold calls you book with us.
To send you resources you ask for and a short series of related emails, which you can unsubscribe from at any time.
To understand which pages, campaigns and referring websites lead to enquiries, and to improve the performance, content and experience of our website.
To comply with our legal and regulatory obligations, including tax and accounting requirements.
To establish, exercise or defend legal claims.

4. Legal basis for processing

Under the UK GDPR, we must have a lawful basis for processing your personal data. The bases we rely on are:

Consent

Where you have given clear, affirmative consent for us to process your personal data for a specific purpose. This includes subscribing to marketing communications and accepting non-essential cookies. You may withdraw consent at any time by contacting us or using the unsubscribe mechanism in our emails.

Contractual necessity

Where processing is necessary for the performance of a contract with you, or to take steps at your request prior to entering into a contract. This applies to processing required to deliver our services and manage our client relationships.

Legitimate interest

Where processing is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights. Our legitimate interests include:

Responding to enquiries submitted through our contact form or email.
Improving our website, services, and user experience through analytics.
Marketing our services to existing clients or individuals who have expressed a clear interest in our work.
Ensuring the security and integrity of our website.

Legal obligation

Where processing is necessary to comply with a legal obligation, such as maintaining financial records for tax purposes.

5. Cookies and tracking

Our website uses cookies and similar tracking technologies to distinguish you from other visitors, analyse traffic, and improve your browsing experience. A cookie is a small text file stored on your device by your web browser.

Essential cookies

These are necessary for the website to function correctly. They enable core features such as page navigation and do not collect personally identifiable information. These cookies cannot be disabled.

Analytics cookies

We use Google Analytics 4 (GA4) to understand how visitors interact with our website. GA4 collects data such as pages visited, session duration, and traffic sources. IP anonymisation is enabled where supported. Google Analytics may set the following cookies:

_ga — used to distinguish users. Expires after 2 years.
_ga_* — used to persist session state. Expires after 2 years.

For more information on how Google processes data, visit Google’s Privacy Policy. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

No marketing cookies

We do not use advertising or marketing cookies. Vercel Web Analytics and Speed Insights measure the site without cookies.

Session storage

To tell us how you found us if you send an enquiry, the site keeps a note of your landing page, referring website and campaign tags in your browser’s session storage. It is not a cookie, is not sent anywhere unless you submit a form, and is cleared when you close the tab.

Managing cookies

You can control and manage cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our website. Most browsers allow you to:

View which cookies are stored and delete them individually.
Block cookies from specific or all websites.
Set preferences for first-party and third-party cookies.

6. Third-party services

We share personal data with trusted third-party service providers who assist us in operating our business. These providers process data on our behalf and are contractually obligated to handle it securely and in accordance with applicable data protection law.

Vercel

Our website is hosted on Vercel, which also provides our cookieless analytics. Vercel may process server log data (including IP addresses) for the purpose of delivering and securing our website. Vercel’s infrastructure is primarily located in the United States and Europe. For details, see Vercel’s Privacy Policy.

Google Analytics

We use Google Analytics 4 to collect anonymised website usage statistics. Data may be transferred to Google servers in the United States. Google is certified under the EU-US Data Privacy Framework. See Google’s Privacy Policy.

Resend

We use Resend to send and receive the emails our website generates: enquiry notifications, confirmations, resources you request and the follow-up emails that go with them. If you sign up for a resource, Resend also stores your email address in our contact list. SeeResend’s Privacy Policy.

Cal.com

We use Cal.com to manage call bookings. When you book a call, Cal.com processes your name, email address and any information you provide in the booking form. SeeCal.com’s Privacy Policy.

Google Workspace

Our email runs on Google Workspace, so enquiries and emails you send us are stored there. SeeGoogle’s Privacy Policy.

Shopify

As a Shopify Plus Partner, we build and maintain Shopify stores on behalf of our clients. When working on client projects, we may access customer data within Shopify in accordance with our contractual obligations. See Shopify’s Privacy Policy.

We maintain a presence on LinkedIn for professional networking and marketing purposes. If you interact with our LinkedIn content, LinkedIn may share limited information with us in accordance with your LinkedIn privacy settings. See LinkedIn’s Privacy Policy.

International data transfers

Some of the third-party services listed above are based outside the United Kingdom. Where your data is transferred internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs), adequacy decisions, or the provider’s participation in recognised data transfer frameworks (e.g. the EU-US Data Privacy Framework).

7. Data retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our general retention periods are as follows:

Contact form enquiries: retained for up to 2 years from the date of your last interaction, unless a commercial relationship is established.
Client project data: retained for the duration of the engagement and for up to 6 years afterwards, in accordance with our legal and accounting obligations.
Marketing subscribers: retained until you unsubscribe or request deletion. We periodically review our subscriber lists and remove inactive contacts.
Website analytics data: retained in accordance with the default retention settings of Google Analytics (up to 14 months for user-level data).
Financial and tax records: retained for a minimum of 6 years as required by HMRC.

When personal data is no longer required, we securely delete or anonymise it.

8. Your rights

Under the UK GDPR, you have the following rights in relation to your personal data:

Right of access: you have the right to request a copy of the personal data we hold about you (a “subject access request”).
Right to rectification: you have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
Right to erasure: you have the right to request that we delete your personal data where there is no compelling reason for us to continue processing it.
Right to restriction of processing: you have the right to request that we restrict the processing of your personal data in certain circumstances (e.g. where you contest its accuracy).
Right to data portability: you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
Right to object: you have the right to object to the processing of your personal data where we rely on legitimate interest as our legal basis. You also have the absolute right to object to processing for direct marketing purposes.
Rights related to automated decision-making: you have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you. We do not currently carry out automated decision-making.

To exercise any of these rights, please contact us at hello@graftstudio.com. We will respond to your request within one month. In certain circumstances, we may extend this period by a further two months, in which case we will inform you and explain the reason for the delay.

There is no fee for making a request, unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act on it.

9. Data security

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure, or destruction. These measures include:

Encryption of data in transit using TLS/SSL across our website and email communications.
Access controls to ensure that personal data is only accessible to authorised personnel who require it for their role.
Use of reputable, security-certified hosting and cloud service providers.
Regular review of our data processing activities and security practices.

While we strive to protect your personal data, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we are committed to taking all reasonable steps to safeguard your information.

10. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “Last updated” date at the top of this page.

We encourage you to review this policy periodically to stay informed about how we are protecting your data. Your continued use of our website after any changes to this policy constitutes your acceptance of the updated terms.

11. Contact us

If you have any questions about this privacy policy, wish to exercise your data protection rights, or have a concern about how we handle your personal data, please contact us:

Email: hello@graftstudio.com
Post: Graftstudio Ltd, Teapot Studio 12, Hoults Yard, Newcastle upon Tyne, NE6 2HL

Complaints

We take all complaints seriously and will endeavour to resolve any issues promptly. If you are not satisfied with our response, or believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner’s Office (ICO)
Website: ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would appreciate the opportunity to address your concerns before you approach the ICO, so please do contact us in the first instance.