Who we are
Lucent Digital Studio is a web design, SEO and paid advertising studio based in Leeds, United Kingdom. We are the data controller for the information described on this page. Contact us at hello@lucentdigital.co.uk.
This policy covers both this website and the internal tools we run to manage client advertising, analytics and search accounts. Those tools are private, used only by Lucent Digital Studio, and are not offered to the public.
What we collect through this website
When you send an enquiry we collect your name, email address, phone number if you give one, your company name, and whatever you write in the project description. Nothing on the form is collected that you have not typed into it.
We also collect basic technical information that every web server records: IP address, browser type, the pages you viewed and the page that referred you. With your consent, Google Analytics and the Meta advertising pixel record the same kind of information in more detail.
Why we hold it, and on what basis
Enquiry details are held so we can reply to you, quote for work, and keep a record of what was agreed. The lawful basis is our legitimate interest in responding to a request you chose to send us, and, once you become a client, performance of our contract with you.
Analytics and advertising data are held so we can see which pages and which adverts produce enquiries. The lawful basis is your consent, given through the cookie banner.
How long we keep it
Enquiries that do not become work are deleted within 24 months. Client records are kept for the life of the engagement and for six years afterwards, because UK tax law requires us to retain business records for that period. Analytics data is retained on Google's default schedule of 14 months. Server logs are kept for 30 days.
Who we share it with
We do not sell, rent, syndicate or trade personal data, and we never use it to train machine learning models. We use a small number of processors to run the business, and each one only receives what it needs:
- Vercel, for website hosting.
- Convex, for storing enquiry form submissions.
- Google Workspace, for our email inbox.
- Resend and Microsoft Graph, for delivering enquiry notification emails.
- Stripe, for invoicing and payment. Stripe handles card details directly; we never see or store them.
- Google Analytics and Meta, for the advertising measurement described below, and only with your consent.
We may also disclose information where the law requires it.
Cookies
We use first-party cookies for the optional client portal and to remember your cookie choice. With your consent we also load Google Analytics and the Meta (Facebook) advertising pixel, so we can see which pages and which adverts actually bring enquiries. Decline the cookie banner and neither one loads. Full detail is in our Cookie policy.
Advertising measurement
If you arrive from a Facebook or Instagram advert and then send us an enquiry, we tell Meta that the advert produced an enquiry, so we know which adverts are worth paying for. This happens on our server rather than in your browser, which means it works even when the advertising pixel has not loaded.
What we send is your email address, name and phone number hashed (turned into an irreversible string that cannot be read back) together with the identifier Meta attached to your click. Meta uses it to match your enquiry to that click. We never send the content of your message.
If you chose "essential only" on the cookie banner, we send nothing at all. If you made no choice, we do send it, on the basis of our legitimate interest in knowing which adverts produced the enquiry you chose to submit. Email us and we will exclude you and delete what was sent.
Google user data: what our internal tools access
We run private internal tools that sign in to Google using Google OAuth. This is how a Lucent Digital Studio staff member connects the advertising, analytics and search accounts we manage on behalf of our clients, so that reporting can be produced without downloading spreadsheets by hand. Only Lucent Digital Studio staff use these tools. There is no public sign-up.
When a staff member connects a Google account, we may request the following scopes, and only for the reasons given:
- Google Ads (adwords): to read campaign, keyword, search term, conversion and spend figures from advertising accounts we manage, and to make campaign changes a client has approved.
- Google Analytics (analytics.readonly): to read website traffic and conversion figures for reporting.
- Search Console (webmasters): to read search impressions, clicks and indexing status, and to submit sitemaps.
- Gmail, Google Drive, Docs, Sheets and Calendar: where used, to draft and file our own reports, read enquiry emails sent to our own inbox, and manage our own calendar. We do not read the mailboxes of clients or of anyone else.
Data pulled through these scopes is advertising and analytics reporting data belonging to Lucent Digital Studio or to a client who has authorised us. It is used solely to produce that client's reporting and to manage their accounts. It is stored on encrypted, password-protected machines controlled by Lucent Digital Studio, retained only as long as the client engagement requires, and deleted on request or when the engagement ends. Access tokens are revocable at any time from your Google account's third-party access page.
Limited Use. Lucent Digital Studio's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not transfer Google user data to third parties except as necessary to provide or improve the features described above, to comply with applicable law, or as part of a merger or acquisition. We do not use Google user data for advertising, and we do not allow humans to read it except with your explicit permission, for security purposes, to comply with applicable law, or where the data has been aggregated and anonymised.
Where your data is held
Our processors operate data centres inside and outside the UK and the European Economic Area, including the United States. Where data leaves the UK or EEA it is transferred under the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or an equivalent approved safeguard.
Security
Access to enquiry data and to connected client accounts is restricted to Lucent Digital Studio staff, protected by two-factor authentication, and held on encrypted devices. Credentials and OAuth tokens are stored outside the website codebase and are never committed to source control or shared with third parties.
Children
This site and our services are aimed at businesses. We do not knowingly collect data from anyone under 16.
Your rights
If you are in the UK or the EU you have the right to ask what we hold about you, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive a copy in a portable format. Where we rely on consent you may withdraw it at any time.
Email hello@lucentdigital.co.uk and we will respond within 30 days. If you are not satisfied with our response you may complain to the UK Information Commissioner's Office at ico.org.uk.
Changes to this policy
If we change how we handle data we will update this page and the date at the top of it.