Your information
Privacy notice.
How we handle information when you visit this website or contact the studio.
Last reviewed:
1. Who we are and how to contact us
NOCTIS STUDIOS LIMITED, trading as Noctis Studios, is responsible as controller for the personal information described in this notice. We are registered in England and Wales under company number 16940486. Our registered office and postal contact is 23 Glenfield Road, Leicester, LE3 6AT, United Kingdom.
For business enquiries, privacy questions, rights requests or a data-protection complaint, contact hello@noctisstudios.dev. Our owner, Adam Kuc, handles the studio's day-to-day correspondence and privacy enquiries on the company's behalf.
This notice covers the noctisstudios.dev studio website and communications about our services. It does not replace the separate privacy notices for ScanLens or PracticeComply. If we later process client-controlled information when delivering a project, the relevant project arrangements and any required data-processing agreement will address that activity.
2. Ways of contacting us
You can contact us directly by email or use the website enquiry form. The form requires your name, email address and a description of the project. Company details, type of work, budget and timing are optional. It sends your enquiry through our server to our Namecheap-hosted mailbox; it does not open your email application as a substitute for submission.
We do not add you to a newsletter or marketing list because you enquire. Please do not submit passwords, access tokens, identity documents or confidential client records. If the form is unavailable or a security check cannot complete, you can use the displayed email address instead.
3. Information we receive
Enquiries and correspondence. We receive your name, email address, company or website details where supplied, your message, any project requirements you choose to describe and our subsequent correspondence. This can include an indicative budget or intended timetable. We also receive normal email information such as the sender, recipient and time of a message. Please avoid unnecessary personal information about yourself or others.
Technical information. Serving and securing a website involves processing connection information such as an IP address, request time, requested resource, response status and browser information. Some of this can appear in hosting, error or security records. We do not use website activity to create advertising profiles.
Form protection and delivery. The form also uses a request identifier, a security-check token and limited technical results to validate requests, reduce spam, prevent duplicates and report whether an enquiry was accepted for sending. Its processing involves your connection information and short-lived checks in server memory. The enquiry text is not stored in a website enquiry database. Copies delivered by email are subject to the correspondence retention described below.
Business records. If we enter into a project, we may need business contact information, contractual correspondence, quotations and necessary billing records. The precise data needed to deliver a particular project is agreed separately. We do not ask for payment-card information through the initial website enquiry route.
Most information comes directly from you or your browser. A colleague or representative may provide your business contact details when involving you in an enquiry or project. We use those details for the relevant communication, not unrelated marketing.
4. Why we use information and our legal bases
| Purpose | Basis we rely on |
|---|---|
| Responding to enquiries and discussing work with people acting for a business | Our legitimate interests in understanding requests, communicating with prospective business clients and operating the studio. |
| Taking steps requested by you before a contract with you personally, or performing that contract | Necessity for those pre-contract steps or the contract, where the relevant conditions apply. A contract with your employer does not automatically make this the basis for your personal information. |
| Communicating with client representatives and keeping proportionate project records | Our legitimate interests in managing client relationships, delivering agreed work and maintaining an appropriate record of decisions. |
| Hosting the website, diagnosing faults and preventing misuse | Our legitimate interests in keeping the website and communications available and secure. |
| Validating and delivering form submissions; preventing automated abuse and duplicate submissions | Our legitimate interests in providing a reliable enquiry channel and protecting the service from misuse, balanced against visitors' rights. Necessary pre-contract communications with an individual may also fall under the contract basis described above. Storage/access rules are assessed separately; a legitimate interest does not remove a requirement for consent. |
| Keeping records required for tax, accounting or other legal requirements; handling applicable rights requests | Compliance with the relevant legal obligations. |
| Resolving complaints and establishing, exercising or defending legal claims | Compliance with applicable complaints duties and, where appropriate, our legitimate interests in investigating concerns and protecting legal rights. |
Where we rely on legitimate interests, we consider the need for the processing and its impact on you. We limit information to the relevant purpose. You can object as explained below.
You do not have to contact us. If you do, we need enough information to understand and reply to your request. Optional details can be omitted. Not providing necessary contact or project information may prevent us from progressing the enquiry.
5. Who receives information
The owner handles routine correspondence. Relevant service providers may process information needed to operate their services, and limited disclosure may be required for professional advice, compliance or legal claims.
Our current providers include Hetzner for server hosting and Namecheap Private Email for receiving, storing and sending email. Namecheap also provides domain and DNS services. Their access and responsibilities depend on the service and applicable arrangements; providers may separately process service-account, billing, security or legally required information for their own purposes.
We use Cloudflare Turnstile on the enabled contact form to help distinguish legitimate visitors from automated abuse. Technical signals may include an IP address, browser and connection characteristics, and the website origin. Our server also asks Cloudflare to validate the security token. Our validation request does not include the enquiry message or the sender's email address.
Cloudflare acts as processor for protecting customers' websites and describes a separate controller role when using signals to improve its bot-detection capabilities. Its Turnstile Privacy Addendum explains those purposes and the relationship with its main privacy policy. Cloudflare's international processing also needs to be considered under section 6.
We do not sell enquiry information. We do not send the contents of studio enquiries to ScanLens to analyse them or use those enquiries to populate PracticeComply. We do not send your enquiry text to a generative-AI service as part of this website's contact process. If a proposed project would need additional processing or providers, that is considered separately.
6. International processing
Noctis Studios is based in the United Kingdom, but not all processing is confined to the UK. Hetzner provides international hosting infrastructure. Namecheap identifies the United States as a location for its Private Email servers. Other provider processing, support and onward processing depend on the particular service and its arrangements.
For a transfer restricted by applicable data-protection law, our policy is to use an applicable adequacy arrangement or appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with the required assessment and supplementary protections where needed. A provider's general claim of compliance is not itself a transfer safeguard, and a US provider is not automatically covered by the UK-US data bridge.
You can ask us for information about the locations and safeguards relevant to your information, including a copy or explanation of applicable safeguards with confidential or unrelated details removed where appropriate. Provider privacy information is linked at the end of this notice.
7. How long we keep information
Enquiries that do not become client work: our normal retention period is 12 months from the last substantive communication about the enquiry. We remove the correspondence from active folders at the end of that period unless a specific legal requirement, unresolved complaint or legal claim justifies retaining relevant information longer. A later unsolicited marketing message from us would not restart this period.
Accepted projects and essential business records: we keep records needed while the relationship or work continues. Afterwards, we generally retain the essential contract and decision record for up to six years after the work or relationship ends, where needed to resolve disputes or establish legal rights. This is not a rule to keep every working file or unnecessary copy. Required company accounting records are retained for the applicable statutory period, normally six years from the end of the financial year to which they relate, and longer where the law requires it.
Technical and security records: we retain only information needed to operate the service, investigate faults, detect abuse or resolve an incident. The relevant criteria are the type of record, the period needed to investigate the issue, applicable security requirements and the configured rotation or expiry. This is distinct from email retention. Relevant incident evidence may need to be retained longer than routine records, with its continued need reviewed.
Short-lived form checks: the contact service uses bounded in-memory rate-limit, token and duplicate checks, rather than a permanent submission history. Completed-check records normally expire within minutes, with the longest configured completed-request window currently ten minutes. An in-progress operation is not removed merely because that window elapsed. These records are separate from the delivered email and provider security records; expiry does not guarantee immediate erasure of every memory byte.
Rights requests and complaints: we keep a proportionate record of the request, our response and the outcome for as long as needed to demonstrate how it was handled, address an unresolved issue or protect legal rights. We do not keep unnecessary copies of identity documents or entire unrelated files merely as proof that a request occurred.
Recovery copies: deleting a message from active folders is not a promise of immediate physical removal from every provider recovery system. Any residual recovery copies are subject to the relevant provider's retention and deletion arrangements. They must not be repurposed as a second active contact list, and applicable deletion decisions must be reapplied if data is restored. We assess such arrangements rather than treating an unspecified backup as a reason to retain information indefinitely.
9. Security and automated decisions
We limit access and use proportionate technical and organisational measures to protect information. No website, email system or transmission can be guaranteed completely secure. Please do not send passwords, access tokens, identity documents, financial account details or confidential client records in an initial enquiry.
We do not use this studio website to make solely automated decisions about people that have legal or similarly significant effects. Security controls may limit a request or prevent use of an unavailable service; you can contact us by email if you need help.
10. Your rights
Depending on the circumstances and applicable law, you can ask to access your personal information, correct it, erase it, restrict its use, object to processing based on legitimate interests, or receive and transfer eligible information in a portable format. Where processing depends on consent, you can withdraw that consent without affecting processing that was lawful beforehand. Rights are not absolute; we will explain any relevant restriction or exemption.
Contact hello@noctisstudios.dev or write to our registered office. You do not need to use a special form, legal wording or a particular subject line. We may request proportionate information to confirm identity or clarify a request, but will not routinely require an identity document. Requests are normally free. We respond within the applicable legal time limit, usually one month; where a lawful extension or pause applies, we explain it.
11. Data-protection complaints
If you are concerned about our handling of your information, email hello@noctisstudios.dev or write to our registered office. A subject such as “Privacy complaint” may help us route it, but is not required. Please describe the concern and how we can contact you; only include information needed to understand the issue.
We will acknowledge a data-protection complaint within 30 days, take appropriate steps to investigate without undue delay, keep you informed and communicate the outcome without undue delay. This is not a promise that every investigation will be completed within 30 days.
You also have the right to raise a concern with the Information Commissioner's Office (ICO), the UK supervisory authority. See the ICO's complaints information or call 0303 123 1113. Asking us to address the issue first may help resolve it, but does not remove your legal rights. Where applicable, you may also complain to your local supervisory authority.
12. Changes and provider information
We review this notice when our practices change. The date above identifies the current version. Material changes are explained before a new processing purpose is introduced where required.
Provider information: Hetzner privacy information, Namecheap privacy information, and Namecheap data-processing terms.