Design by Katie Jones, T/A The Grove Creative Studio

Privacy Policy

This policy explains how I collect, use and look after your personal information, and the rights you have over it. I’ve tried to keep it clear and free of jargon. if anything is unclear, just get in touch using the details at the end.

1. Who I am

The Grove Creative Studio is the trading name of Katie Jones, a sole trader providing design services. In this policy, “I”, “me” and “my” mean The Grove Creative Studio, and “you” and “your” mean you, the person whose information I hold.

I am the “data controller” for the personal information described in this policy. That means I’m responsible for deciding how and why your information is used, and for keeping it safe in line with UK data protection law (the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025).

You can reach me at:

I am registered with the Information Commissioner’s Office (ICO), the UK’s data protection regulator, under registration number ZB949988.

2. The personal information I collect

The information I hold depends on how you interact with me. Below is what I collect in each situation.

If you visit my website

My website is hosted on Squarespace. When you visit, limited technical information is collected automatically, such as your device type, browser, approximate location and how you move around the site, mainly through cookies and similar technologies. You can find out more in my Cookie Policy, and you can control non-essential cookies through the banner shown when you first visit.

If you contact me or make an enquiry

When you email me or fill in an enquiry or contact form, I collect your name, your email address and anything else you choose to tell me about your project or query. I store these contact details in my CRM, HighLevel.

If you sign up to my mailing list

When you sign up to my mailing list through my website, I collect your first name, last name and email address. I manage my mailing list and send my emails using HighLevel, my customer relationship management (CRM) platform, which stores this information on my behalf. You can unsubscribe at any time.

If you become a client

When you work with me, I collect the information I need to deliver your project and run my business. Depending on the work, this may include:

  • your name, business name, email address, phone number and billing address;

  • details of the project, including any briefs, content, files, images or feedback you share with me;

  • billing and payment information which I manage through my accounting software;

  • our correspondence and notes relating to your project.

If you interact with me on social media

If you follow, message or tag me on platforms such as Instagram or LinkedIn, I may see and keep a record of that interaction. Those platforms have their own privacy policies that govern how they use your information.

3. How I use your information - and my legal basis

Data protection law says I must have a valid “legal basis” for using your information. Below, I've outlined how I use your information and the legal basis I rely on for each purpose.

  • Responding to enquiries and providing quotes or proposals: I rely on legitimate interests to respond to your enquiry, or to take steps towards entering into a contract with you.

  • Delivering design work and managing your project: I use your information to fulfil my contractual obligations to you.

  • Sending invoices and maintaining accounting and tax records: I process this information to comply with my legal obligations, including tax and accounting requirements.

  • Sending newsletters and marketing emails: I rely on your consent, which you can withdraw at any time (see section 4).

  • Showcasing completed work in my portfolio and on social media: I rely on my legitimate interest in promoting my business, subject to any agreements we've made about your project (see Terms and Conditions).

  • Understanding how my website is used: I use website analytics with your consent, provided through the cookie banner.

  • Keeping my business and website secure: I rely on my legitimate interest in protecting my business, preventing fraud and safeguarding the people I work with.

Where I rely on legitimate interests, I've considered whether these interests are fair and balanced against your rights and freedoms. You can ask me for more information about this at any time.

4. Marketing and my mailing list

I’ll only send you marketing emails if you’ve signed up to receive them, or where the law otherwise allows it. Every marketing email I send will include an “unsubscribe” link, and you can opt out at any time, either by clicking that link or by emailing me. Once you unsubscribe, I’ll stop sending you marketing, though I may keep a minimal record of your request so I don’t accidentally contact you again.

5. Cookies and analytics

My website uses cookies and similar technologies. Some are essential for the site to work; others (such as analytics) are only used with your consent, which you give through the cookie banner. You can change your choices at any time. Full details are in my Cookie Policy.

6. Who I share your information with

I never sell your personal information. I do share it with a small number of trusted service providers who help me run my business, and only so far as they need it. These currently include:

  • Squarespace - my website host;

  • HighLevel – my CRM used to store my contacts and to send my emails and newsletters;

  • QuickBooks- to keep my accounts, financial records and meet my tax obligations; and

  • Google – in connection with my Google Business Profile and related website analytics.

These providers act as my “processors”. They can only use your information on my instructions and must keep it secure. I may also share information if I’m legally required to (for example, with HMRC or in response to a valid legal request).

7. Sending information outside the UK

Some of my providers (such as my website host and mailing list provider) are based outside the UK, which means your information may be transferred abroad. Where that happens, I make sure appropriate safeguards are in place, such as the country having “adequate” protection recognised by the UK government, or the provider being covered by an approved data transfer agreement (for example, the UK’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses). You can ask me for more detail on the safeguards that apply.

8. How long I keep your information

I keep your information only for as long as I need it, and then delete or securely destroy it. As a general guide:

  • Enquiries that don’t lead to a project: up to 12 months.

  • Client project records: for the duration of the project and then for 6 years, to deal with any queries or disputes.

  • Invoicing, accounting and tax records: 6 years after the end of the relevant tax year, as required by law.

  • Mailing list information: until you unsubscribe and I’ll also remove subscribers who haven’t engaged with my emails for 24 months.

9. Your rights

Under data protection law, you have a number of rights over your personal information. You can ask me to:

  • give you a copy of the information I hold about you (a “subject access request”);

  • correct anything that’s wrong or incomplete;

  • delete your information, where there’s no good reason for me to keep it;

  • restrict or object to how I use it; and

  • provide it in a portable format, where that right applies.

Where I rely on your consent (for example, for marketing or analytics), you can withdraw it at any time. This won’t affect anything I’ve already done lawfully before you withdrew it.

To exercise any of these rights, just email me. I’ll respond within one month. If your request is particularly complex I may need longer, in which case I’ll let you know. I may also need to confirm your identity, or ask you to clarify your request, before I can deal with it. If so, the time for responding pauses until you reply. Exercising your rights is free, although I may charge a reasonable fee or decline if a request is clearly unfounded or excessive.

10. How to complain

If you’re unhappy with how I’ve handled your personal information, please tell me first. I’d really like the chance to put things right. You can complain to me by email at katie@thegrovecreativestudio.com. I’ll acknowledge your complaint within 30 days, look into it properly, and keep you updated on the outcome.

If you’re not happy with the outcome of my investigation, you then have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at any time. I’d be grateful for the opportunity to resolve things first, but you don’t have to contact me before going to the ICO. You can reach them at:

11. Changes to this policy

I may update this policy from time to time, for example, if the way I work or the law changes. If the changes are significant, I’ll take reasonable steps to let you know.

12. How to contact me

If you have any questions about this policy or about how I use your information, please email me at katie@thegrovecreativestudio.com, or write to me at the address in section 1.