What data we hold, why we hold it, and your rights. This policy applies to craigstanley.work and all data collected through it.
Craig Stanley, trading as Craig Stanley Studio, is the data controller for all personal data collected via this website.
Business name Craig Stanley Studio
Contact Via the contact form at craigstanley.work/contact.html. For data protection queries specifically, please select "Something else" and describe your request.
Note: This is a sole trader business based in England. A postal address is not published on this site for personal safety reasons. All data subject requests and privacy queries are handled via the contact form, which is monitored directly by Craig Stanley.
1. Contact form submissions
Data Name, email address, message, and enquiry topic.
Legal basis Legitimate interests (UK GDPR Article 6(1)(f)) — it is necessary to process this information to respond to your enquiry. The processing is proportionate to that purpose and is not outweighed by your privacy interests, since you have chosen to contact the studio.
Processor Netlify Inc., USA. Standard contractual clauses (SCCs) apply for international transfers.
Retention Until the enquiry is resolved, plus 12 months.
2. Newsletter signups
Data Email address.
Legal basis Consent — you opted in by submitting the newsletter form. You can withdraw your consent at any time by using the contact form to request removal. Withdrawal does not affect the lawfulness of any processing done before you withdrew.
Processor Netlify Inc., USA. Standard contractual clauses (SCCs) apply for international transfers.
Retention Until you withdraw consent. To be removed, use the contact form.
3. Ethics and takedown query form
Data Name, email address, query type, description, content URL (optional).
Legal basis Legitimate interests (UK GDPR Article 6(1)(f)) — compliance with copyright, DMCA, and ethical obligations. Retaining records of takedown and ethics queries is necessary for legal compliance and to demonstrate accountability. The processing is proportionate to those purposes.
Processor Netlify Inc., USA. Standard contractual clauses apply.
Retention 24 months from submission.
This site uses analytics tools to understand how visitors use the site and identify areas for improvement. Analytics only run if you choose to accept them via the consent banner shown on your first visit. You can change your choice at any time by clearing your browser's local storage for this site.
4. Analytics — Microsoft Clarity
Data Page views, session recordings, heatmaps, user interactions (mouse movement, clicks, scrolling), browser type, device type, referrer. Clarity uses a first-party cookie to identify sessions.
Legal basis Consent — UK GDPR Article 6(1)(a). You can withdraw consent at any time by clearing your browser's local storage for craigstanley.work. Withdrawal does not affect processing that occurred before withdrawal.
Processor Microsoft Corporation, USA. Governed by the Microsoft Privacy Statement and Clarity Terms of Use. Data may be transferred internationally under Microsoft's standard data protection mechanisms. Clarity custom identifiers are hashed on the client before transmission to Clarity servers.
Retention Up to 13 months in Clarity's dashboard. Session recordings are retained for 30 days by default under Clarity's standard settings.
More information Microsoft Privacy Statement · Clarity Legal Terms
5. Analytics — Google Analytics 4 (GA4)
Data Page views, session duration, traffic source, device type, browser type, and approximate geographic location (city/country level). GA4 automatically anonymises IP addresses before they are stored — no full IP address is retained by Google for this property.
Legal basis Consent — UK GDPR Article 6(1)(a) and UK PECR Regulation 6. Analytics scripts and cookies are not loaded until you accept via the consent banner. You may withdraw your consent at any time by clearing your browser's local storage for craigstanley.work; analytics will not be loaded on your subsequent visits. Withdrawal does not affect the lawfulness of any processing carried out before withdrawal.
Processor Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google processes data under the Google Ads Data Processing Terms, which incorporate Standard Contractual Clauses (SCCs) as approved by the UK ICO as an appropriate safeguard for international transfers of personal data from the UK to the USA under UK GDPR Article 46(2)(d).
Advertising signals Google Analytics is configured on this property without advertising features. Analytics data is not linked to Google advertising products, is not used for ad targeting or remarketing, and is not shared with third parties for advertising purposes.
Retention Data retention is set at 14 months on this property. After that period, event-level data is automatically deleted. Aggregated reporting data may be retained for longer.
Your rights You can opt out of Google Analytics tracking across all websites using the Google Analytics opt-out browser add-on. To opt out on this site only, decline via the consent banner or clear your browser's local storage for craigstanley.work.
More information Google Privacy Policy · Google Analytics data safeguarding · GA opt-out add-on
Netlify may set a session cookie for form functionality. This is strictly necessary for form submissions to work correctly. It does not track you across sites and expires when your browser session ends.
No third-party advertising or marketing cookies are used on this site.
See our Cookie Notice for full details of all cookies set on this site.
Netlify — hosting and forms.
Netlify Inc., USA. Data processed under standard contractual clauses (SCCs). Privacy policy: netlify.com/gdpr-ccpa
Microsoft Clarity — web analytics and session recording (consent-gated).
Microsoft Corporation, USA. Clarity collects behavioural data (sessions, clicks, heatmaps) only if you accept analytics via the consent banner. Data is processed under Microsoft's Privacy Statement. Privacy policy: privacy.microsoft.com · Legal terms: microsoft.com/legal/terms-of-use
Google Analytics — web analytics (consent-gated).
Google LLC, USA. Google Analytics collects aggregated traffic and usage data only if you accept analytics via the consent banner. IP addresses are anonymised. Data is not used for advertising on this site. Privacy policy: policies.google.com/privacy · Opt-out add-on: tools.google.com/dlpage/gaoptout
YouTube (Google) — video embeds on video.html.
This site uses the youtube-nocookie.com domain, which does not set cookies before user interaction. When a visitor presses play, YouTube may set functional or performance cookies under Google's privacy policy. Google Privacy Policy: policies.google.com/privacy. See our Cookie Notice for details.
AI content generation tools — Claude (Anthropic), Gemini (Google).
These tools are used server-side only to generate and assist with content. They do not receive visitor data. No visitor information is passed to these services.
You have the following rights regarding your personal data:
To exercise any of these rights, please use the contact form and select "Something else". We will respond within one calendar month as required by UK GDPR. In complex cases we may extend this by a further two months, in which case we will let you know.
Right to complain. You have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) if you believe your personal data has been handled unlawfully. You can do this without first raising it with us, although we would welcome the opportunity to address your concern directly. ICO website: ico.org.uk. ICO helpline: 0303 123 1113. Make a complaint: ico.org.uk/make-a-complaint.
Form data collected on this site is processed by Netlify in the United States. This transfer is made under standard contractual clauses (SCCs) as approved by the UK Information Commissioner's Office, providing appropriate safeguards for your data.
Last updated: 29 May 2026 — updated to activate Google Analytics 4 (G-JPY77E8LXT), add UK GDPR Article 46 SCC transfer mechanism details, and confirm no advertising features are enabled. If this policy changes materially, an updated version will be published at this URL with a revised date. This policy is prepared in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.