Privacy Policy

01 Who We Are

Hexagon Studio Ltd is a UK-based automation and AI consultancy. We are the data controller for any personal data we collect through our website, services, and AI-powered systems.

If you have any questions about how we handle your data, please contact us at contact@hexagon-studio.com.

02 What We Collect

We collect personal data in the following ways:

Website contact form

• Your name and email address
• The content of your message
• Your service enquiry type (if selected)

WhatsApp AI chatbot

• Your WhatsApp phone number — collected automatically when you initiate a conversation
• Your WhatsApp display name — collected automatically from your WhatsApp profile
• Your email address — if provided during the conversation
• The content of your messages
• A summary record of your enquiry, stored for follow-up and lead-handling purposes

Automation services delivered to clients

• Data processed as part of delivering automation workflows is handled on behalf of our clients. Clients are responsible for their own privacy obligations to their end users.

03 How We Use Your Data

• To respond to your enquiries and provide the services you request
• To manage leads and arrange discovery calls or project scoping
• To fulfil our contractual obligations to clients
• To comply with legal and regulatory obligations

We do not sell, rent, or trade your personal data with third parties for marketing purposes.

04 Legal Basis for Processing

Under UK GDPR, we rely on the following lawful bases:

• Contract — processing is necessary to perform or prepare a contract with you
• Legitimate interests — for responding to enquiries and managing our business, where this does not override your rights
• Legal obligation — where we are required to retain data by law
• Consent — where you have explicitly provided consent, such as subscribing to updates

05 Third-Party Services

We use third-party services in the course of our work, which may process personal data on our behalf. These fall into the following categories:

• Cloud hosting and infrastructure — servers and infrastructure used to run our automation systems, hosted within the UK or EU where possible
• AI processing — language model services used to power chatbot responses; data is processed transiently in accordance with the AI provider's data processing terms. We do not opt in to any model training programmes
• Database and storage — services used to store lead records, conversation context, and client data securely
• Messaging platforms — third-party platforms used to deliver messages (e.g. via WhatsApp Business API or other channels), subject to those platforms' own terms
• Communication and project tools — tools used internally to manage client projects and communications

All third-party providers are selected with data security in mind. Where data is transferred outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) where applicable. Details of specific providers used in your project are available on request.

06 Data Retention

• Contact form enquiries — retained for up to 2 years, then deleted or anonymised
• WhatsApp conversation data — retained for up to 12 months from last contact
• Lead records in our database — retained for up to 2 years or until you request deletion
• Client project data — retained for the duration of the engagement plus up to 2 years for legal and accounting purposes

You may request deletion of your data at any time by contacting us at contact@hexagon-studio.com.

07 Cookies

Our website currently uses no third-party tracking cookies and no analytics tools. The site is static HTML and does not set any persistent cookies.

If this changes in future, this policy will be updated and a cookie notice will be added to the site.

08 Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten") where applicable
• Restrict processing in certain circumstances
• Data portability — receive your data in a structured, machine-readable format
• Object to processing based on legitimate interests
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, contact us at contact@hexagon-studio.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

09 Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Our server infrastructure is hardened with firewall rules, intrusion prevention, and encrypted connections (SSL/TLS).

No method of transmission over the internet is 100% secure. If you believe your data has been compromised, please contact us immediately.

10 Children

Our services are not directed at children under the age of 13. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected such data, we will delete it promptly.

11 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services or legal requirements. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

12 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or how we handle your personal data, please contact us: