Privacy Policy

1. Who we are

Airborne Studio Limited is the controller of the personal data described in this policy. This means we decide why and how your personal data is processed.

• Company registration number: 10390788
• Registered office: Studio305, The Foundry, 156 Blackfriars Rd, London SE1 8EN
• Trading address: The Foundry, 154–156 Blackfriars Road, London SE1 8EN
• VAT registration number: GB359602381
• Email: hello@airborne.studio

We trade as Airborne Studio and as Airbuild. Both are trading names of Airborne Studio Limited, and this policy covers both.

We have not appointed a Data Protection Officer, as we are not required to. Questions about this policy should go to Alice Chan at hello@airborne.studio.

2. What this policy covers

This policy explains how we handle personal data about:

• Visitors to www.airborne.studio and our other websites.
• People who enquire about our services, and people we approach about our services.
• Our clients and the individuals who work for them.
• Members of our AsOne network, contractors and suppliers.
• People who apply to work with us.

Where we deliver services to clients, we often handle personal data on their behalf and under their instructions. In those cases the client is the controller and we act as a processor. This policy does not describe that processing — it is governed by our contract with the client.

3. The personal data we collect, why, and our lawful basis

Website visitors

What we collect: aggregated, non-identifying analytics about how the site is used, and technical logs generated by our hosting infrastructure for security and reliability.

Our analytics provider does not use cookies, does not collect IP addresses, and does not create persistent identifiers. In most cases this means no personal data is processed at all for analytics purposes.

Why: to understand which content is read and how the site performs, and to keep the site secure and available.

Lawful basis: legitimate interests — operating, securing and improving our website. We have assessed that this has minimal impact on your privacy because the data is aggregated and does not identify you.

People who enquire, and people who use our tools

What we collect: your name, email address, company, role, and anything you choose to tell us in your message. If you use the Rebrand Readiness Audit, we also collect the answers and information you submit to it, and the assessment generated in response.

Why: to respond to you, to assess whether we can help, and to provide the tool you have asked to use.

Lawful basis: legitimate interests — responding to enquiries about our services and operating tools we make available. Where a conversation progresses towards an engagement, our basis becomes the taking of steps at your request prior to entering a contract.

Please note: information submitted to the Rebrand Readiness Audit is transmitted to a third-party artificial intelligence provider in order to generate your assessment. See sections 5 and 6. You should not submit confidential information or personal data about other people into that tool.

Retention: enquiry records are kept for 24 months from your last contact with us. Readiness Audit submissions are retained only for as long as we need them to generate and deliver your assessment.

People we contact about our services

What we collect: name, job title, employer, business email address, business telephone number, and publicly available information about the organisation and its activities.

Where we get it: publicly available sources, including company websites, LinkedIn, Companies House, published funding announcements, industry press and events.

Why: to introduce our services to organisations we believe would benefit from them.

Lawful basis: legitimate interests — business development. We have weighed this against your rights and consider it proportionate because we contact people in a professional capacity, about matters relevant to their role, using business contact details, and we stop immediately on request.

Marketing to corporate subscribers is also subject to the Privacy and Electronic Communications Regulations. Every message we send identifies us and gives you a simple way to opt out.

Retention: 24 months from your last meaningful engagement with us, after which we review and delete.

Newsletter and marketing subscribers

What we collect: your email address and, optionally, your name and organisation.

Why: to send you our writing, updates and occasional information about what we do.

Lawful basis: consent, which you may withdraw at any time. Where you are an existing client, we may rely on the soft opt-in under the Privacy and Electronic Communications Regulations to send you information about similar services. You can unsubscribe from any message.

Retention: until you unsubscribe, plus a suppression record kept indefinitely so that we do not contact you again.

Clients and the people who work for them

What we collect: contact details, role, correspondence, project documentation, meeting notes and recordings, billing information, and records of the work we have done.

Why: to deliver our services, manage the relationship, invoice, keep proper business records and meet our legal obligations.

Lawful basis: performance of a contract, or legitimate interests where the individual is not personally a party to the contract but works for an organisation that is. Legal obligation applies to accounting and tax records.

Retention: for the duration of the relationship, and then for 7 years after the end of the financial year in which the relationship ended, to meet statutory accounting requirements.

Meeting recordings, transcripts and notes

Where we record or transcribe a meeting, we will tell you at or before the start of that meeting and you may object.

What we collect: audio, transcripts and generated summaries of client, prospect and internal meetings.

Why: to keep an accurate record of what was discussed and agreed, and to avoid errors in delivery.

Lawful basis: legitimate interests — maintaining an accurate record of professional discussions. We assess that this is proportionate because participants are notified, participate in a professional capacity, and can ask us not to record.

Retention: 12 months, or the life of the engagement, whichever is longer.

AsOne network members, contractors and suppliers

What we collect: contact details, professional background, portfolio and work history, engagement terms, payment details, and correspondence.

Why: to operate our network, match people to work, engage and pay them, and meet our legal obligations.

Lawful basis: performance of a contract, or steps prior to entering one. Legal obligation applies to payment and tax records.

Retention: for the duration of the relationship, plus 7 years for financial records and 24 months for network profiles after your last engagement.

Job applicants

What we collect: the information in your application, including CV, portfolio, contact details, work history and right-to-work information.

Why: to assess your application and manage recruitment.

Lawful basis: steps taken at your request prior to entering a contract, and legitimate interests in running a fair recruitment process. Right-to-work checks are a legal obligation.

Retention: 6 months after the outcome of the role, or 12 months where you consent to us keeping you in mind for future roles.

4. What we do not do

We do not sell, rent or trade personal data.

We do not use personal data for automated decision-making that produces legal or similarly significant effects.

We do not carry out behavioural advertising, cross-site tracking or profiling of website visitors.

5. Who we share personal data with

We use a number of third-party service providers to run our business. Where those providers process personal data on our behalf, they act as processors under contract and may only use the data for the purposes we specify.

We may also share personal data with our professional advisers, including accountants, insurers and solicitors, and with law enforcement or regulators where we are legally required to do so.

If our business is sold or reorganised, personal data may be transferred to the acquiring entity, subject to the same protections.

6. Transfers outside the UK

Some of our providers process personal data outside the United Kingdom.

Transfers to countries within the European Economic Area are covered by the UK's adequacy regulations, which means no additional safeguard is required.

For transfers to the United States and any other country without UK adequacy, we rely on the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, together with the UK Extension to the EU–US Data Privacy Framework where the recipient is certified under it, and any additional measures identified in our transfer risk assessment.

You may request a copy of the relevant safeguards by emailing hello@airborne.studio.

7. How we protect personal data

We use appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction. These include access controls, multi-factor authentication, encryption in transit and at rest, restricted administrative access, and a classification scheme that governs how sensitive material is handled.

We have procedures to deal with any suspected personal data breach, and will notify you and the Information Commissioner's Office where we are legally required to do so.

8. Your rights

Under UK data protection law you have the right to:

• Be informed about how we use your personal data — this policy.
• Request access to the personal data we hold about you.
• Request correction of personal data that is inaccurate or incomplete.
• Request erasure of your personal data, where there is no good reason for us to continue processing it.
• Object to processing where we rely on legitimate interests, including an absolute right to object to direct marketing at any time.
• Request restriction of processing in certain circumstances.
• Request transfer of your personal data to you or a third party, where processing is based on consent or contract and is carried out by automated means.
• Withdraw consent at any time, where we rely on consent. This does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, email hello@airborne.studio. We will respond within one month. There is no fee, although we may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive. We may need to verify your identity before acting.

9. Complaints

If you have a concern about how we handle your personal data, please tell us first so that we can put it right.

You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection.

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline: 0303 123 1113. www.ico.org.uk

10. Cookies

Our site does not use non-essential cookies and does not require a cookie banner. Our Cookie Policy explains this in full.

11. Changes to this policy

We may update this policy. Every version is dated and the current version is the one published here. Where a change is material, we will take reasonable steps to tell affected people directly.

12. Contact us

Airborne Studio Limited, The Foundry, 154–156 Blackfriars Road, London SE1 8EN. hello@airborne.studio