Privacy policy

1. Who we are

This site is run by Studio Arlek, a website studio based in Poland. We are the data controller: we decide what information is collected and what happens to it.

We say plainly where we are because you are entitled to know who is writing to you. We are not an Australian company and we do not pretend to be one. We build websites for Australian businesses from Europe.

2. Why you got an email from us

Because your business publishes a contact address on its own website, and we wrote to you about work directly relevant to that business: rebuilding the website it sits on.

Under Schedule 2, clause 4 of the Spam Act 2003, consent to a commercial message can be inferred where an address is conspicuously published by a business, is not accompanied by a statement that unsolicited messages are unwanted, and the message is relevant to that person's role. We check all three before we write. If your website says anywhere that you do not want unsolicited email, we do not write at all.

We do not buy address lists, guess addresses, or use personal ones such as an owner's private mailbox.

We write once. There is no follow-up sequence and no phone call.

3. What we collect

We do not collect payment card details on this site, and we never ask for them by email.

4. Where it came from

From your own website, and from public business directories and mapping services where a business has chosen to list itself.

We did not get it from you directly, which is exactly why this section exists: Article 14 of the GDPR requires us to tell you when we hold information about you that we collected somewhere else. Our first email is that notice, and this page is the long version of it.

5. Why we use it, and the legal basis

6. How long we keep it

• The rebuilt website we sent you: 30 days, then it is deleted. It sits at a private link that is given to nobody else, is never published or indexed, and is not shown to anyone.
• Business contact details, if you do not reply: 30 days, then deleted along with the sample.
• Your unsubscribe: kept indefinitely. This is the one thing we cannot delete: we need your address on a suppression list precisely so that nothing reaches it again. It is used for nothing else.
• Correspondence with you: 12 months from the last message, unless it relates to work we did for you.
• Records of work and invoices: for as long as tax and accounting law requires.

7. Who else sees it

We do not sell information, rent it, or pass it to advertisers. It reaches other companies only where they run part of the machinery on our behalf, under contract:

• the company hosting this website and our email;
• the service that delivers our email;
• Stripe, our card payment provider, if you pay by card: it receives your name, email, business name and card details, and we never see the card number;
• our accountants, for invoices.

Because we are based in the European Union, information about Australian residents is handled outside Australia. Australian Privacy Principle 8 requires us to say so plainly, and we take responsibility for it being handled to the same standard wherever it sits.

8. Cookies

Two things can end up on your device here, and neither of them before you have had the chance to say no.

Your answer about cookies. When you choose, we keep one cookie, studioarlek_consent_v1, for twelve months, so that we do not ask again on every page. It holds your answer and nothing else. It is set whichever way you answer, including when you refuse everything. Without it we would have no way to remember the refusal, and you would be asked again on every page.

Google Analytics, only if you accept. If you agree, Google Analytics sets _ga and a second cookie beginning _ga_, both for up to two years. They tell us how many people came, which pages they read and where they arrived from. Your IP address is shortened before it is stored, advertising features are switched off, and we do not use any of it to work out who you are.

Until you accept, analytics storage is switched off in your browser, so nothing is written and no identifier is created. Refusing takes one click, in the same place as accepting. You can change your mind at any time: Cookie settings at the bottom of every page reopens the choice.

Australian law would not require us to ask: the Privacy Act expects a clear notice, which is this page, rather than a consent box. We ask anyway, because the company behind this site sits in the European Union and the European rule covers anything written to your device, wherever you happen to be reading from. Where the two differ, you get the stricter one.

The rebuilt website we send you contains a single small image that tells us the page was opened, and when. It does not identify you, does not read anything on your device, and sets no cookie. If you would rather it did not load, most email and browser settings can block it; the page works either way.

9. Your rights

Whichever set of rules applies to you, you can ask us to:

• Tell you what we hold about you, and where we got it.
• Correct it if it is wrong.
• Delete it. We will, except for the suppression list described above.
• Stop using it for marketing. This one is absolute. We do not weigh it against anything.
• Object to our legitimate interests, or ask us to restrict what we do with it.
• Receive a copy in a portable form.

Ask by email. We answer within 30 days and we do not charge for it. We may ask you to confirm you are the person the information belongs to. That protects you, not us.

We do not make automated decisions about you that have legal or similarly significant effects. A person decides what we send and to whom.

10. How to stop hearing from us

Click the unsubscribe link in the email. It works immediately, takes one click, and needs no form, login or reason.

Replying and saying no works too, and so does asking us in any other words: we action it the same business day. We do not treat silence as interest, and we do not send a second message asking whether you meant it.

The Spam Act gives senders five working days to action an unsubscribe. The link is instant; a reply is handled the same business day.

11. Complaints

Tell us first. Most things are a misunderstanding we can fix the same day. If that does not settle it, you can complain to a regulator:

• In Australia, about privacy: the Office of the Australian Information Commissioner (OAIC), oaic.gov.au.
• In Australia, about spam: the Australian Communications and Media Authority (ACMA), acma.gov.au.
• In the European Union: the Polish data protection authority (UODO), uodo.gov.pl, or the authority in your own country.

You do not need to go through us first. We would simply rather you did.

12. Changes

If we change how any of this works, we change this page and the date below. We do not change it quietly and backdate it.

13. Where your information physically sits

On servers in Poland and in the European Union. Nothing about you is stored in Australia, because we have no office and no equipment here.

Australian Privacy Principle 8 says an Australian business that sends personal information overseas stays responsible for it. We accept that standard even though we are the overseas party: EU rules apply to those servers by law, and they are stricter than the ones you are used to, not looser.

If you would rather your details were not held outside Australia, say so and we will delete them. That closes the conversation, and that is a fair trade.

14. How we keep it safe

Everything travels over an encrypted connection. The database sits behind a password nobody outside the studio has, on a server that does not accept logins from the open internet. Backups are encrypted and kept for fourteen days.

Two people have access to it. Not a department, not a contractor, not a marketing tool with a login we forgot about.

We do not hold card numbers at any point. If you pay by card, the card details go to the payment provider and never touch our systems.

15. If something goes wrong

Under Part IIIC of the Privacy Act, a data breach likely to cause you serious harm has to be reported to you and to the Office of the Australian Information Commissioner. That is the law, and we would do it anyway.

What you would get from us: what happened, what of yours was involved, what we have already done, and what you should do. In plain words, as soon as we know, not after a month of drafting.

16. Dealing with us without giving a name

Australian Privacy Principle 2 gives you the right to deal with a business anonymously or under a pseudonym where that is practical. Here it usually is.

You can ask what we hold, ask us to delete it, or unsubscribe without telling us who you are. The email address is enough. You only need to identify yourself when we are about to hand over information about you, and then only so we do not hand it to somebody else.

17. Your ABN, and what we never use it for

We ask for your ABN in one place only, the order form on this site, and it is optional; the card payment page does not ask for it. It goes on the invoice, because Australian bookkeeping is easier with it, and nowhere else. We never register anything against it: your domain is yours and stays where it is.

Australian Privacy Principle 9 stops a business using a government identifier as its own customer reference. We do not. Your ABN is used for the invoice and for nothing else: not as a key in our database, not to look you up anywhere, not to match you against any other list.

We never ask for a tax file number. There is no reason a web studio would need one, and any business that asks you for one should be asked why.

18. The rebuild we made of your site

If we wrote to you first, we had already rebuilt your website. It is worth being exact about what that contains, because it is built from things that belong to you.

• Your words and your photographs, taken from your own public website. Nothing is bought in, and nothing is invented about your business.
• A private address that is given to nobody else, never published, never indexed by search engines and never shown in any list of our work.
• A deadline. After 30 days it is deleted from the server, along with your contact details, unless you have replied.

You can have it removed sooner, in one click, from the link in the email: your address goes on the suppression list at once, and the rebuild comes off our server within one business day. You do not have to explain why, and it does not become a conversation.

It remains your material throughout. We claim nothing over it, and we will never use your site, your name or your photographs as an example of our work without asking you first.

19. Your website once it is live

After your site is running, the people who fill in its contact form are your customers, and their details are yours. They arrive in your inbox. We do not keep a copy, we do not read them, and we do not build a list out of them.

Two practical consequences worth knowing:

• The site keeps a short technical record of form submissions so that nothing is lost if an email bounces. It clears itself after thirty days and you can switch it off.
• Backups of your site include whatever is in it at the time. They sit with your hosting provider, in your account, under your control.

If we help you later and need to log in, we use an account of our own that you can close at any moment. We do not keep a master key to sites we have handed over.

20. What we will never do

Shorter than the rest, and the part most worth reading:

• We will never sell, rent or swap your details. There is no circumstance in which that becomes acceptable to us.
• We will never ring you. Everything happens in writing, so you always have a record of what was agreed.
• We will never write a second time after you have said no, and never from a different address to get around it.
• We will never put a tracker on your site for our benefit. On this one we use Google Analytics, and only if you agree to it; you can refuse or change your mind from the bottom of any page.
• We will never claim to be an Australian company. We are a Polish studio working with Australian businesses, and our registered address sits in the footer of every page, including this one.