This policy covers studioarlek.com and the emails we send from it. Three sets of rules apply to what we do, and we follow all three: the Spam Act 2003 and the Privacy Act 1988 in Australia, and the GDPR, because the company behind this site is based in the European Union.
1. Who we are
This site is run by Studio Arlek, a website studio based in Poland. We are the data controller: we decide what information is collected and what happens to it.
We say plainly where we are because you are entitled to know who is writing to you. We are not an Australian company and we do not pretend to be one. We build websites for Australian businesses from Europe.
Studio ArlekDobrego Urobku 35
40-810 Katowice
Poland
Email: [email protected]
2. Why you got an email from us
Because your business publishes a contact address on its own website, and we wrote to you about work directly relevant to that business — rebuilding the website it sits on.
Under Schedule 2, clause 4 of the Spam Act 2003, consent to a commercial message can be inferred where an address is conspicuously published by a business, is not accompanied by a statement that unsolicited messages are unwanted, and the message is relevant to that person's role. We check all three before we write. If your website says anywhere that you do not want unsolicited email, we do not write at all.
We do not buy address lists, guess addresses, or use personal ones such as an owner's private mailbox.
We write once. There is no follow-up sequence and no phone call.
3. What we collect
| What | Example |
|---|---|
| Business contact details | Business name, business email address, suburb, the website address itself |
| Facts about the website | When it was last changed, whether it works on a phone, whether the security certificate is valid, what it is built with |
| Whether the link was opened | That the rebuild we sent you was viewed, and when. Not who viewed it, and not what else you did. |
| Anything you send us | What you type into the contact form, and your reply if you email back |
| Ordinary web server records | IP address, browser type, pages requested — the same records every website keeps |
We do not collect payment card details on this site, and we never ask for them by email.
4. Where it came from
From your own website, and from public business directories and mapping services where a business has chosen to list itself.
We did not get it from you directly, which is exactly why this section exists: Article 14 of the GDPR requires us to tell you when we hold information about you that we collected somewhere else. Our first email is that notice, and this page is the long version of it.
5. Why we use it, and the legal basis
| What for | Legal basis |
|---|---|
| Deciding whether a website is worth rebuilding, and building the sample | Legitimate interests — GDPR Art. 6(1)(f). Our interest in offering a relevant service, weighed against your privacy. We use business contact details only, and one message only. |
| Sending you one email about it | Inferred consent — Spam Act 2003, Sch. 2 cl. 4. Legitimate interests under the GDPR. |
| Recording that the link was opened | Legitimate interests. It tells us whether to keep the sample or delete it. |
| Answering your enquiry and doing the work if you buy | Performance of a contract, or steps before one — GDPR Art. 6(1)(b). |
| Keeping a record that you asked us to stop | Legal obligation — GDPR Art. 6(1)(c). We must keep your address in order to not write to it again. |
| Invoices and accounts | Legal obligation. Retention periods are set by tax law, not by us. |
6. How long we keep it
- The rebuilt website we sent you — 30 days, then it is deleted. It sits at a private link that is given to nobody else, is never published or indexed, and is not shown to anyone.
- Business contact details, if you do not reply — 30 days, then deleted along with the sample.
- Your unsubscribe — kept indefinitely. This is the one thing we cannot delete: we need your address on a suppression list precisely so that nothing reaches it again. It is used for nothing else.
- Correspondence with you — 12 months from the last message, unless it relates to work we did for you.
- Records of work and invoices — for as long as tax and accounting law requires.
7. Who else sees it
We do not sell information, rent it, or pass it to advertisers. It reaches other companies only where they run part of the machinery on our behalf, under contract:
- the company hosting this website and our email;
- the service that delivers our email;
- our accountants, for invoices.
Because we are based in the European Union, information about Australian residents is handled outside Australia. Australian Privacy Principle 8 requires us to say so plainly, and we take responsibility for it being handled to the same standard wherever it sits.
8. Cookies
This site sets only what it needs to work. We do not use advertising cookies and we do not follow you to other websites.
The rebuilt website we send you contains a single small image that tells us the page was opened, and when. It does not identify you, does not read anything on your device, and sets no cookie. If you would rather it did not load, most email and browser settings can block it; the page works either way.
9. Your rights
Whichever set of rules applies to you, you can ask us to:
- Tell you what we hold about you, and where we got it.
- Correct it if it is wrong.
- Delete it. We will, except for the suppression list described above.
- Stop using it for marketing. This one is absolute — we do not weigh it against anything.
- Object to our legitimate interests, or ask us to restrict what we do with it.
- Receive a copy in a portable form.
Ask by email. We answer within 30 days and we do not charge for it. We may ask you to confirm you are the person the information belongs to — that protects you, not us.
We do not make automated decisions about you that have legal or similarly significant effects. A person decides what we send and to whom.
10. How to stop hearing from us
Click the unsubscribe link in the email. It works immediately, takes one click, and needs no form, login or reason.
Replying and saying no works exactly the same way. So does asking us in any other words. We do not treat silence as interest, and we do not send a second message asking whether you meant it.
The Spam Act gives senders five working days to action an unsubscribe. Ours is instant.
11. Complaints
Tell us first — most things are a misunderstanding we can fix the same day. If that does not settle it, you can complain to a regulator:
- In Australia, about privacy: the Office of the Australian Information Commissioner (OAIC), oaic.gov.au.
- In Australia, about spam: the Australian Communications and Media Authority (ACMA), acma.gov.au.
- In the European Union: the Polish data protection authority (UODO), uodo.gov.pl, or the authority in your own country.
You do not need to go through us first. We would simply rather you did.
12. Changes
If we change how any of this works, we change this page and the date below. We do not change it quietly and backdate it.
Last updated 3 September 2026.
Written in plain English on purpose. If a sentence here is unclear, that is a fault worth telling us about.