Last updated: May 2026

1. Who we are

Mallen Studio is a human-directed AI brand photography studio, fully remote and based in Bristol, UK. We are registered in England and Wales (Company No. 17089248).

For the purposes of UK data protection law, Mallen Studio is the data controller responsible for your personal data.

Contact details: Email: hello@mallenstudio.com Website: www.mallenstudio.com

2. What this policy covers

This policy explains what personal data we collect, why we collect it, how we use it, and what your rights are. It applies to anyone who visits our website, contacts us, or signs up to our mailing list.

We are committed to handling your data responsibly and in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

3. What personal data we collect and why

When you contact us

If you send us an email or fill in the contact form on our website, we collect your name, email address, and any information you choose to include in your message. We use this to respond to your enquiry and, where relevant, to discuss a potential project with you. The legal basis for processing this data is legitimate interests — specifically, responding to a direct communication from you.

When you sign up to our mailing list

If you subscribe to our mailing list via the sign-up form on our Contact page, we collect your email address. We use this to send you occasional news and updates about Mallen Studio. The legal basis for this is your consent, which you give at the point of sign-up. You can unsubscribe at any time using the link in any email we send you, or by contacting us directly at hello@mallenstudio.com.

When you visit our website

Our website is hosted on Squarespace. Squarespace collects certain technical data automatically when you visit, including your IP address, browser type, pages visited, and time spent on the site. This data is used for website analytics and performance monitoring. For more detail on how Squarespace handles data, please see their privacy policy at squarespace.com/privacy. Our use of analytics data is covered in our Cookie Policy.

4. How long we keep your data

We keep enquiry and correspondence data for as long as is reasonably necessary to manage the relationship or project it relates to, and for a period afterwards in case of follow-up queries. We do not retain data beyond the point it is useful.

If you are on our mailing list, we will retain your email address until you unsubscribe or ask us to remove it.

5. Who we share your data with

We do not sell, rent, or trade your personal data. We may share it with the following third-party services that help us operate our business:

• Squarespace — our website platform and form/email data processor, based in the US. Squarespace is certified under the EU-US Data Privacy Framework and operates appropriate safeguards for international data transfers.

• Email providers — if you contact us directly by email, your message will pass through standard email infrastructure.

We will not share your data with any other third parties without your knowledge, except where required to do so by law.

6. International transfers

Squarespace processes data in the United States. They maintain appropriate safeguards for cross-border data transfers as required by UK GDPR. You can read more about their data transfer mechanisms at squarespace.com/privacy.

7. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you

• Correct any inaccurate or incomplete data

• Request deletion of your data (the "right to be forgotten")

• Restrict how we process your data in certain circumstances

• Object to processing based on legitimate interests

• Withdraw consent at any time where we rely on consent as our legal basis (such as for mailing list sign-ups)

• Data portability — to receive your data in a structured, commonly used format

To exercise any of these rights, please contact us at hello@mallenstudio.com. We will respond within one month, as required by law.

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection authority, at ico.org.uk or by calling 0303 123 1113.

8. Links to other websites

Our website contains links to third-party sites, including Instagram and LinkedIn. We are not responsible for the privacy practices of those sites and encourage you to read their own privacy policies.

9. Children's data

Our services are directed at businesses and professionals. We do not knowingly collect personal data from anyone under the age of 16.

10. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. The date at the top of this page will always show when it was last revised. For significant changes we will aim to notify mailing list subscribers directly.