Privacy Policy

1Who we are

Studioly is operated by TOPDEVS SOLUTIONS LTD, a company registered in England and Wales under company number 15016255, with registered office at 20 Wenlock Road, London, England, N1 7GU (“Studioly”, “we”, “us”, “our”).

Privacy contact

[email protected]

Data Protection Officer, if appointed

Not currently appointed; contact [email protected]

UK representative, if required

Not applicable for the UK entity at launch.

2Scope

This policy applies to the public Studioly website, account registration, Studio Portal, Studioly mobile applications, support and service communications, and other Studioly-operated services that link to this policy (together, the “Services”).

A studio, school, club or other organisation using Studioly (“Studio Customer”) may upload or create information about its students, guardians, instructors, coaches, tutors, team members and other participants. For that Customer Data, the Studio Customer normally determines why and how the data is used and acts as controller, while Studioly acts as processor/service provider on its documented instructions. The Studio Customer remains responsible for its own privacy notices, lawful bases and instructions to Studioly. Studioly may separately act as controller for account administration, billing, security, service analytics, support, legal compliance and its own marketing.

3Personal data we may collect

4How we obtain personal data

• Directly from account holders and website/app users.
• From Studio Customers and authorised studio personnel who create or upload Customer Data.
• From guardians, students or team users who interact with Studio Customer accounts.
• Automatically from devices, browsers, apps, logs and permitted storage/access technologies.
• From service providers, payment providers, authentication providers and other partners where applicable.
• From public or business sources where lawful and relevant.

5How and why we use personal data

Depending on our role and the context, we may process personal data for the following purposes and legal bases:

Where we rely on legitimate interests, we consider whether our interests are necessary and balanced against individuals’ rights and freedoms. Where consent is the basis, consent may be withdrawn at any time without affecting prior lawful processing.

6Children’s data

Studioly is designed for organisations that may provide activities to children. Studio Customers may therefore process children’s personal data through Studioly. Studio Customers are responsible for determining the appropriate lawful basis, providing required privacy information, obtaining any permissions/consents required for their activities, and configuring access appropriately. Studioly does not knowingly use Customer Data about children for behavioural advertising.

If a child or guardian wishes to exercise rights in relation to Customer Data held by a Studio Customer, they should normally contact that Studio Customer first. Studioly will assist Studio Customers with rights requests as required by the applicable data-processing agreement and law.

7Photos, videos and media

Studio Customers may upload photos, videos and other media to Studioly. The Studio Customer controls the purpose, lawful basis, permissions and audience for that content. Authorised users should upload media only where they have the right and authority to do so. Studioly processes that media to provide the Services and for security, support and legal purposes as applicable.

8Cookies and similar technologies

Our website and apps may use cookies, SDKs, pixels, local storage, tags and similar storage/access technologies. Strictly necessary technologies may be used to provide requested functions, security and consent preferences. Non-essential analytics, advertising/marketing or optional technologies will be handled through the applicable consent mechanism where consent is required.

Users can accept, reject or manage non-essential categories through Cookie Settings. Continuing to browse is not treated as consent to non-exempt technologies. We will identify the actual technologies, purposes, providers and retention periods in our Cookie Policy/Cookie Settings before production.

9Who we share personal data with

• Hosting, cloud infrastructure, database, storage and content-delivery providers.
• Authentication, security, monitoring, logging and support providers.
• Email, communications and customer-support providers.
• Payment and billing providers.
• Analytics and advertising providers, subject to applicable consent and configuration.
• Professional advisers, auditors, insurers and corporate transaction advisers.
• Authorities, courts or regulators where disclosure is required or permitted by law.
• A buyer, investor or successor in connection with a merger, acquisition, financing, reorganisation or sale, subject to appropriate safeguards.

A current sub-processor list should be published at the Studioly Sub-processor List and kept aligned with the actual production stack.

10International transfers

Some service providers may process personal data outside the United Kingdom. Where a restricted transfer occurs, we will use an applicable lawful transfer mechanism and safeguards, such as UK adequacy regulations or an appropriate Article 46 safeguard (which may include the UK International Data Transfer Agreement or UK Addendum, where applicable), together with any required data protection/transfer assessment.

11Data retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including contractual, security, accounting, legal and dispute-resolution requirements. Customer Data is retained according to the Studio Customer’s instructions, the subscription lifecycle and the applicable Data Processing Agreement, subject to backups and legal obligations.

Unless a longer period is required by law or a shorter period is agreed with the Studio Customer, Studioly’s launch retention standard is:

Active Customer Data

For the life of the account

Customer Data after account termination

Available for export/recovery for 30 days, then scheduled for deletion from active systems

Backup copies

Removed through the normal backup cycle within up to 90 additional days

Security logs

Up to 12 months

Support records

Up to 24 months after closure

Billing, tax and accounting records

At least 6 years, or longer where applicable law requires

Marketing suppression/consent records

As necessary to evidence preferences and legal compliance

Legal holds, disputes, fraud/security investigations and statutory obligations may require longer retention.

12Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures should reflect the actual production architecture and risk and may include access controls, encryption in transit, secure development practices, logging/monitoring, backups, vulnerability management and incident response. No system can be guaranteed completely secure.

13Your data protection rights

Depending on the circumstances and applicable law, individuals may have rights including access, rectification, erasure, restriction, objection, data portability, withdrawal of consent, and rights relating to certain automated decision-making. These rights are subject to legal conditions and exemptions.

For Customer Data controlled by a Studio Customer, requests should normally be directed to that Studio Customer. For data Studioly controls, contact [email protected]. We may need to verify identity before acting on a request.

14Automated decision-making and profiling

Studioly does not currently intend to make solely automated decisions about individuals that produce legal or similarly significant effects through the functionality described in this policy.

15Marketing

Where permitted, we may send information about Studioly products, services or updates. Recipients can unsubscribe using the link in a marketing message or contact us. Transactional/service communications required to operate an account are not marketing and may continue while relevant.

16Third-party links and services

The Services may link to third-party websites, app stores or services. Their privacy practices are governed by their own notices. Studioly is not responsible for third-party privacy practices except to the extent required by law or contract.

17Complaints

Please contact us first at [email protected] so we can try to resolve a concern. Individuals may also have the right to complain to the UK Information Commissioner’s Office (ICO) or another competent supervisory authority.

18Changes to this policy

We may update this policy to reflect product, legal or operational changes. We will publish the updated version with a new effective date and, where appropriate, provide additional notice of material changes.

19Contact us

20Related documents

• Terms of ServiceThe agreement for using Studioly
• Cookie Policy and Cookie SettingsTechnologies on our website and apps
• Data Processing Agreement (DPA) for Studio CustomersHow we process Customer Data for studios
• Sub-processor ListProviders that help us run the Services
• Acceptable Use Policy, if maintained separatelyRules for using the Services