Privacy policy

Last updated — September 2026

This policy explains what personal information Chroma collects through this website and in the course of our work, why, and what your rights are. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who we are

Chroma is a brand identity and web design studio based in Manchester, United Kingdom. For the purposes of UK data protection law, Chroma is the controller of the personal information described here. You can reach us about anything in this policy at contact@chromabranding.co.

What we collect

We only hold personal information you choose to give us:

  • Enquiries. When you use the contact form or the application form, we receive your name, email address, project budget, preferred launch timing and anything you write about your project.
  • Email. If you email us directly, we receive your address, your message and anything you attach.
  • Clients. If we work together, we also hold the contact and billing details needed to run the project and invoice for it.

We count visits with Vercel Web Analytics, which is cookieless: it records pages viewed, the referring site, and your country and device type, without identifying you. If you accept cookies, we also use Google Analytics, which sets cookies and shares usage data with Google; it never loads if you decline. We use no advertising tools, and we do not buy or receive personal information about you from anyone else.

Why we use it, and our lawful basis

  • To reply to your enquiry and assess whether we're the right fit. Lawful basis: steps taken at your request before entering into a contract (Article 6(1)(b) UK GDPR), and our legitimate interest in responding to people who contact us (Article 6(1)(f)).
  • To deliver a project we've agreed. Lawful basis: performance of a contract (Article 6(1)(b)).
  • To keep financial records. Lawful basis: legal obligation (Article 6(1)(c)), as HMRC requires business records to be kept.

We never sell your information, share it for anyone else's marketing, or add you to a mailing list you didn't ask for. We don't use it for automated decision-making or profiling.

Who processes it for us

We use a small number of service providers who handle data on our behalf, under contracts that require them to protect it:

  • Vercel hosts this website and runs the form that sends your enquiry.
  • Resend delivers form submissions to our inbox by email.
  • Our email provider stores the correspondence we send and receive.
  • Google Fonts supplies some of the typefaces on this site, so your browser requests them from Google's servers, which see your IP address. See Google's privacy policy.

We may also share information with our accountant, or where the law requires us to.

International transfers

Some of these providers are based in, or store data in, the United States. Where personal information leaves the UK, we rely on the safeguards UK law allows: the UK Extension to the EU–US Data Privacy Framework, or the International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses issued by the Information Commissioner.

How long we keep it

  • Enquiries that don't turn into a project: up to 12 months, then deleted.
  • Project correspondence and files: for the length of the project and up to six years afterwards, in line with the Limitation Act 1980.
  • Invoices and financial records: six years from the end of the financial year they relate to, as HMRC requires.

Your rights

Under UK data protection law you have the right to:

  • ask for a copy of the personal information we hold about you;
  • ask us to correct anything that's wrong or incomplete;
  • ask us to delete it;
  • ask us to restrict how we use it, or object to our using it on the basis of legitimate interests;
  • ask for the information you gave us in a portable format.

Email contact@chromabranding.co. There's no charge, and we'll respond within one month. We may need to confirm who you are first.

Complaints

If you're unhappy with how we've handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.

Security

This site is served over HTTPS, form submissions are not stored in a database, and access to our inboxes and project files is limited to the people doing the work.

Children

This site and our services are for businesses. We don't knowingly collect information from anyone under 18.

Changes

If this policy changes, the new version will appear on this page with an updated date.