Privacy Notice
Last updated: November 1, 2026
This notice explains how Studio Galata collects and uses personal data when you visit studiogalata.eu, fill in a form, or contact us.
We are a UK company, so UK data-protection law applies to us. Because we also offer our services to people in the European Union, EU data-protection law may apply as well.
1.Who we are
The controller of your personal data is Studio Galata Ltd, registered in England and Wales under number 13331940, with its address at 92 Pymmes Green Road, London, England, N11 1DD.
For any privacy question or request, write to [email protected].
2.What data we collect
When you join the priority list (business or personal programs): your name, email address, phone number and the program (Booster) you choose.
When you send the company enquiry form: your name, email address, phone number, company name, whether you are a business owner, your industry and your company’s annual turnover range.
When you write or call us: the details you give us in your message or call.
Automatically, when you use the website: technical data such as your IP address, browser, device and pages visited, collected through cookies and similar tools. See our Cookie Policy.
If you buy from us or become a client: your billing name and address, country, VAT number if you buy as a business, order details and payment status. Card details are handled by our payment provider Stripe, and we do not store them.
Please do not send us sensitive data (for example health data) in your messages. We do not ask for it.
3.Why we use your data and on what legal basis
The legal bases below come from the UK GDPR and the EU GDPR, which use the same Article numbers.
| Purpose | Data used | Legal basis |
|---|---|---|
| Answer your enquiry and manage your priority-list request | Contact details, chosen program | Steps you ask us to take before a contract (Art. 6(1)(b) GDPR), or our legitimate interest in answering you (Art. 6(1)(f)) |
| Assess whether our programs fit your company | Company, industry, turnover range | Our legitimate interest in handling business enquiries efficiently (Art. 6(1)(f)) |
| Process your purchases, give you access to what you bought, invoice you and keep accounts | Contact, billing, order and payment-status data, and the record of your consent to immediate access | Contract (Art. 6(1)(b)) and legal obligations (Art. 6(1)(c)) |
| Send you news, invitations and offers by email [and phone/SMS – only if offered] | Name, contact details | Your consent (Art. 6(1)(a)), given separately by an optional tick box |
| Website analytics and measurement | Cookie and usage data | Your consent through the cookie banner (Art. 6(1)(a)) |
| Website security and preventing misuse | Technical data | Our legitimate interest (Art. 6(1)(f)) |
| Legal claims and compliance with the law | Data needed for the purpose | Legal obligation and legitimate interest (Art. 6(1)(c) and (f)) |
| Prevent fraud and handle payment disputes and chargebacks | Order and payment data | Our legitimate interest (Art. 6(1)(f)) |
4. Marketing messages
We send marketing messages only if you tick the separate, optional marketing box on our forms. It is not ticked by default, and filling in a form does not require it. You can withdraw your consent at any time by using the unsubscribe link in our messages or by writing to [email protected]. Withdrawing does not affect how we handle your enquiry or the lawfulness of what we did before.
5. Purchases, payments and refunds
If you buy a product from us, such as a recorded masterclass, we use your name, email, billing address and country, your VAT number if you buy as a business and the details of your order. We use them to process the order, give you access to what you bought, issue an invoice and keep our accounts.
Payments. Payments are processed by Stripe. You enter your card or other payment details directly on Stripe’s payment page, so we never see or store your full card number. Stripe handles those details under its own Privacy Policy and, for some purposes such as fraud prevention and its legal obligations, uses them as an independent controller. We receive confirmation of the payment (amount, status and date), your name and email address, a transaction reference and receipt link, and the type of payment method with the card brand, last four digits and country. See section 7 for how we protect data that leaves the UK and the European Economic Area.
Immediate access. If you buy digital content that you can use right away, we ask for your consent to start immediately and your acknowledgement that you lose the right to withdraw once access begins. We keep a record of that consent, with the date and time, so that we can prove it.
Withdrawals and refunds. Consumers may have a right to withdraw within 14 days. The conditions are in our Terms of Sale. If we refund you, we use your order and payment reference and send the money back to the original payment method through Stripe.
Fraud and disputes. We and Stripe may use order and payment data to prevent fraud and to handle payment disputes and chargebacks.
6.Who receives your data
We do not sell your data. We share it only with service providers who help us run the website and our business and who act on our instructions, and where the law requires it:
- website hosting and security: Coma Web Development, Cloudflare,
- website and form software: WordPress, WPForms,
- email, CRM or newsletter tools: Gmail, HubSpot,
- analytics: Google Analytics – only after consent,
- payment processing: Stripe (see section 5),
- delivery of purchased content: YouTube, Vimeo,
- accountants and professional advisers, where needed,
- public authorities, courts or law enforcement, when legally required.
7.Transfers outside the European Economic Area
Some of these providers may process data outside the UK and the European Economic Area, for example in the United States: Stripe. In that case we rely on an adequacy decision of the UK government or the European Commission, or on Standard Contractual Clauses with the UK Addendum where needed, together with additional safeguards where needed.
8.How long we keep your data
- Enquiries and priority-list requests that do not lead to a contract: 12 months after our last contact, then deleted.
- Orders, invoices and payment records, including your consent to immediate access: 6 years from the end of the year of purchase, or as long as UK accounting and tax law requires.
- Marketing contact details: until you withdraw consent or for 2 years without any interaction.
- Cookie and analytics data: as stated in our Cookie Policy.
- Data needed for a legal claim: until the matter is finally closed.
9.Your rights
You can ask us to give you access to your data, correct it, delete it, restrict its use, or send it to you or another provider in a usable format. You can object to processing based on our legitimate interests, and you can withdraw consent at any time. To use any right, write to [email protected]. We will reply within one month.
You also have the right to complain to a data-protection authority, in particular in the country where you live or work, or in the United Kingdom, the Information Commissioner’s Office (ICO).
10.Is providing data required?
Fields marked with an asterisk on our forms are needed so we can answer you. Without them we cannot handle your request. The marketing box is optional. To buy a product we also need your billing details and payment, and without them we cannot complete the order.
We do not make decisions about you based only on automated processing and we do not carry out profiling that has legal or similarly significant effects.
11. Cookies
We use cookies and similar technologies. Necessary ones are always active. Others, such as analytics, are used only after you agree in the cookie banner, and you can change your choice at any time. Details are in our Cookie Policy
12.Security
We use appropriate technical and organisational measures to protect your data against loss, misuse, unauthorised access and disclosure.
13.Links to other sites
Our website links to other sites, such as our Facebook, Instagram and YouTube pages. Those services have their own privacy policies, and we are not responsible for how they handle data.
14.Children
Our website and services are meant for adults. We do not knowingly collect data from people under 18.
15. Changes to this notice
We will publish any update on this page and change the “last updated” date at the top.
