Privacy policy

Who we are

Cwd.studio is a web design and development studio based in Nicosia, Cyprus, and we operate cwd.studio. For anything in this policy, write to [email protected]. We are the data controller for the information described below.

What we collect, and why

Only what you hand us. There is no tracking on this site.

• Enquiry and referral forms. Your name, email, phone number if you give one, your business name if you give one, and whatever you write in the message. We use it to reply to you and, if we end up working together, to run the project.
• Referrals. If a partner introduces you, we receive your name, business and contact details from them. We use them to get in touch once, on the basis of our legitimate interest, and delete them after twelve months if no work follows. Partner agreements and payout records are kept for six years for tax purposes.
• Email and WhatsApp. If you contact us directly, that conversation sits in our inbox or on our phone like any other business correspondence.
• Server logs. Our host, Cloudflare, records IP addresses and request data automatically as part of keeping the site online and defending it from attack. We do not read these for marketing and we cannot connect them to you.

We do not run advertising pixels, we do not build profiles, and we have never sold anyone’s data.

Our legal basis

When you fill in a form, you tick a box, and that consent is our basis for holding the details in order to reply. When we are working together, the basis is performance of our contract with you. Server logs rest on our legitimate interest in running a site that stays up and does not get attacked.

Who else sees it

• Web3Forms receives form submissions and passes them to our inbox. They act as a processor for us.
• Cloudflare hosts the site and handles security.
• Fontshare (Indian Type Foundry) serves the site’s fonts, so it receives your IP address when a page loads.
• Our email provider stores the resulting correspondence.

That is the full list. We add nobody without updating this page. Some of these providers operate outside the EEA under standard contractual clauses.

How long we keep it

Enquiries that do not turn into work are deleted after twelve months. Client records are kept for as long as we work together and then for six years afterwards, because Cypriot tax law requires it. Ask us to delete something sooner and we will, unless keeping it is a legal obligation.

Your rights

Under the GDPR you can ask us for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to stop using it, ask for it in a portable format, or withdraw your consent at any time. Email [email protected] and we will deal with it inside thirty days, usually the same week.

If you think we have handled your data badly, you can complain to the Office of the Commissioner for Personal Data Protection in Cyprus. We would rather you told us first, but it is your right either way.

Cookies

This site sets no cookies beyond what is strictly necessary to serve it. There is no analytics, no advertising and no tracking, which is why you were never shown a consent banner. The cookie page explains it in full.

Security

The site runs over HTTPS with a strict content security policy and loads no third-party scripts. That is not a guarantee against everything, but it removes most of what goes wrong on small business websites.

Changes

If this policy changes we update the date at the top. Nothing here is applied retroactively to information you gave us under an older version.