Privacy policy

This policy explains what personal data Chrome Objects Ltd collects through chromeobjects.com, why we collect it, how long we keep it and the rights you have over it. We have tried to keep it plain and specific. If anything is unclear, email us at hello@chromeobjects.com.

Who we are

Chrome Objects Ltd is the controller of the personal data described in this policy. That means we decide how and why it is used, and we are responsible for looking after it under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

Company: Chrome Objects Ltd, registered in England and Wales, company number 17492559
Registered office: Office 28, Bradford Chamber Business Park, New Lane, Laisterdyke, Bradford BD4 8BX
ICO registration number: [ICO registration number]
Contact: hello@chromeobjects.com

We have not appointed a data protection officer, because the law does not require one for a business of our kind. Questions about this policy go to the email address above.

What we collect and why

When you send an enquiry

Our website has four enquiry forms: the project brief, the quick enquiry, the callback request and the project estimator. Depending on the form, we collect:

your name, email address and phone number
your company name
your message, and any files you attach
the services you are interested in, your budget range and your timeline
the choices you made in the project estimator, and the estimate it gave you

We also record how you found us: the page you first landed on, the website that referred you, and any campaign tags in the link you followed (known as UTM parameters). This is recorded with your enquiry whether or not you accept analytics cookies, because it is part of the enquiry itself, not tracking across other sites.

All of this is stored in our own customer relationship management system (CRM), which is part of our website and runs on our hosting. We use it to reply to you, to prepare a proposal if you ask for one, and to understand which of our pages and campaigns bring in enquiries.

Lawful basis: our legitimate interests in responding to people who contact us and running our business, and, where you ask us for a proposal or go on to work with us, taking steps at your request before entering into a contract.

When we reply to you

We reply by email, and by WhatsApp if you have given us your phone number and contacting you there makes sense. We keep a record of our conversation with you, across email and WhatsApp, in the CRM so that anyone at the studio working on your enquiry can see what has already been said. When you send us an enquiry, we also send you an automatic email to confirm we have received it.

WhatsApp is run by Meta. Messages sent through it are also handled under WhatsApp's own terms and privacy policy.

Lawful basis: our legitimate interests in answering your enquiry, or steps you have asked us to take before a contract.

When you join our newsletter

If you sign up to our newsletter, we collect your email address and, if you give it, your name. We also note the page you signed up on and how you found us, in the same way as for enquiries. We use double opt-in: we send you an email asking you to confirm, and we do not send you the newsletter until you do. Every newsletter has a one-click unsubscribe link, and you can also unsubscribe by emailing us. We keep a record of when you signed up and confirmed, so we can show that you agreed.

Lawful basis: your consent. You can withdraw it at any time by unsubscribing.

When you apply for a job

If you apply through our careers form, we collect your name and email address, the role you are interested in, and anything else you choose to send us: your CV, a link to your portfolio and a message. We use it only to consider your application and to contact you about it.

Lawful basis: our legitimate interests in recruiting, and steps you have asked us to take before a possible contract of employment or engagement.

When you browse the website

Our website sets a small number of cookies that it needs to work, such as a session cookie and a security token that protects our forms. It also remembers your cookie choice.

We use Google Analytics 4, Google Ads and the Meta pixel to understand how people use the site and to measure our advertising. These load only if you click Accept on our cookie banner. Until then, we use Google Consent Mode v2 with every setting defaulted to denied, so no analytics or advertising cookies are set. If you accept, these services collect information such as the pages you visit, how you arrived, your device and browser, and an approximate location based on your IP address.

Lawful basis: your consent, as PECR requires for non-essential cookies. You can change your choice at any time using the Cookie settings link in the footer. Our cookie policy lists every cookie in detail.

If you have an account on our admin system

Our staff and anyone we give access to our admin system have an account with their name, email address, role and a password, which we store in a scrambled (hashed) form. Accounts are protected with two-factor authentication, and we keep a record of active sign-in sessions for security.

Lawful basis: our legitimate interests in keeping our systems and the data in them secure.

We do not sell your personal data, and we do not share it with anyone for their own marketing. We use a small number of service providers who handle data on our behalf, under contracts that require them to protect it and use it only on our instructions:

Website hosting: [Hosting provider], in the UK, which hosts our website and CRM.
Email: [Email provider], which sends and receives our emails, including enquiry confirmations and the newsletter.
WhatsApp: Meta, when we message you on WhatsApp.
Analytics and advertising: Google (Analytics and Ads) and Meta (the Meta pixel), only if you accept cookies.

Our team works across the UK and Turkey, so people at the studio based outside the UK may access your data to work on your enquiry or project. We may also share data if the law requires it, or with professional advisers such as our accountants and lawyers where needed.

International transfers

Our website and CRM are hosted in the UK. Some of the providers above, such as Google and Meta, may process data outside the UK, including in the United States, and some members of our team work in Turkey. Where data leaves the UK, we rely on the safeguards UK law allows, such as UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the International Data Transfer Agreement or Addendum. [CONFIRM: transfer safeguards for each provider and for team access from Turkey]

How long we keep it

We keep personal data only for as long as we need it. These are our standard periods:

Data	How long
Enquiries that do not lead to work, and the conversation with you	Two years from our last contact with you [CONFIRM: retention]
Records for clients we work with	Six years after the end of our last contract, for legal and accounting reasons [CONFIRM: retention]
Newsletter subscription	Until you unsubscribe. We then keep your email address on a list of people not to email, so we do not add you again by mistake.
Job applications and CVs	Six months after the role is filled, unless you agree to us keeping them longer for future roles [CONFIRM: retention]
Analytics data in Google Analytics	14 months [CONFIRM: retention]
Admin accounts	While the account is active, and removed when access is no longer needed

When a period ends, we delete the data or make it anonymous so it can no longer identify you.

How we protect it

The website and CRM are served over an encrypted connection. Access to the admin system is limited to the people who need it, each person sees only the areas their role requires, and every account is protected with two-factor authentication. Our forms are protected against automated abuse.

Your rights

Under UK data protection law, you have the right to:

ask for a copy of the personal data we hold about you
ask us to correct data that is wrong or incomplete
ask us to delete your data
ask us to limit how we use your data
object to us using your data on the basis of our legitimate interests
ask for data you gave us to be passed to you or to another organisation in a common format
withdraw your consent at any time, where we rely on it, without affecting anything we did before

Some of these rights apply only in certain situations. To use any of them, email hello@chromeobjects.com. We will reply within one month, and we will not charge you unless a request is clearly unfounded or excessive. We may ask you to confirm your identity first.

We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

Children

Our website is for businesses and the people who run them. It is not aimed at children, and we do not knowingly collect data from anyone under 16.

Complaints

If you are unhappy with how we have handled your data, please tell us first at hello@chromeobjects.com and we will try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator for data protection, at ico.org.uk/make-a-complaint.

Changes to this policy

We will update this policy when the way we use personal data changes. The date at the top shows when it was last updated. If a change is significant, we will make it clear on the website or tell you directly where we can.

Contact us

For any question about this policy or your data, email hello@chromeobjects.com or write to Chrome Objects Ltd at Office 28, Bradford Chamber Business Park, New Lane, Laisterdyke, Bradford BD4 8BX.