Privacy & cookies.
This notice explains how I use your information when you enquire about my services or use ABA Studio, your client portal.
Last updated: 6 November 2026
Who is responsible for your information?
I’m Alex Bell, trading as Alex Bell Arts (ABA). I am the data controller for the personal information I use to run my design business and this portal.
For privacy questions or to exercise your rights, email me at Alex.bell.arts@outlook.com. Please do not send passwords, sign-in links, authentication codes or bank-card details.
What I collect and why
You provide information through enquiries, project correspondence, questionnaires, uploaded files and your portal account. This can include your name, business, contact details, project brief, feedback, approvals, contract returns and payment-verification records. Please only upload information you are entitled to share and avoid unnecessary sensitive personal information.
- Enquiries and delivering your project
- I use the details needed to discuss your request, agree the work, communicate with you and deliver it. My lawful basis is taking steps at your request before a contract or performing my contract with you. Where you represent an organisation, my legitimate interest is managing that business relationship.
- Accounts, access and security
- I use account identifiers, sign-in information, technical request data such as IP addresses, and access/audit records to provide the portal, prevent unauthorised access and investigate problems. My lawful basis is my legitimate interest in running a reliable, secure service and protecting confidential work.
- Business records and legal obligations
- I retain necessary contract, financial and decision records to meet applicable accounting and legal obligations, and for my legitimate interests in handling queries, disputes and legal claims. Uploading a contract or recording a payment check does not itself process a payment or provide an electronic signature.
If you do not provide information needed to respond to an enquiry, manage your account or deliver the agreed work, I may be unable to provide that part of the service. I do not use this portal to make solely automated decisions with legal or similarly significant effects about you.
Who helps me provide the service?
- Supabase provides account authentication, the project database and private file storage.
- Vercel hosts the portal and processes technical requests and operational logs.
- Tally processes your answers if you use my enquiry or feedback forms. Relevant enquiry answers are also received in my workspace.
- Email providers handle correspondence and account emails. My published contact address is hosted by Microsoft Outlook.
Booking and other external links, such as Calendly or Framer, open separate services with their own privacy and cookie information. They are not embedded tracking tools on this page. I may also share necessary information with professional advisers or authorities where required by law or necessary to establish, exercise or defend legal claims.
These providers operate internationally, so processing locations depend on the service and its configuration. Contact me for details of the locations and any applicable UK transfer safeguards for your information.
How long I keep information
As a sole trader, I normally keep invoices and supporting accounting and tax records for seven years after the end of the tax year they relate to. I may keep them longer where HMRC requires it or an unresolved enquiry or legal obligation needs it. Financial records may be held separately from the project portal.
Other records follow their own retention arrangements, rather than a blanket seven-year rule. Retention depends on whether an enquiry is still active, whether information is needed to deliver or support the agreed project, applicable accounting or legal obligations, and whether an unresolved complaint or legal claim requires it. Please contact me for the retention arrangements relevant to your project.
Closing or archiving a project does not automatically delete its information. Removing portal access also does not erase every business record. Necessary financial, contract, audit and account records may need separate retention; backups follow their own retention arrangements. A deletion request is reviewed against these requirements rather than treated as an automatic removal of everything.
Protecting your information
Portal access is restricted to authorised accounts and project permissions. Files have sharing and release controls. Download links are sensitive: a signed link can remain usable for up to 60 seconds, and copies already downloaded cannot be recalled. Keep your account and any private links secure, and tell me if you suspect unauthorised access.
Your rights and how to ask
Depending on the circumstances, UK data protection law gives you rights to access your personal information, correct it, request erasure or restriction, object to processing based on legitimate interests, and receive certain information in a portable format. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.
Email me using the contact above. I may need to confirm your identity without requesting more information than necessary. I normally respond within one month; if a lawful extension applies, I will explain it. Rights are subject to the applicable conditions and exemptions. You can also complain to the Information Commissioner’s Office (ICO), the UK data protection regulator.
Changes to this notice
I will update this page when the portal or relevant privacy arrangements change. The date above identifies this version.