Privacy policy

LOOM Studio Limited is a company incorporated in Hong Kong, based in Wan Chai. We decide how the personal data described here is used, which makes us the data user under the Ordinance (the data controller, in EU and UK terms).

You can reach us about anything in this policy at team@loomstudio.design.

When you send an enquiry

The contact form asks for your name, company, email address and a description of your project. Your phone number is optional. We use these details to reply to you, to scope and quote the work and, if a project goes ahead, to run it with you.

Giving us your details is voluntary. Without a name, company, email and project description we can't send the form, but you can always email us directly instead.

When you start filling in the form, Cloudflare Turnstile checks that a person, not a bot, is sending it, using technical signals from your browser. Usually you won't notice it. Occasionally it asks you to tick a box. Resend then delivers the form to our inbox by email.

When you browse the site

Cloudflare, which hosts the site, records standard technical data for every request: IP address, browser and device type, the page requested and the time. This keeps the site running and secure. We don't use it to identify you.

Once a page is interactive, Google Tag Manager loads two tools. Google Analytics tells us how many people visit, which pages they read and how they found us. We look at this as totals and trends, not to identify you.

Google Ads is an advertising tool. It tells us when someone who clicked one of our Google ads goes on to visit or send an enquiry. Google also uses this data for its own purposes, under its own privacy policy, and if you are logged in to a Google account it can connect the visit to it.

If you visit from the EU, the EEA, the UK or Switzerland, a short notice asks for your consent first. These tools load only if you accept.

• __cf_bm comes from Cloudflare and helps tell people from bots. It expires after 30 minutes and holds nothing that identifies you.
• Google Analytics sets _ga and _ga_*, which tell visits from the same browser apart so we can count visitors. They stay for up to 2 years.
• _gcl_au, from Google Ads, links a visit to an ad you clicked, for 90 days.
• Visitors from the EU, EEA, UK and Switzerland also get region, from Cloudflare, which lasts a day and only tells the site to show the consent notice. Your answer to the notice is remembered in your browser for 12 months; to change it, use Cookie settings at the foot of any page.

You can block or delete cookies in your browser settings at any time, and a tracker blocker stops both tools. Google offers a Google Analytics opt-out add-on. To limit ads based on your activity, use Google's My Ad Center. The site works the same either way.

We don't sell personal data. Cloudflare, Resend, Google Tag Manager and Google Analytics handle it on our behalf, under their own data processing terms, which require them to keep it secure and not use it for anything else. Google (for Ads) also uses the data from its tag for its own purposes, under its own privacy policy.

This means your data is processed outside Hong Kong. Beyond these providers, we only share personal data with people working with us on your project, and only what they need, or where the law requires it.

• Enquiries: if no project follows, we delete your details within 12 months of your enquiry. If we work together, we keep them while the relationship is active and for up to 3 years after our last contact. Resend keeps a delivery record of each message for a limited period under its own retention policy.
• Technical logs: kept by Cloudflare for a short period under its own retention policy.
• Google Analytics: user-level data is kept for up to 14 months, then deleted automatically.
• Google Ads data: kept by Google under its own retention policy. We don't store a copy.

We don't use your personal data for direct marketing, such as newsletters or promotional emails, unless you have agreed to it first. Replying to your enquiry and following up on it is not marketing. If you ever receive something from us you don't want, reply and we'll stop, free of charge.

Under the Ordinance you can:

• ask whether we hold personal data about you and request a copy of it
• ask us to correct data that is inaccurate
• tell us to stop using your data for direct marketing

You can also ask us to delete your data. We will, unless we still need it for the purpose you gave it for or the law requires us to keep it.

Send requests to our data protection officer at LOOM Studio Limited, Wan Chai, Hong Kong, by email toteam@loomstudio.design. We may need to confirm your identity first, and we will respond within 30 days. The Ordinance allows a reasonable fee for copies of data.

If you are unhappy with how we have handled your data, you can complain to the Office of the Privacy Commissioner for Personal Data.

The GDPR, the UK GDPR and Swiss data protection law also give you the right to have your data erased, to restrict or object to how we use it, to receive it in a portable format and to withdraw consent you have given. We answer enquiries you send us on the basis of our legitimate interest, and take steps towards a contract when a project follows. For analytics and advertising cookies we rely on your consent, which you can withdraw at any time through the cookie settings link in the footer; the analytics and advertising cookies already set are then deleted. Contact us to use any of these rights. You can also complain to your local data protection authority, in the UK the Information Commissioner's Office, and in Switzerland the Federal Data Protection and Information Commissioner.

The site and the contact form run over HTTPS, and only the people who need your enquiry to answer it or run your project can see it. No system is completely secure, so if you'd rather not send something through the form, email us instead.

Links to Instagram, LinkedIn and other sites take you outside this policy. Their own privacy policies apply there.

When the way we handle personal data changes, we'll update this page. If a change affects data you have already given us, we'll tell you before it applies.