Privacy policy

Who we are

Workly Up Ltd (“Workly Up”, “we”, “us”) is a digital studio registered in England and Wales under company number 14413111. Our registered office is 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.

For the personal data described in this policy, Workly Up Ltd is the controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where the EU General Data Protection Regulation (EU GDPR) or Türkiye’s Law No. 6698 on the Protection of Personal Data (KVKK) applies to you, we are the controller under those laws as well.

What this policy covers

This policy explains how we handle personal data when you:

• visit worklyup.com, in any language;
• send us a project enquiry, a general message or a careers application through the site;
• email us, speak with us, or become a client.

It does not cover Worklyup Social, the private social media publishing tool we run for our own accounts and for clients we invite. That tool has its own privacy policy, which also explains how to ask for its data to be deleted.

Cookies are explained in detail in our cookie policy. Visitors from Türkiye can also read our KVKK information notice (in Turkish).

The information we collect

When you browse the site

• Technical data. To deliver each page, our hosting provider and our network provider (Cloudflare) receive your IP address, the page requested, the date and time, your browser and device type, and the page that referred you. This happens on every website and is needed to serve and protect the site.
• Language. The first time you open our home page, our server reads the language your browser asks for, so it can show the English, Turkish or German home page. This is not stored. If you pick a language with the language switcher, we remember that choice in a cookie.
• Cookie choices. We store the choice you make in our cookie banner, so we do not ask on every page.
• Analytics, only with your consent. If you accept analytics cookies, Google Analytics records how the site is used: pages viewed, time spent, the site you came from, country or region, device and browser type, language, screen size, and interactions such as scrolling or following a link to another site. Google states that it does not log or store IP addresses of visitors in the UK, the EU and Switzerland. If you decline, Google Analytics does not load at all.

The site carries no advertising cookies, no social media pixels and no embedded third-party content other than Cloudflare’s security check on our forms. Our fonts are served from our own server.

When you use one of our forms

Our forms (start a project, contact and careers) ask for some or all of the following:

• your name and email address;
• your company or brand, and its website;
• a budget range and a timeline for the project;
• your message, and anything else you choose to tell us in it.

On the careers form, the website field is where you can share your portfolio, and your message tells us about your work and experience. Please do not include health information or other sensitive details in a form. If your project is confidential, tell us and we can sign a non-disclosure agreement before you share more.

To protect the forms from spam and abuse:

• Cloudflare Turnstile checks that a person, not an automated program, is sending the form. To do this, Cloudflare processes signals from your browser such as your IP address, browser (user agent) details and connection (TLS) fingerprint. In most cases you will not be shown a puzzle.
• Our server uses your IP address for a moment to limit repeated submissions. It is never stored in readable form: our security log keeps only a pseudonymous hash of it (a one-way code), for up to 90 days. A hash like this still counts as personal data, so we treat it as such.

The form then sends your enquiry as an email to our mailbox, which is provided by Google Workspace. The form does not keep your message in a database on our web server.

When you email or speak with us

We keep the emails you send and our replies, and short notes from calls and meetings. We do not record calls unless we have agreed it with you beforehand.

When you become a client

If an enquiry becomes a project, we also hold what we need to run it: the names and business contact details of the people we work with, the signed proposal or agreement, project correspondence, invoices and payment records. Personal data inside the material you give us for the project, such as customer records in a store we build, is handled under our agreement with you. In that work we usually act as your processor.

From other sources

If someone introduces your business to us, they may pass on your name and contact details. Before a first conversation, we may look at publicly available information about your business, such as its website and public social media profiles.

Why we use it, and our lawful bases

Purpose	Data	Lawful basis (UK GDPR and EU GDPR)
Delivering the site and keeping it secure	Technical data, security cookies	Legitimate interests: running a secure, reliable website
Showing the site in your language and remembering your cookie choices	Language and consent cookies	Legitimate interests: providing the site the way you asked for it
Understanding how the site is used, so we can improve it	Analytics data	Consent
Protecting our forms from spam and abuse	Turnstile signals, hashed IP address	Legitimate interests: protecting our systems and inbox
Replying to enquiries and preparing proposals	Form and email data	Steps you ask us to take before a contract; or legitimate interests in replying to businesses that contact us
Considering careers applications	Application data	Steps before a contract; legitimate interests in finding the right collaborators
Delivering projects and managing the client relationship	Client data	Contract; or legitimate interests where you act for your organisation
Keeping accounts and meeting tax and company law duties	Invoices, payment records	Legal obligation
Establishing, exercising or defending legal claims	Relevant records	Legitimate interests
Handling privacy requests and complaints	Request details and correspondence	Legal obligation

Where we rely on legitimate interests, we have weighed them against your rights and expectations, and you can ask us for that assessment.

We do not sell personal data, use it for advertising or build profiles of visitors. We do not make decisions about you by purely automated means. The only automated check is Cloudflare Turnstile, which may stop a form being sent if it suspects automated traffic; if that happens, email us at info@worklyup.com instead.

We do not send newsletters or marketing emails from this site. If we ever want to, we will ask first wherever the law requires it, and every message will include a simple way to opt out.

Who we share it with

We share personal data only with providers who help us run the site and the studio, under contracts that require them to protect it and use it only on our instructions, and with others where the law requires it.

Recipient	What they do for us	Location
Hostinger International	Hosts the website and the form endpoint	Data centres in the UK or the EU
Cloudflare, Inc.	Content delivery, security and Turnstile. Cloudflare also uses Turnstile signals as an independent controller to improve its bot detection.	United States company; global network, usually the data centre nearest to you
Google (Google Workspace)	Our email, calendar and documents	United States company; data centres in several countries
Google (Google Analytics), only with your consent	Site statistics	United States company; data from UK and EU visitors is first collected on servers in Europe
Our team and project-based specialists	Work on your enquiry or project, under confidentiality obligations	The UK and abroad, including Türkiye
Our accounting partner	Company formation in the UK, only if you ask us to introduce you	United Kingdom
Professional advisers (accountants, lawyers, insurers)	Advice, accounts and insurance	United Kingdom
Courts, regulators and public authorities	Only where the law requires it	As required

If Workly Up is ever reorganised, merged or sold, personal data may pass to the new owner, who must continue to protect it in line with this policy.

International transfers

We are a UK company. Some of our providers, and some of the people who work with us, are based outside the UK. When personal data leaves the UK, we make sure it remains protected:

• European Economic Area. Transfers to the EEA are covered by UK adequacy regulations.
• United States. Google and Cloudflare rely on the UK Extension to the EU–US Data Privacy Framework where they are certified, and their data processing terms include the UK International Data Transfer Addendum to the EU standard contractual clauses.
• Türkiye and other countries without a UK adequacy decision. When we share data with a separate organisation or a freelance specialist there, we use the UK International Data Transfer Agreement or Addendum, with extra measures where needed. Members of our own team work under our policies and confidentiality obligations wherever they are based.

If you are in the EU, note that the European Commission recognises the UK as providing adequate protection; the decision was renewed in December 2025 and runs until 27 December 2031. Our onward transfers use the EU standard contractual clauses or the Data Privacy Framework, as applicable. If you are in Türkiye, the KVKK information notice explains the basis for transfers abroad under Article 9 of KVKK.

You can ask us for a copy of the safeguards that apply to your data.

How long we keep it

Data	How long
Enquiries that do not lead to a project	Up to 24 months after our last exchange
Careers applications	Up to 12 months after we last contacted you, or longer only if you agree
Client and project records	For the length of the relationship and 6 years after it ends
Invoices and accounting records	6 years from the end of the financial year they relate to
Security log entries (hashed IP address)	Up to 90 days
Google Analytics user-level and event-level data	2 months; after that, only aggregated statistics remain, which do not identify you
Cookies	As listed in the cookie policy
Privacy requests and complaints	Up to 3 years after the matter is closed

When a period ends, we delete the data or anonymise it so that it no longer identifies you.

How we protect it

• Every page is served over HTTPS, with strict security headers and a content security policy.
• The site is static: there is no database and no administrator login on the web server.
• Forms are checked on the server, verified by Cloudflare Turnstile and rate-limited.
• Access to our mailboxes is limited to the people who need it and protected by two-step verification.
• Our providers are bound by data processing terms.

No system is entirely free of risk. If a personal data breach is likely to put your rights at high risk, we will tell you without undue delay.

Your rights

Under the UK GDPR, and the EU GDPR where it applies, you have the right to:

• access the personal data we hold about you and receive a copy;
• correct data that is inaccurate or incomplete;
• erase your data, where there is no good reason for us to keep it;
• restrict how we use your data, for example while a correction is checked;
• object to our use of your data based on legitimate interests, and to direct marketing at any time;
• portability: receive data you gave us in a machine-readable format, where we use it on the basis of consent or contract;
• withdraw consent at any time, for example through the “Cookie settings” link at the foot of every page; this does not affect what happened before;
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects (we make none).

To use a right, email info@worklyup.com with the subject “Privacy”, or write to us at the address below. We respond within one month; for complex or numerous requests we may extend this by up to two further months and will tell you why. If we need information to confirm your identity or understand your request, the time limit pauses until we receive it. We will search for your data in a reasonable and proportionate way, and there is normally no fee.

If you are in Türkiye, you also have the rights in Article 11 of KVKK; see the KVKK information notice.

Complaints

Please tell us first if you are unhappy with how we have handled your data: email info@worklyup.com with the subject “Privacy”. We acknowledge complaints within 30 days, look into them without undue delay and tell you the outcome.

You also have the right to complain to the Information Commission, the UK data protection regulator still known as the ICO: ico.org.uk/make-a-complaint or 0303 123 1113 (+44 303 123 1113 from outside the UK). If you live in the EU or EEA, you can complain to the data protection authority in your country. In Türkiye, after applying to us, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) through kvkk.gov.tr.

Children

This site is for businesses and professionals and is not directed at children. We do not knowingly collect personal data from anyone under 18.

Changes to this policy

We update this policy when the way we handle data changes. The date at the top shows the current version; if a change is significant, we will say so clearly on the site.

Contact

Email: info@worklyup.com (subject “Privacy”)

Post: Workly Up Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom

We have not appointed a data protection officer, because the law does not require one for the kind of processing we do. Our founder and director is responsible for data protection at Workly Up.