Privacy Policy

Jamjar Studio Ltd (“Jamjar”, “we”, “us”) is a web design and marketing studio based in Norwich, England. This policy explains what personal data we collect, why, and what your rights are. It covers our website at jamjar.studio and the tools we use to deliver our services.

We are the data controller for the personal data described here. Company number: 16829346. Registered address: 46 Alexandra Road, Norwich, NR2 3EB.

If you have any questions, email us at emma@jamjar.studio.

1. What we collect and why

When you visit our website

We collect basic technical data: your IP address, browser type, device type, pages visited and how you arrived at the site. We use this to keep the site secure and to understand how it is used.

Legal basis: legitimate interests (running and securing our website).

When you contact us

If you email us or fill in a form, we keep your name, contact details and the content of your message so we can reply and, if you become a client, deliver the work.

Legal basis: legitimate interests (responding to enquiries) and, once you become a client, performance of a contract.

When you are a client

We hold the personal data needed to run your account: names and contact details of the people we work with, billing details, and access credentials you give us to the platforms we manage on your behalf (for example a website host, an advertising account or a social media account).

Legal basis: performance of a contract and our legal obligations (for example keeping accounting records).

Data we process on behalf of clients

When we manage a client’s website, advertising or social accounts, we may see personal data belonging to that client’s customers, such as enquiry form submissions or advertising audience data. In that case we act as the client’s processor, follow their instructions and use the data only to deliver the agreed service. The client’s own privacy policy governs how that data is used.

2. Google user data

We use Google APIs, including the Google Ads API, Google Analytics API and Google Search Console API, to manage advertising, analytics and search performance for clients who have given us access to their Google accounts.

What we access. With your permission, we access the Google Ads, Google Analytics and Search Console accounts you have linked to our agency account. This includes campaign settings, performance data, keyword data, site analytics and search performance data.

How we use it. Only to deliver the service you have engaged us for: reporting on performance, creating and managing campaigns, and improving your website’s search visibility. Our staff view this data through Google’s own tools and through internal tools that connect to Google’s APIs.

How we store it. Access tokens are stored securely on our own equipment and are never shared with third parties or embedded in any distributed software. We do not copy your Google account data into a database of our own. Reports we prepare for you are built from your data and shared only with you.

Who we share it with. Nobody outside Jamjar, other than as required to deliver the service to you (for example, sending you a report). We do not sell Google user data, use it for advertising unrelated to your account, or use it to build profiles of individuals.

How to revoke access. You can remove our access at any time by unlinking your account from our agency account in Google Ads, removing us as a user in Google Analytics or Search Console, or revoking access at myaccount.google.com/permissions.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. Who we share data with

We use a small number of service providers to run the business. Each one processes data only on our instructions:

• Website hosting and infrastructure (for example Vercel, Supabase, Flywheel)
• Email and productivity tools (Google Workspace)
• Accounting (Xero)
• Payment processing (Stripe)
• Automation tools that connect the services above

Some of these providers are outside the UK. Where that is the case, we rely on the UK’s adequacy regulations or on standard contractual clauses approved by the ICO.

We will also share data if the law requires it.

4. How long we keep it

• Website technical data: up to 26 months.
• Enquiries that do not become clients: 12 months after our last contact.
• Client account data: for the length of our relationship and 6 years afterwards, to meet accounting and legal requirements.
• Access credentials: deleted when the engagement ends or when you revoke them, whichever is sooner.

5. Your rights

Under UK GDPR you have the right to:

• Ask what personal data we hold about you and receive a copy.
• Ask us to correct or delete it.
• Object to or restrict how we use it.
• Ask for it in a portable format.
• Withdraw consent where we rely on it.

Email emma@jamjar.studio to exercise any of these. We will respond within one month.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk.

6. Cookies

Our website uses only the cookies needed for it to work and for basic analytics. We do not use advertising cookies on jamjar.studio.

7. Changes

We will update this policy when our practices change and show the date at the top.