How we handle your data

Depthia runs a single-page brochure website with a small contact form so you can send us a project enquiry, and Google Analytics (with consent) so we can count anonymous page views. We don't have a newsletter, a chatbot, advertising, or any other third-party scripts. This page explains what data we do touch, and what your rights are.

Who we are

This website is operated by Marcin Lewandowski, trading as Depthia, a UK sole trader. We are the data controller for the limited processing described below.

Depthia
66 Paul Street, London EC2A 4NA, United Kingdom
hello@depthia.com

What we collect

Server logs (Vercel)

When you visit this site, our hosting provider Vercel Inc. records standard server logs: IP address, browser type, the page you requested, and the time. These logs exist for security, abuse prevention, and traffic measurement, and are retained for a short period before deletion. We do not access these logs except in response to a security incident.

Contact form (Formspree)

When you submit the contact form on the home page, your email address and the content of your message are sent to Formspree, Inc., a forms-as-a-service provider that forwards the submission to us by email. Formspree retains submissions for a short period for delivery reliability and may apply spam filtering. We use the message only to reply to your enquiry.

Email correspondence

Once we reply, your email address and the content of our conversation sit in our email provider's systems for as long as we need to handle the matter and keep a record of work discussed.

Fonts

Web fonts on this site are self-hosted. No requests are made to Google Fonts or any other third-party font CDN. Visiting the site does not send your IP address to any font provider.

Cookies and similar technologies

We use one third-party service that may set cookies: Google Analytics 4. It only fires after you accept analytics in the consent banner. Until then, Google receives only an anonymous, cookieless ping under Google Consent Mode v2.

When you accept analytics, the following cookies are set:

• _ga — distinguishes unique visitors. Set by Google. Expires in 2 years.
• _ga_S4DS3NB4Y6 — persists session state for this Google Analytics property. Expires in 2 years.

We also store your consent choice in your browser's localStorage as depthia-consent so you don't get re-prompted on every visit. This entry is functional, not tracking, and never leaves your browser.

You can change your mind anytime via the Cookies link in the footer.

Lawful basis for processing

• Server logs: legitimate interest in operating a secure website (UK GDPR Article 6(1)(f)).
• Contact form submissions: steps to enter into a contract / legitimate interest in replying to an enquiry (Article 6(1)(b) or (f)).
• Email correspondence: same basis as above — replying to and managing your project enquiry.
• Analytics cookies (Google Analytics): consent (Article 6(1)(a)). Set only after you accept analytics in the banner; withdraw anytime via the footer.

Who we share data with

We use a small number of processors. Each acts only on our instructions under a written agreement (DPA).

• Vercel Inc. — hosting and server logs. US-based; data transfers are covered by Vercel's UK Addendum to EU Standard Contractual Clauses.
• Formspree, Inc. — receives contact form submissions and delivers them to us by email. US-based; transfers covered by Formspree's Data Processing Addendum.
• Google LLC — Google Analytics 4 (with Consent Mode v2). Receives anonymised page-view events and visitor identifiers, only after you accept analytics. US-based; transfers covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
• Email provider — handles incoming and outgoing email at hello@depthia.com.

We do not sell personal data, do not use it for advertising, and do not transfer it outside the UK/EU other than via the processors above (with the safeguards just mentioned).

How long we keep things

• Server logs: deleted on the hosting provider's standard schedule (around 30 days).
• Contact form submissions: held at Formspree per its retention policy (typically 30–60 days), then deleted.
• Email correspondence: kept while there's an active conversation, plus a reasonable archive period for records of work discussed.
• Google Analytics: per Google's retention setting (currently 14 months) for event-level data, then aggregated.
• Consent record: stored only in your browser's localStorage until you clear it or change preferences.

Your rights

Under UK GDPR you have the right to:

• Be informed about how we use your data (this page).
• Access a copy of personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased ("right to be forgotten") where applicable.
• Restrict or object to processing.
• Data portability where the conditions apply.
• Lodge a complaint with the Information Commissioner's Office at ico.org.uk/make-a-complaint — though we'd appreciate the chance to address concerns first.

To exercise any of these rights, email hello@depthia.com with "Privacy request" in the subject line. We aim to respond within 30 days, which is the maximum allowed by law.

Children

This site is aimed at businesses and adult professionals. We do not knowingly collect data about children under 13.

Security

The site is served over HTTPS. There is no database, no user accounts, no payment system, and no third-party tracking that could be compromised. Email correspondence is protected by our email provider's standard transport encryption.

Changes to this notice

If we add features that change what's processed (a contact form, analytics, a product on the site), we'll update this page and bump the "Last updated" date. Material changes will be highlighted.

← Back to home