Controller
Travis Hurlock, operating travishurlock.com, is the controller for information collected directly through the website and Client Area. Contact: travis@travishurlock.com.
Where client files contain personal information controlled by a client, the client will normally remain the controller and Travis Hurlock will act as its processor under the applicable client agreement and data-processing terms.
Current status
The Client Area is currently a non-functional pre-launch prototype. Sign-in, registration, password-reset and newsletter controls do not currently submit or store information.
This notice must be reviewed against the final hosting, authentication, storage, email, analytics and processor configuration before activation.
Information we collect
Depending on how you interact with the website and Client Area, this may include:
- Identity, name, work email, organisation and role.
- Invitations, access requests and account status.
- Authentication and account-security records.
- Project communications and administrative information.
- Client files and associated metadata.
- Technical, access, browser, IP and security logs.
- Newsletter address, consent evidence, subscription status and unsubscribe records.
- Contractual, invoicing and legal-compliance records, where applicable.
Client Area
- User/account identifier
- Name and work email
- Client/organisation
- Role and access permissions
- Invitation and account status
- Authentication and security records
Newsletter
- Email address
- Subscription status
- Consent date and time
- Source page or form
- Version of the consent wording presented
- Confirmation date, if double opt-in is used
- Unsubscribe date
Purposes and lawful bases
- Access requests and steps towards providing services: pre-contractual steps and legitimate interests.
- Providing and administering contracted services: performance of a contract.
- Project communication and support: contract and legitimate interests.
- Protecting accounts, files and systems: legitimate interests and applicable legal obligations.
- Accounting, regulatory compliance and legal claims: legal obligation and legitimate interests.
- Studio Notes marketing: separate consent, or another lawful basis only where PECR permits it.
Marketing subscription remains optional and independent of Client Area access.
Marketing
With your separate permission, we may send occasional emails about studio work, services, launches and useful ideas. Marketing subscription is optional and is not required to obtain Client Area access or receive contracted services. You can withdraw permission at any time using the unsubscribe link in an email or by contacting travis@travishurlock.com.
Sources
Information may come directly from the individual, from an authorised client administrator, from necessary technical or security logs, or from client-provided files where Travis Hurlock is acting as a processor.
Sharing
Information may be shared only where necessary, with:
- Hosting, authentication, storage, email, security and support providers.
- Professional advisers.
- The relevant client organisation.
- Regulators, courts or authorities where legally required.
- A lawful successor to the relevant business or service.
Providers are not named here until they have been selected and verified.
International transfers
Any restricted transfer of personal information outside the UK will rely on an applicable adequacy arrangement or an appropriate UK safeguard, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with any required transfer-risk assessment.
Retention
The following is the intended pre-launch retention schedule. It must be confirmed before launch:
- General enquiries: normally up to 12 months after the last substantive contact.
- Unsuccessful or withdrawn access requests: normally up to 12 months after the decision.
- Security logs: normally up to 12 months, unless required for an incident or legal matter.
- Client, contractual and transaction records: for the duration of the relationship and normally up to six years afterwards where required for accounting or legal purposes.
- Client files: according to the client agreement, followed by secure return or deletion, subject to agreed backup arrangements.
- Newsletter consent and suppression records: while subscribed, with limited suppression information retained afterwards to prevent unwanted resubscription or marketing.
Your rights
Depending on the lawful basis and circumstances, you may have the right to:
- Information.
- Access.
- Rectification.
- Erasure.
- Restriction.
- Objection.
- Portability.
- Withdraw consent.
- Challenge qualifying solely automated decisions.
Not every right applies in every circumstance. Requests can be sent to travis@travishurlock.com.
Complaints
Privacy complaints should first be sent to travis@travishurlock.com. If a complaint remains unresolved, you may complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint.
Cookies
Operational authentication may require strictly necessary session and security technologies. Non-essential analytics, advertising or tracking will not be enabled until assessed and, where required, covered by an appropriate consent mechanism.
Security
When operational, the Client Area will use proportionate technical and organisational safeguards, including controlled access, account security, monitoring, backups and encryption where appropriate.
Additional provisions
- The service is intended for business users aged 18 or over.
- Unnecessary special-category or criminal-offence information must not be uploaded without prior agreement.
- No solely automated decision with legal or similarly significant effect is currently intended.
- This notice will be updated when the service, suppliers, purposes or legal requirements materially change.
Last updated: 4 August 2026.