Privacy Policy
This policy explains what personal data JUST JENIUS LTD collects through this website and in the course of its business, why we collect it, how long we keep it, and the rights you have over it under the UK GDPR and the Data Protection Act 2018.
1. Who we are
JUST JENIUS LTD (“we”, “us”, “our”) is the data controller for the personal data described in this policy. We are a company registered in England and Wales under company number 17335525, with our registered office at 167–169 Great Portland Street, London, England, W1W 5PF. We trade as Just Jenius.
For any question about this policy, or to exercise any of the rights described in it, email info@justjenius.com or write to us at the address above marked “Data Protection”.
We are not required to appoint a Data Protection Officer, and have not appointed one. Data protection enquiries are handled by the company's director.
Action for the client: a UK company processing personal data electronically must normally pay the annual data protection fee and register with the ICO. Once registered, the ICO registration number should be added to this section.
2. What this policy covers
This policy covers personal data we collect through justjenius.com, personal data you send us by email, and personal data we process about people who enquire about our services, apply for a role with us, or act as a contact at a client or supplier.
Where we design or build a website for a client, that client is the controller for personal data collected through their own site, and their own privacy notice applies — not this one.
3. Personal data we collect
Information you give us
- Enquiry form: your name, email address, the company or brand name you choose to give, the enquiry category you select, the content of your message, and whether you tick the optional marketing box.
- Email and correspondence: anything you choose to include when you contact us directly, including any attachments.
- Client and supplier contacts: name, job title, business email address, business telephone number and the correspondence relating to a project.
Information collected automatically
- Server logs: your IP address, the pages requested, the date and time, the response status, the referring page and your browser's user-agent string. These are created automatically by our web server and by our content delivery network.
- Anti-abuse data: when you submit the enquiry form we record your IP address and a timestamp so that we can apply rate limits and detect automated submissions.
- Your cookie choices: stored in your own browser, as described in section 6.
We do not collect payment card details through this website, and we do not knowingly collect any special category data (such as health, ethnicity, religion or biometric data). Please do not send us special category data through the enquiry form.
4. Why we use it, and our lawful basis
| What we do | Data used | Lawful basis (UK GDPR Article 6) |
|---|---|---|
| Read and reply to your enquiry, and discuss a possible project | Name, email, company, enquiry category, message | Article 6(1)(b) — steps taken at your request before entering into a contract; and Article 6(1)(f) — our legitimate interest in responding to people who contact our business |
| Deliver a project and manage the client relationship | Business contact details, correspondence, project records | Article 6(1)(b) — performance of a contract; Article 6(1)(f) — legitimate interest in administering our business |
| Protect the site and the form from spam, bots and abuse | IP address, timestamp, user-agent, bot-protection token | Article 6(1)(f) — our legitimate interest in keeping the site secure, available and free from automated abuse |
| Send you occasional updates about the studio's work | Name, email | Article 6(1)(a) — your consent, given by ticking the optional box; and regulation 22 of PECR |
| Assess a job application | See section 5 | Article 6(1)(b) — steps prior to an employment contract; Article 6(1)(f) — legitimate interest in recruiting for our business |
| Carry out a right to work check on a successful candidate | Identity and immigration documents | Article 6(1)(c) — compliance with a legal obligation (Immigration, Asylum and Nationality Act 2006) |
| Keep records for accounting, tax and legal purposes | Transaction and correspondence records | Article 6(1)(c) — legal obligation; Article 6(1)(f) — establishing or defending legal claims |
| Set optional cookies | See our Cookie Policy | Article 6(1)(a) — your consent, and regulation 6 of PECR |
Where we rely on legitimate interests, we have considered whether that interest is overridden by your rights and freedoms, and concluded that it is not — the processing is limited to what is necessary to run a small design studio, keep its website secure and reply to people who contact it. You can object to processing based on legitimate interests: see section 11.
Where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not affect the lawfulness of anything we did before you withdrew it.
5. If you apply for a job
If you apply for a vacancy with us, we process the CV, portfolio, covering note and contact details you send, together with any notes we make during the selection process, in order to assess your suitability for the role.
- Providing this information is voluntary, but we cannot assess an application without it.
- Your application is seen only by the people involved in that recruitment decision.
- If your application is unsuccessful, we keep it for six months from the closing date in case a similar role arises, and then delete it. Tell us if you would prefer us to delete it sooner and we will.
- If your application is successful, your information becomes part of your employment record and a separate employee privacy notice will be given to you.
- Before employment starts we are legally required to check that you have the right to work in the UK, and to keep a copy of the documents you provide for the duration of your employment and for two years afterwards.
Please do not include special category data in your application unless we specifically ask for it.
6. Cookies and similar technologies
We set only what is strictly necessary to deliver and secure this site, plus a record of your own cookie choice stored in your browser. We do not currently use analytics or advertising cookies. If we add any, they will be off until you switch them on.
Full details, including how to change your choice at any time, are in our Cookie Policy.
7. Who we share data with
We do not sell your personal data, and we do not share it for anyone else's marketing. We share it only with the service providers we need in order to run the site and the business. Each acts as our processor under a written contract that meets Article 28 of the UK GDPR.
| Provider | What they do for us | Where they process data |
|---|---|---|
| The Constant Company, LLC (trading as Vultr) | Hosting for this website and its server logs | Data centre in Singapore; company established in the United States |
| Cloudflare, Inc. | DNS, content delivery, TLS encryption, protection against denial-of-service attacks, and the bot-protection check on the enquiry form | United States and its global network, including servers in the UK and EU |
| Twilio Inc. (SendGrid) | Delivering enquiry-form notifications to our own mailbox | United States and the EU |
| Our email provider | Hosting the info@justjenius.com mailbox and its contents | United Kingdom / European Union |
We may also disclose personal data to our professional advisers (such as lawyers and accountants) where necessary, and to a public authority, regulator or court where we are legally required to do so. If our business is sold or reorganised, personal data may be transferred to the buyer, who would then be bound by this policy.
8. International transfers
Some of the providers listed above process personal data outside the United Kingdom — in particular our hosting provider, whose data centre for this website is in Singapore, and Cloudflare and Twilio, which are established in the United States. Neither Singapore nor the United States generally benefits from UK “adequacy” regulations.
Where we make such a restricted transfer, we put in place one of the safeguards permitted by Chapter V of the UK GDPR before doing so. In practice this means either:
- the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses (or the UK International Data Transfer Agreement), together with a transfer risk assessment; or
- where the recipient is certified under the UK Extension to the EU–US Data Privacy Framework, reliance on that certification.
You can ask us for a copy of the safeguards that apply to a particular transfer by emailing info@justjenius.com.
9. How long we keep data
We keep personal data only for as long as we need it, and then delete it.
| Data | Retention period |
|---|---|
| Enquiries that do not become a project | 24 months from our last contact with you, then deleted |
| Client project records and correspondence | 6 years from the end of the engagement (the limitation period for contract claims in England and Wales) |
| Accounting and tax records | 6 years, as required by the Companies Act 2006 and HMRC rules |
| Unsuccessful job applications | 6 months from the closing date |
| Right to work check documents | Duration of employment plus 2 years |
| Marketing consent and any withdrawal of it | Until you withdraw consent, and for 24 months afterwards so that we can honour your choice |
| Web server access logs | 30 days |
| Anti-abuse records for the enquiry form | 30 days |
| Your cookie preference record | 12 months, stored in your own browser |
10. How we keep data secure
- The whole site is served over encrypted HTTPS connections.
- The enquiry form is protected by a honeypot field, a timing check, a signed one-time token, rate limiting and a bot-protection challenge.
- Access to our systems and mailbox is restricted, individually credentialed and protected by multi-factor authentication.
- We collect the minimum data we need, and we do not take payment details through this site.
No transmission over the internet can be guaranteed completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it, and tell you directly where the law requires us to.
11. Your rights
Under the UK GDPR you have the right to:
- Be informed about how we use your personal data — which is what this policy is for.
- Access a copy of the personal data we hold about you.
- Rectification — have inaccurate data corrected and incomplete data completed.
- Erasure — ask us to delete your data where there is no good reason for us to keep it.
- Restrict processing — ask us to pause our use of your data while a question about it is resolved.
- Data portability — receive data you gave us in a structured, commonly used, machine-readable format.
- Object — object to processing based on our legitimate interests, and object at any time and absolutely to direct marketing.
- Withdraw consent at any time where we rely on consent.
To exercise any of these, email info@justjenius.com. We will respond within one month. That period can be extended by a further two months for complex requests, and we will tell you if that happens. There is no charge, unless a request is manifestly unfounded or excessive. We may ask you for information to confirm your identity before we act.
12. How to complain
If you are unhappy with how we have handled your personal data, please tell us first at info@justjenius.com so we have the chance to put it right. You also have the right to complain at any time to the UK supervisory authority:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — telephone 0303 123 1113 — ico.org.uk
13. Automated decision-making
We do not make decisions about you that produce legal or similarly significant effects using automated processing alone, and we do not carry out profiling. The bot-protection check on the enquiry form assesses whether a submission is automated, not who you are; if it wrongly blocks you, simply email us instead and a person will read your message.
14. Children
This website and our services are aimed at businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.
15. Changes to this policy
We review this policy regularly and will update it when our processing changes. The date at the top shows when it was last updated. Where a change is significant we will make that clear on this page.
Version 1.0 — last updated 19 August 2026.