Privacy Notice
Milk First Studio Ltd · Version 1.3 · effective 28 October 2026
This notice explains how we collect and use personal data, and the rights you have.
The short version
- We collect only what we need to provide our services, get paid and keep proper records.
- We don’t sell your data or use it for advertising.
- We don’t send marketing emails unless you’ve agreed, and you can opt out at any time.
- Our website doesn’t use analytics or advertising cookies.
- To see, correct or delete your data, email privacy@milkfirst.co.uk.
1. Who we are
Milk First Studio Ltd, trading as Milk First, is the controller of the personal data described in this notice.
- Company number 17506516, registered in England and Wales
- Registered office: 27 Flay Field, Tithebarn, Exeter, England, EX1 3YA
- Email: hello@milkfirst.co.uk; for data protection requests, privacy@milkfirst.co.uk
- ICO registration number: ZC279303
This notice covers:
- people who contact us;
- clients of our website services;
- clients of our Tech Help services;
- visitors to milkfirst.co.uk.
It doesn’t cover visitors to websites we build and run for our clients. For those, see section 7.
2. What we collect and why
People who contact us
- What: your name, email address, phone number, business name and your message.
- Why: to reply to you and, if you ask, prepare a quote.
- Legal basis: our legitimate interest in responding to enquiries, or steps you’ve asked us to take before entering into a contract.
- How long: 12 months after our last contact, if no work follows.
Website clients
- What: contact details; business details such as your business name, address, company number, Unique Taxpayer Reference (UTR) or VAT number; billing and payment records; our correspondence; the content you send us for your website; and logins we create for you.
- Why: to build, host and look after your website, invoice you and support you.
- Legal basis: performing our contract with you; and our legal obligation to keep accounting records.
- How long: for as long as our agreement lasts. After it ends, we delete your website, mailboxes and content within 30 days, as set out in our Website Terms. We keep invoices and payment records for 6 years after the end of the financial year they relate to, as required for tax purposes.
Tech Help clients
- What: contact details, booking details, the type of device and operating system, and short notes of what we did.
- During a Session: we can see your screen, but we don’t copy your files or record Sessions. We only look at what we need to fix the problem.
- Why: to provide the help you’ve booked, and to follow up or deal with any questions or complaints afterwards.
- Legal basis: performing our contract with you.
- How long: 2 years after your last Session. Invoices and payment records: 6 years after the end of the financial year they relate to.
Payments
- What: the details that come with your payment, such as your name, the amount, the date and your payment reference. If you pay through Stripe, we also see the business name and details you enter at checkout, and limited payment details such as the card type and last four digits, or the last digits of your bank account. We never see or store your full card number.
- Why: to match payments to invoices and keep accounts.
- Legal basis: performing our contract with you; and our legal obligation to keep accounting records.
- How long: 6 years after the end of the financial year they relate to.
Visitors to milkfirst.co.uk
- What: standard server logs kept by our hosting provider — IP address, browser type, pages requested and the time of the request.
- Why: to keep the website secure and working.
- Legal basis: our legitimate interest in running a secure website.
- How long: for a short period, then deleted automatically by our hosting provider.
News from us
- What: your name and email address.
- Why: to send occasional news about our services.
- Legal basis: your consent. If you’re already a client, we may email you about similar services we offer, and every email lets you opt out.
- How long: until you opt out.
We don’t use automated decision-making or profiling.
3. Who we share it with
We share personal data only with providers that help us run our business, and only as much as they need:
| Provider | What for | Where |
|---|---|---|
| Namecheap, Inc. | hosting websites, email and backups | data stored in a UK data centre |
| Wise Payments Limited | business banking and receiving payments | UK |
| Notion Labs, Inc. | client and project records | USA |
| Chrome Remote Desktop, our main tool for connecting Tech Help Sessions | Sessions are encrypted; Google’s servers don’t record them | |
| RustDesk relay servers | connecting Tech Help Sessions when Chrome Remote Desktop can’t be used | Sessions are encrypted; the relay doesn’t record them |
We may also share personal data with accountants or professional advisers we use, and with HMRC, courts or other authorities where the law requires it.
We never sell personal data.
4. International transfers
Most of the data we hold is stored in the UK. Some of our providers are based in the USA. Where personal data goes outside the UK, we make sure it’s protected as UK law requires — for example, under the UK–US data bridge for certified providers, or under the International Data Transfer Agreement or Addendum.
Our team may access data remotely from outside the UK. When they do, the data stays under our control, and the UK GDPR continues to apply.
5. How we keep it safe
We use strong passwords and two-step verification on our accounts, limit access to those who need it, use encrypted connections and keep our software up to date. Tech Help Sessions are started by you, are encrypted and aren’t recorded.
6. Your rights
You have the right to:
- ask for a copy of your personal data;
- ask us to correct it;
- ask us to delete it;
- ask us to limit how we use it;
- object to how we use it, including at any time to direct marketing;
- ask for the data you gave us in a format you can take elsewhere;
- withdraw your consent at any time, where we rely on it.
Some rights depend on the circumstances: for example, we must keep accounting records for 6 years even if you ask us to delete them.
To make a request, email privacy@milkfirst.co.uk. We’ll reply within one month. There’s usually no charge.
If you’re unhappy with how we’ve handled your data, please tell us first so we can try to put it right. You can also complain to the Information Commissioner’s Office: ico.org.uk, 0303 123 1113.
7. Websites we build for our clients
When we build and run a website for a client, the client is responsible for the personal data collected on it — for example, enquiries sent through its contact form. We handle that data only on the client’s behalf and under its instructions, as its processor.
If you’ve visited or contacted one of our clients’ websites, please read that website’s privacy policy and contact the business directly. If you contact us, we’ll pass your request on to them.
The same applies when we help a business through Tech Help: for personal data on that business’s devices, the business is responsible, and we act on its behalf.
8. Cookies on milkfirst.co.uk
Our website doesn’t use analytics or advertising cookies. If we ever add cookies that aren’t strictly necessary, we’ll ask for your consent first and update this notice.
9. Children
Our services are for adults and businesses, and we don’t knowingly collect personal data from children. When we help a household through Tech Help, a device may contain family members’ data; we only look at what we need to fix the problem.
10. Changes to this notice
We’ll update this notice when our services or the law change. The date at the top shows when it was last updated. If we make significant changes, we’ll tell our clients by email.