Privacy policy

This policy explains how 308 Studio (“we”, “us”) handles personal data when you use this website. It is written for the UK GDPR and the Data Protection Act 2018. It is not a substitute for advice from a solicitor or the ICO.

1. Who is the controller?

The data controller is the operator of 308 Studio, a UK marketplace for recording studios. The legal entity name, registered office, company number and ICO registration number (if required) will be published here when they are confirmed. Until then, privacy requests go to hello@308.studio.

2. What we collect

Booking requests

When you send a booking request we collect: contact email; optional name; studio (if selected); location; session type; preferred date or time; and any notes you add. That data is posted to our API, hosted on Cloudflare, and stored so we and the studio can respond.

Listing enquiries

When you list a studio we collect: studio name; city; contact email; and a message that includes room type, hourly rate and optional notes.

Browser session

If you use Sign in, we store your email, optional name and role (artist or partner) in your browser’s session storage so this device can open guest or partner tools. That data is not sent to the API as an account record.

Contact messages

The contact form opens your own email app. We only receive what you send to hello@308.studio.

Technical data

Cloudflare, which hosts the site and the API, will process standard request data such as IP address, browser type, date and time, and the pages requested. We do not run a separate analytics product on this site today.

We do not collect payment-card numbers. We do not ask for a phone number on these forms.

3. Why we use it (lawful bases)

• Contract (UK GDPR Article 6(1)(b)): to handle a booking request or listing enquiry you have submitted, and to reply.
• Legitimate interests (Article 6(1)(f)): to keep the site secure, prevent abuse, understand whether the API is reachable, and improve the marketplace. You can object — see section 8.
• Legal obligation (Article 6(1)(c)): if we must keep records for tax, accounting or a lawful request.
• Consent (Article 6(1)(a)): we do not send marketing emails from this site today. If we ever do, we will ask first, and you can withdraw consent at any time.

4. Who we share it with

• Studios. If you request a particular room, we share the details needed to confirm the session (typically name, email, time, session type and notes).
• Cloudflare, Inc. and Cloudflare Ltd. Hosting, DNS, security and the Worker that stores form submissions.
• Google Ireland / Google LLC. We load fonts from Google Fonts, which may see your IP address. See the cookie policy.
• Professional advisers or authorities where the law requires it, or to establish or defend legal claims.

We do not sell personal data.

5. International transfers

Cloudflare and Google may process data in the United Kingdom, the European Economic Area and the United States. Where a transfer of UK personal data goes outside the UK, we rely on the UK adequacy regulations where they apply, or on standard contractual clauses / the UK International Data Transfer Addendum used by those providers.

6. How long we keep it

Booking requests and listing enquiries are kept for as long as needed to handle the request and for a reasonable period afterwards (typically up to 12 months) so we can answer follow-ups and detect abuse, unless a longer period is required by law. Browser session data lasts until you close the tab or clear site data. Server logs follow Cloudflare’s retention for the product we use.

7. Security

Forms are sent over HTTPS to the API. Access to stored enquiries is limited to people who operate 308 Studio. No internet transmission is perfectly secure; please do not put passwords, card numbers or special-category data in notes fields.

8. Your rights

Under UK GDPR you can ask us to:

• access the personal data we hold about you;
• correct inaccurate data;
• erase data in certain cases;
• restrict or object to processing, including legitimate-interests processing;
• receive data you provided in a portable format where the right applies; and
• withdraw consent, where we ever rely on it.

Send requests to hello@308.studio with enough detail for us to find you (the email you used on the form is usually enough). We may need to verify it is you. You also have the right to complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/.

9. Children

The marketplace is aimed at adults. We do not knowingly collect data from anyone under 18 through booking or listing forms.

10. Automated decisions

We do not use automated decision-making that produces legal or similarly significant effects about you.

11. Changes

We will update this page when our practices change. The “Last updated” date is the version that applies.