1. Who we are
Scarfi Media is a trading name of Scarfi Media Ltd, a company registered in England and Wales under company number 17204021. Our registered office is at 132 Cwrt Celyn, Cwmbran, NP44 3FB. We operate the website scarfimedia.com and design, build, host, and maintain websites for small businesses and organisations in the United Kingdom. For the purposes of data protection law, we are the data controller of your personal information.
2. What information we collect
We collect a small amount of information, and only when it’s needed for something specific:
- When you use the contact form — your name, email address, the name of your business or club (optional), which audience category best describes you, and the message you choose to send. Nothing else.
- When you visit the site — first-party analytics from our own cookieless analytics beacon (no third party). It records pageviews, referrers and approximate device data without persistent identifiers.
- When you email us directly — whatever information you choose to include in your email.
- When you become a client — the additional information needed to deliver and invoice the work: company details, billing information, the content and assets you share with us, and any access credentials you provide for integrations.
3. How we use it
We use personal data for the following purposes only:
- Replying to enquiries and following up on potential projects.
- Delivering the service you’ve engaged us for.
- Sending invoices and project-related communications.
- Understanding aggregate site usage so we can improve the content and structure of the site.
- Meeting our legal and accounting obligations (e.g. tax records).
We do not sell, rent, or share your data with third parties for marketing purposes, and we don’t add anyone to a mailing list without explicit opt-in.
4. Legal basis for processing
Under the UK GDPR we rely on the following lawful bases:
- Contract, or steps taken to enter into one — for handling enquiries and delivering client work.
- Legitimate interests — for understanding anonymous, aggregate site usage. We’ve assessed that this doesn’t override anyone’s rights because the data is not personally identifiable.
- Legal obligation — for keeping records HMRC requires.
5. Who we share information with
Personal data is only shared with service providers we use to run the studio. Each is bound by their own data processing terms:
- Resend — handles delivery of email sent from the contact form to our inbox.
- ImprovMX — forwards email sent to
hello@scarfimedia.comto our personal inbox. - Vercel — hosts the website and runs the serverless function that processes contact-form submissions.
- Our accountant and HMRC — only for the financial information they need to do their jobs.
Site analytics are first-party and stay on infrastructure we control — they are not shared with any third party. We don’t use advertising or marketing trackers, social pixels, or behavioural retargeting tools.
6. International transfers
Some of our service providers are based in the United States or process data on US-based servers (notably Resend and Vercel). Where personal data is transferred outside the UK, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or another mechanism approved by the Information Commissioner’s Office (ICO).
7. How long we keep your information
Retention periods we apply:
- Contact form submissions — kept for up to two years from receipt, then deleted.
- Client project files — kept for the duration of the engagement plus seven years afterwards, to meet HMRC record-keeping requirements.
- Email correspondence — kept for as long as it’s relevant to the relationship; pruned periodically.
- Analytics data — aggregated and retained for up to thirteen months; raw events purged on a rolling basis.
8. Cookies and analytics
This website uses only the cookies strictly necessary to make the site work (e.g. remembering your preferences in the contact form during a session). We do not use advertising cookies, third-party trackers, or session-replay tools.
Our analytics are first-party: a cookieless analytics beacon we run ourselves (no third party). It records pageviews, referrers and approximate device data without persistent identifiers, so we can see anonymous patterns of which pages get read most often without ever being able to identify individual visitors.
9. Your rights
Under UK GDPR you have the following rights:
- Access — ask for a copy of the personal data we hold about you.
- Rectification — ask us to correct anything that’s wrong.
- Erasure — ask us to delete data we no longer need.
- Restriction — ask us to limit how we use your data while a query is resolved.
- Portability — ask for your data in a portable format you can move elsewhere.
- Objection — object to processing we carry out on the basis of legitimate interests.
- Withdraw consent — where we rely on your consent, you can withdraw it at any time.
To exercise any of these rights, email hello@scarfimedia.com. We aim to respond within one working day and complete most requests within thirty days at the outside.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you’re unhappy with how we’ve handled your data — though we’d appreciate the chance to put things right first.
10. Changes to this policy
We may update this policy from time to time as the studio evolves or as the law changes. Any material change will be reflected in the last updated date at the top, and where the change is significant we’ll flag it before it takes effect.
11. Contact us
For any privacy questions, requests, or concerns, please email hello@scarfimedia.com.