How we handle your data.

This privacy policy explains what personal data LUXENESS Studio collects, how it is used, who it is shared with, and the rights you have under UK and EU data protection law.

LUXENESS Studio is based in the United Kingdom and works with clients in the UK and internationally, including the United States. This policy sets out our obligations under the UK GDPR and the Data Protection Act 2018. Depending on where you or your company are located, additional privacy or data protection laws may also apply to the information we hold about you. Where they do, we will meet those obligations alongside the ones described here. This website and the LUXENESS Studio services are operated by Iconic CEO Limited, a company registered in England and Wales (Company No: 12223405).

Iconic CEO Limited is the data controller for personal data collected through this website and in the course of enquiries, client records and our own business administration.

Iconic CEO Limited acts as data controller for personal data it determines is necessary to provide and administer the LUXENESS Studio service. In some engagements we may also process personal data on behalf of a client, for example where we are given access to client systems or to information relating to members of the client’s business, and process that information solely on the client’s documented instructions. Where Iconic CEO Limited acts as a processor, that processing is governed by the appropriate data processing terms in the engagement documentation. This policy covers the data we control. It does not replace the terms agreed with a client for the data we process on their behalf. If you have questions about this policy or how your data is handled, email Papillon Luck directly at papillon@papillonluck.com.

What we collect

The personal data we collect depends on how you interact with us.

If you enquire about working with us or book a call: your name, email address, phone number, the answers you submit through our enquiry form via Typeform, and your timezone and chosen call time via Calendly are collected.

If you go on to work with us: we collect the information needed to write and publish for you. This includes what you share in interviews, voice notes and messages, whether by email, WhatsApp or a recording app of your choice; content you have already written or said in public, such as posts, articles, interviews and podcasts; your LinkedIn profile and how your posts perform; and, where your plan includes it, publicly available professional information about the people you engage with or we suggest you connect with. What you share may include information about other people, such as colleagues, guests or business partners. We use it only to write for you, and anything confidential or commercially sensitive is left out of what is published. What we can access and how it is handled is set out in the letter of engagement.

If we record a session: with your knowledge, meetings may be recorded and transcribed so decisions, actions and context are captured accurately. Recordings, transcripts and the notes taken from them are used only to carry out the engagement. You can ask us not to record, or to exclude specific material, at any time.

If you email us directly: your email address and the content of the message.

Why we collect it and our lawful basis

We collect personal data only where there is a clear and lawful basis for doing so under UK GDPR.

• To respond to your enquiry and arrange a call. Lawful basis: legitimate interest.
• To deliver the professional services you engage us for. Lawful basis: performance of a contract.
• To handle information about other people that comes up in our work for a client, such as people mentioned in interviews and publicly available professional details of people we suggest a client connects with. Lawful basis: legitimate interest.
• To comply with legal obligations, including HMRC record-keeping requirements. Lawful basis: legal obligation.

Who we share data with

We use trusted third-party service providers to help operate our business and deliver our services. Where required, we put appropriate data protection terms in place with those providers. We do not sell your personal data to anyone.

International transfers

Several of the providers above may process personal data outside the UK, including in the United States. Where this involves a restricted transfer under UK data protection law, we rely on an applicable UK adequacy regulation or put in place an appropriate safeguard or other lawful transfer mechanism recognised under UK law.

How long we keep your data

• Enquiry and call booking data: retained for as long as needed to respond and, where relevant, to begin an engagement, then deleted when no longer required.
• Client and engagement records: retained for the duration of the engagement and for any period required to meet legal, accounting or tax obligations.
• Interviews, recordings, voice notes, transcripts and your second brain: retained for the duration of the engagement. When we stop working together, they are handed back to you or deleted, as you prefer, in line with the letter of engagement.
• Transaction records: retained for 7 years to comply with HMRC accounting requirements.
• Personal data on request to delete: removed within 30 days of a verified request, except where retention is legally required (for example, transaction records).

Your data protection rights

Under the UK GDPR you have the following rights regarding your personal data. If you are located elsewhere, you may have comparable or additional rights under the law that applies to you.

• The right to be informed about how we use your data, which this policy provides.
• The right of access to a copy of the personal data we hold about you.
• The right to rectification if any data we hold is inaccurate or incomplete.
• The right to erasure (the right to be forgotten), subject to legal retention obligations.
• The right to restrict processing in certain circumstances.
• The right to data portability for the data you have provided to us.
• The right to object to processing carried out on the basis of legitimate interest, including direct marketing.
• The right to withdraw consent at any time where processing is based on consent, without affecting the lawfulness of any prior processing.

To exercise any of these rights, email papillon@papillonluck.com. We will respond to legitimate requests within one month. Occasionally it may take longer if your request is particularly complex or you have made a number of requests, in which case we will notify you.

You will not have to pay a fee to access your personal data or to exercise any of the other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive, or refuse to comply with your request in those circumstances. We may also need to request specific information from you to confirm your identity before fulfilling a data request. This is a security measure to ensure personal data is not disclosed to anyone without the right to receive it.

Marketing communications

We do not add enquirers or clients to a marketing list. If you contact us, we use your details to respond to you and to conduct the conversation about a possible engagement. If we introduce marketing emails in future, we will do so only where we have the permission required and every message will carry a clear unsubscribe option.

Cookies

Our website sets one cookie, which records your response to the cookie banner. We do not use analytics, advertising, social media cookies or tracking pixels. Our Cookie Policy sets out the full detail, including the third-party services used by the site and the technical information they may receive.

Security

We take the security of your personal data seriously. Data is held in encrypted form by the processors we use. We select providers that maintain recognised information security standards and, where required, we put appropriate data protection terms in place with them.

Children

Our services are intended for adults aged 18 or over. By providing us with your data, you warrant that you are at least 18 years of age. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us with personal data, please contact us so we can delete it.

Complaints

If you have a complaint about how your data is handled, please contact us first at papillon@papillonluck.com and we will work to resolve it. You also have the right to lodge a complaint with a data protection authority. In the UK this is the Information Commissioner's Office (ICO), at ico.org.uk.

Changes to this policy

We may update this privacy policy from time to time, particularly when we add new tools or change how data flows through our systems. Any material changes will be reflected in the effective date below and, where required, we will notify affected individuals directly.