Privacy & Cookie Policy
Last updated: 15 October 2026
1. Who We Are
BAY CUSTOM STUDIOS LIMITED, trading as BAY Custom Studios (“we”, “us” or “our”), is responsible for the personal information covered by this policy. We are registered in England and Wales under company number 16058699 and act as the data controller.
This policy covers our website, enquiries, bookings, services, digital products, marketing and project work in the United Kingdom, France and remotely.
Email: info@baycustomstudios.com
Registered office: 23 Wood Lane, Wedges Mills, Cannock, Staffordshire, England, WS11 1SZ
2. Information We Collect
Depending on your contact with us, we collect:
• Contact and identity details, including your name, email, telephone number, billing address and organisation or representative details.
• Enquiry, booking and project details, including your requirements, dates, creative brief, feedback, correspondence and arrangements for studio visits or accommodation.
• Recordings and project material, including audio, images, video, file links, metadata and notes. These are personal information where they identify, or can be linked to, an individual.
• Purchase and administration records, including quotations, contracts, invoices, services or products purchased, extras, payment status, refunds, transaction references, terms acceptance and any request to start work during a cancellation period.
• Marketing preferences, subscription details, consent records and campaign responses.
• Website and device information, including IP address, browser and device details, approximate location, pages viewed, interactions, timestamps and cookie or similar identifiers.
We receive information directly from you, from people acting for you or involved in your project, and from the payment, communication and other service providers described below. We also collect technical information through our website and online advertising, subject to your choices where applicable.
If you supply another person’s information, make sure you are authorised to do so and share this policy with them where appropriate.
3. How & Why We Use Information
We use personal information for the following purposes and legal reasons:
• Enquiries, quotations, bookings and delivery: to understand your requirements, provide services or digital products, manage project files and communicate about the work. We rely on our contract with you or steps you request before a contract. For representatives and other project participants, we rely on our legitimate interests in coordinating and delivering the work.
• Payments and business records: to administer purchases, refunds, terms acceptance, start-time choices, accounts and taxes. We rely on contract, legal obligations and our legitimate interests in accurate, secure administration.
• Support, project continuity and disputes: to handle follow-up requests, maintain appropriate client records and establish or defend legal claims. We rely on contract, legal obligations and our legitimate interests in supporting clients and protecting legal rights, as applicable.
• Security and website operation: to maintain our systems, prevent fraud and misuse, and resolve technical problems. We rely on our legitimate interests in protecting the business and its users, and legal obligations where applicable.
• Marketing, analytics and advertising: to share relevant updates, understand website use and measure campaigns. We rely on consent where required, and otherwise on legitimate interests where the law permits, as explained below.
• Agreed portfolio material: to publish authorised credits, testimonials, images or audio. We rely on consent or, where appropriate, our legitimate interests in showcasing agreed work under a written licence. A licence does not remove your data-protection rights.
• Legal requirements: to meet legal obligations, including lawful requests from courts, regulators and other public authorities.
Before relying on legitimate interests, we consider the effect on your rights and interests. If you do not provide information needed for a quotation, contract or legal requirement, we may be unable to accept or complete your booking or purchase.
4. Sensitive Information & Young People
We do not routinely request sensitive personal information. If a visit, session or stay requires health, accessibility or dietary information, we explain why and collect only what is necessary. Where this is special-category information, we normally seek explicit consent; another legal condition may apply in an emergency or for legal claims. Please do not include sensitive information in a general enquiry unless we have requested it.
Our website and enquiry forms are not intended for children to use independently. If a project involves someone under 18, a parent, guardian or appropriately authorised adult should contact us. We collect only the information needed for the project and involve the appropriate adult where necessary.
5. Who We Share Information With
We share information only where reasonably necessary for the purposes in this policy. Recipients include:
• Squarespace, for website hosting, forms, mailing-list functions and related services. Form submissions are processed through the website and passed to us.
• Stripe, for online payments, security and transaction services. Card details go directly to Stripe; we do not receive or store your full card number or security code. We receive the customer, billing and transaction details needed to administer your purchase.
• Samply, for project uploads, private listening, feedback and delivery. This can involve contact details, project files and related notes, according to the project’s sharing settings.
• Zapier, to connect confirmed payments with project setup and service emails. This involves contact details, purchased items, payment status, order references and project-upload links needed for those tasks.
• Email, telephone, IT, cloud-storage, backup and file-transfer providers used to communicate with you and manage the work.
• Engineers, producers, musicians, technicians, accommodation personnel and other contractors involved in your project.
• Accountants, insurers, banks, legal advisers and public authorities where required or legally justified.
• Advertising, analytics and embedded-media providers, as described in Section 7.
• A prospective buyer or successor if the business is sold or reorganised, subject to appropriate confidentiality safeguards.
Providers acting on our behalf are subject to appropriate data-protection arrangements. Others, including payment, social-media and media-player providers, may also process information for their own purposes under their privacy policies. Visiting their websites or our social-media pages is subject to their own privacy and cookie controls.
6. Marketing & Service Emails
Booking confirmations, upload instructions, project updates and delivery emails are service messages. Buying from us or accepting our terms does not automatically subscribe you to our mailing list.
We send marketing where you have consented or where applicable law permits it, including:
• Updates about our own similar services after a sale or genuine sales enquiry, where we obtained your details directly and offered an opt-out both when collecting them and in every message.
• Relevant business-to-business communications based on legitimate interests, where permitted.
Marketing is optional. You can unsubscribe using the link in our emails or contact info@baycustomstudios.com. We stop direct marketing when you object, while retaining any minimum record needed to respect your choice. This does not stop necessary service messages.
If you contact us through social media or an advertising enquiry form, we use the information you provide to respond and manage any resulting booking. The platform also processes information under its own privacy terms.
7. Cookies & Embedded Media
Our website uses cookies and similar technologies to operate securely, remember choices, measure visits and support media playback and advertising. The technologies used depend on the page, enabled features, your account status with providers and your choices.
• Essential functions: Squarespace uses technologies for security and cookie preferences. Forms may use Google reCAPTCHA, which processes device and interaction information to prevent spam and abuse.
• Analytics: Squarespace Analytics helps us understand visits, traffic sources and website interactions.
• Advertising: Meta tools, and Google advertising tools where enabled, help measure campaigns and reach relevant audiences. They can process device identifiers and website activity, and associate this with information held by the provider.
• Embedded media: Spotify, Apple Music and YouTube receive technical and playback information when their players load or are used. Activity may be associated with your account if you are signed in. Providers may use it for their own service, analytics or advertising purposes.
Where consent is required, we ask for it before using the relevant technology. You can accept, reject or change optional cookie choices through our cookie controls. You can also delete or block cookies in your browser, although some features may stop working. Withdrawing consent does not affect earlier lawful processing.
Some cookies last only for a browsing session; others remain for a set period. Provider-published examples for the services described above include:
• Squarespace: cookie-consent choices are remembered for 30 days; analytics cookies last from 30 minutes to two years. Some interface preferences use persistent browser storage until cleared.
• Google and YouTube: durations vary by function. Examples include session cookies, six-month player identifiers and 13-month consent or advertising cookies in the UK and European Economic Area.
• Apple Music: its web-player identifier resets after one day; Apple retains associated player-activity information for up to two years. Signed-in playback is also covered by Apple’s subscriber privacy information.
• Meta and Spotify: durations depend on the particular cookie, feature and account settings; their provider information explains the applicable technologies and controls.
These are examples, not a statement that every listed cookie is used on every visit. The provider information below gives further detail on their data use and cookie controls.
Squarespace Cookies
Meta Cookies
Google & YouTube Cookies
Spotify Cookies
Apple Music Web Player Privacy
8. International Transfers
Our operations and service providers can involve processing in the United Kingdom, the European Economic Area and other countries, including the United States. Where a transfer is restricted by data-protection law, we use the applicable UK or European adequacy arrangements, approved contractual safeguards or another lawful transfer mechanism, with additional protections where necessary.
Contact info@baycustomstudios.com for details or a copy of the safeguards relevant to your information.
9. How Long We Keep Information
We retain information only while there is a necessary and lawful reason. For enquiries, bookings, contracts and correspondence, we consider the purpose, sensitivity, ongoing client relationship, reasonably anticipated work and applicable legal or claims periods. Information no longer needed is securely deleted or anonymised.
Financial, tax and accounting records are normally kept for at least six years from the end of the last company financial year they relate to. Longer periods can apply where required by law, where transactions span more than one accounting period, or while an enquiry, claim or investigation remains unresolved. Particular records may need to be kept longer under French law.
Our standard minimum operational retention periods for project files are:
• Raw recordings, session files and working versions: normally retained for at least 90 days after final delivery or completion of the relevant project, whichever is later.
• Approved final masters and other final deliverables: normally retained for at least 12 months after final delivery or completion of the relevant project, whichever is later.
After these periods, files may be securely deleted without further notice. We may keep them longer for a continuing lawful purpose, including revisions, ongoing client work, queries, legal obligations or claims, agreed portfolio use or a written storage agreement. Extended retention is reviewed periodically and is not guaranteed.
Unless agreed in writing, we do not provide a permanent archive or backup service. Please promptly download, check and securely back up your files.
• Marketing records: until you opt out or they are no longer needed, with periodic reviews of inactive contacts. We retain the minimum suppression record needed to honour an opt-out.
• Sensitive practical information: deleted or anonymised when no longer needed, unless an incident, claim or legal obligation requires retention.
• Cookie and related information: for the relevant technology’s lifespan or provider retention period, as described in Section 7 and the linked provider information.
Deleted information may remain in protected backups until the normal deletion or overwrite cycle, isolated from routine use unless legally required. Genuinely anonymised information may be kept longer. All retention remains subject to applicable data-protection rights and legal obligations.
10. Security
We use appropriate technical and organisational safeguards and limit access to people who need information for their work. No online service or storage system is completely secure. Use the agreed transfer method for project files, and do not put passwords or sensitive material in a general enquiry form.
11. Your Rights & Complaints
Depending on the circumstances and applicable law, you can request access to your information, correction, deletion, restricted processing, or a portable copy or transfer of your data. You can also object to processing based on legitimate interests and withdraw consent without affecting earlier lawful processing.
Your right to object to direct marketing is absolute. For other legitimate-interest processing, we will stop unless we have overriding lawful grounds or need the information for legal claims. Other rights are subject to their legal conditions.
To exercise a right or raise a privacy complaint, email info@baycustomstudios.com or write to our registered office. We may need to verify your identity and will respond to rights requests within the applicable legal timescale. We acknowledge data-protection complaints within 30 days, investigate without undue delay, keep you informed and explain the outcome.
We do not make solely automated decisions about you that have legal or similarly significant effects. Advertising providers may use automated profiling as described in Section 7.
You may complain to the UK Information Commissioner’s Office (ICO). Where EU data-protection law applies, you may complain to the authority where you live or work, or where the alleged infringement occurred. In France, this is the CNIL.
12. Changes To This Policy
We review this policy when our practices or legal requirements change. The current version and date appear on this page. We provide additional notice of material changes where required by law.