Privacy Policy

Last updated: 3 November 2026

This policy explains what personal information DevArt Studio (“we”, “us”, “our”) collects through devartstudio.net and while working with clients, why we collect it, who we share it with and what rights you have. We try to collect only what we need to answer you and deliver your project.

1. Who We Are

DevArt Studio is a website design and development agency based in Pakistan, working with clients in the United States, the United Kingdom, Europe and elsewhere. For the purposes of the UK GDPR and the EU GDPR, DevArt Studio is the controller of the personal information described in this policy.

When we build or manage a website for a client, any visitor or customer data on that client’s site belongs to the client. In that case the client is the controller and we act on their instructions as a processor.

2. Information We Collect

  • Contact and quote forms: your name, email address, phone or WhatsApp number, company or business name, website address, the services or type of website you’re interested in, your budget range and any project details you write in the message box.
  • Emails, calls, WhatsApp and video calls: whatever you choose to share with us when you get in touch or join a discovery call.
  • Client projects: billing and invoice details, signed proposals, and the content, files and logins (hosting, domain, CMS) needed to build and support your website.
  • Shop and account pages: our site runs on WordPress with WooCommerce. At the moment our service pages send you to a quote form and we don’t take online payments. If you ever create an account or place an order on our site, WooCommerce stores the details you enter, such as your name, billing address, email, phone and order history.
  • Technical data: like most websites, our server keeps logs with your IP address, browser and device type, the pages you request and the date and time. We use these to keep the site secure and working.

We don’t ask for sensitive information such as health, religion or financial account passwords through our website. Please don’t send it to us.

3. How We Use It and Our Lawful Basis

If you are in the UK or the EU, the law requires us to tell you the legal reason for each use:

  • Replying to your enquiry and preparing a quote: steps taken at your request before entering into a contract.
  • Planning, building, launching and supporting your website: performance of our contract with you.
  • Invoicing and keeping accounting and tax records: legal obligation.
  • Keeping the site secure, blocking spam and improving our services: our legitimate interest in running a safe, working business. We have balanced this against your rights.
  • Sending news or offers: only with your consent, which you can withdraw at any time. We don’t currently send a newsletter.

We don’t sell your personal information, we don’t use it for targeted advertising, and we don’t make decisions about you using automated means alone.

4. Cookies

We only use cookies that are needed for the site to work: WordPress cookies for logged-in users and comments, WooCommerce cookies that remember a cart or session, and security cookies that help our forms block spam. These don’t need your consent under UK and EU rules.

We don’t currently use analytics or advertising cookies. If we add them (for example Google Analytics), we’ll update this policy and ask for your consent first where the law requires it. You can also block or delete cookies in your browser settings, although some parts of the site may stop working.

5. Who We Share Information With

We share personal information only with service providers that help us run the business, and only as much as they need:

  • Web hosting: our site and form submissions are stored with our hosting provider, Hostinger.
  • Email and communication tools: our email provider, WhatsApp (Meta) if you message us there, and video call tools such as Zoom or Google Meet if we meet online.
  • Fonts and scripts: our pages load fonts from Google Fonts and code libraries from cdnjs (Cloudflare). Your browser connects to these services, so they receive your IP address.
  • Payment providers: when you pay an invoice, the bank or payment service you use (for example a bank transfer or online payment service) processes your payment details under its own privacy policy. We never see or store full card numbers.
  • Third-party services for your project: with your agreement, we may pass details to domain registrars, hosting companies or plugin vendors to set up your website.
  • Legal reasons: if the law requires it, or to protect our rights in a dispute.

Our site links to our social media pages (Instagram, TikTok, YouTube). Those platforms have their own privacy policies.

6. International Transfers

We are based in Pakistan, and some of our providers are in the US and other countries. This means information you send us from the UK, EU or US will be handled outside your country, in places that may not have the same data protection laws. We transfer it because it’s needed to answer your request or carry out our contract with you, and where a provider offers them we rely on recognised safeguards such as Standard Contractual Clauses or the UK International Data Transfer Addendum.

7. How Long We Keep It

  • Enquiries that don’t lead to a project: up to 2 years, then deleted.
  • Client project files and correspondence: for the length of the project and any maintenance plan, then up to 2 years in case you need support.
  • Invoices and accounting records: up to 6 years, or longer if tax law requires it.
  • Logins you give us for your hosting or website: removed from our records once the project or maintenance period ends. We recommend you change those passwords at that point.
  • Server logs: kept for a short period set by our hosting provider, usually no more than a few months.

8. Your Rights (UK and EU)

You have the right to:

  • ask for a copy of the personal information we hold about you;
  • have inaccurate information corrected;
  • have your information deleted where we no longer have a reason to keep it;
  • ask us to restrict how we use it, or object to uses based on our legitimate interests;
  • receive information you gave us in a portable format;
  • withdraw consent at any time, where we rely on consent.

Email uzair@devartstudio.net to use any of these rights. We’ll reply within one month and won’t charge you. If you’re unhappy with how we’ve handled your information, you can complain to the Information Commissioner’s Office in the UK (ico.org.uk) or to the data protection authority in your EU country. We’d appreciate the chance to sort it out with you first.

9. California Residents (CCPA / CPRA)

If you live in California, you have extra rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. In the last 12 months we have collected these categories of personal information, from you directly and from your device when you visit our site:

  • Identifiers: name, email address, phone number, IP address.
  • Commercial information: services you asked about, quotes, invoices and payments.
  • Professional information: company name, website and job role, if you share them.
  • Internet activity: pages visited and browser information from server logs.

We use these for the business purposes described in section 3 and share them only with the service providers listed in section 5. We do not sell or share your personal information for cross-context behavioural advertising, and we don’t use or disclose sensitive personal information. We keep each category for the periods in section 7.

You have the right to know what personal information we collect, use and disclose; to ask us to delete it; to ask us to correct it; and to opt out of any sale or sharing (although we don’t sell or share it). We won’t treat you differently for using these rights. To make a request, email uzair@devartstudio.net or call +92 313 4548537. We’ll need to confirm your identity, usually by matching your email address or project details, and we’ll respond within 45 days. You can also ask an authorised agent to make a request for you, with your written permission.

10. Children

Our services are meant for businesses and adults. We don’t knowingly collect information from anyone under 16. If you think a child has sent us their details, please contact us and we’ll delete them.

11. Security

Our site runs over HTTPS, our forms include spam protection, and we limit access to client data and logins to the people working on your project. No system is completely secure, but we take reasonable steps to protect your information and will tell you and the relevant authorities about a serious breach where the law requires it.

12. Changes to This Policy

We may update this policy when our services or the law change. The date at the top shows when it was last updated. If the changes are significant, we’ll make that clear on this page.

13. Contact

For any privacy question or request, email uzair@devartstudio.net, call or WhatsApp +92 313 4548537, or write to DevArt Studio at [Company address].