UK Privacy Notice
Contents
Who we are
Rhytmelo Designs is a sole proprietorship of Asha Tyagi, registered in India (GSTIN 09AESPT6631C1Z3). Registered office: 362, Near Peer Wali Gali, Muzaffarnagar, Uttar Pradesh 251001, India. We are the controller of the personal data described here. The UK GDPR applies to us because we offer our services to people in the UK.
UK representative
Our UK representative under Article 27 of the UK GDPR is Aashwit Tyagi, gdpr@rhytmelo.com.
What we collect
- Your name, work email, phone number, company name and store URL.
- Messages, call notes and, where a call is recorded, the recording and transcript.
- Order and payment records. Card details are handled by Razorpay; we never see them.
- When you visit: your IP address and browser and device details, used to deliver and secure the site and show prices for your country.
- If you allow it: how you use the site (Google Analytics, Microsoft Clarity and Contentsquare, including session recordings in which what you type into forms is hidden), and which ad or company brought you here (Google Ads, Meta, Apollo.io, HubSpot).
- If you allow it: a hashed copy of your email and phone sent to Meta when you send a sales form, including the free audit form (see section 04).
- A record of your cookie choice: a random ID, what you chose, when and on which page. It doesn’t include your name, and we don’t add your IP address to it.
- When we work on your Shopify store, we may see your customers’ data. We handle it only as your processor, under our contract.
Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Preparing and emailing the free audit you ask for | Steps you ask us to take before a possible contract |
| One follow-up email about our paid services | Legitimate interests (telling you about a service related to your request); opt out any time |
| Quoting, contracting, delivering and invoicing a sprint | Performance of a contract |
| Running and securing the site, and showing UK prices | Legitimate interests |
| Analytics and advertising cookies | Consent, through our cookie settings |
| Sending Meta a hashed copy of your email and phone when you send a sales form, including the free audit form, to measure our ads | Consent, given in our cookie settings or by ticking the box on the form; withdraw any time |
| Company identification by Apollo.io | Consent, through our cookie settings |
| Contacting businesses we haven’t heard from (section 05) | Legitimate interests; you can object any time |
| Keeping a record of your cookie choice | Legal obligation (to show consent) |
| Tax and accounting records | Legal obligation |
| Further marketing emails | Your consent, or for corporate email addresses legitimate interests (as PECR allows), always with an unsubscribe link |
Hashing hides your actual email and phone, but Meta can still use the code to recognise you if you have a Meta account, so it is still personal data. We send it only if you have accepted marketing cookies or ticked the box on the form, and never if your browser sends Global Privacy Control. You can withdraw at any time in Cookie settings or by emailing gdpr@rhytmelo.com; we then stop sending new records.
If we contact you first
We may find business contact details (name, job title, work email, company) through business-data providers such as Apollo.io and public professional sources, and email you about our services on the basis of our legitimate interests. We email only company addresses, not sole traders or partnerships, unless they have asked to hear from us. Every email says where we got your details and has an unsubscribe link; you can object at any time and we will stop.
International transfers
We are based in India and collect your details directly from you, so the UK GDPR applies to us directly; sending us your own details is not a restricted transfer. Where a UK organisation sends us personal data, we protect the transfer with the ICO’s International Data Transfer Agreement or the UK Addendum. When we pass your data to service providers outside the UK, we do so under their data processing terms, which we have accepted and which include the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as each provider’s terms provide. Some US providers are also certified under the UK Extension to the EU–US Data Privacy Framework; that certification is the provider’s own. Ask gdpr@rhytmelo.com for details.
How long we keep it
- Leads who don’t become clients: our systems delete the enquiry records automatically within 12 months; copies in our email and team messages are kept no longer than we need them.
- Client and contract records: 8 years after the end of the financial year, for tax.
- Google Analytics data: 14 months.
- Session recordings: up to 30 days in Microsoft Clarity (a small sample and any we save for up to 9 months) and 1 month in Contentsquare.
- Records of your cookie choice: 2 years.
- Cookies: as set out in our cookie policy.
Access is limited to our team members who need it, and we use two-factor authentication on our accounts where available.
Your rights
You can ask to see, correct, delete or restrict your data, object to its use, or move it, and you can withdraw consent at any time. Email gdpr@rhytmelo.com and we will reply within one month (we may extend this by two months for complex requests, and will tell you why). You don’t have to give us your data, but we can’t send an audit or a quote without your email. We don’t make decisions about you by automated means alone.
You may also complain to the UK Information Commissioner’s Office (ico.org.uk, 0303 123 1113). We’d appreciate the chance to help first.
Updates
Version 2.0, 25 Oct 2026. Earlier versions stay readable below.