Untapped LLC ("Untapped", "we", "us") is a design studio formed under the laws of the State of Wyoming, United States. We are the data controller for the personal data described in this policy.
| Legal name | Untapped LLC |
|---|---|
| Wyoming Filing ID | 2022-001152420 |
| Registered address | 30 N Gould St Ste N, Sheridan, Wyoming 82801, United States |
| Privacy contact | contact@untappedhq.com |
For privacy enquiries, email contact@untappedhq.com.
2.1 This policy covers personal data we handle as a controller: that is, where we decide why and how it is used. In practice that means visitors to untappedhq.com, people who contact us, our clients and their staff, our suppliers and subcontractors, and anyone who applies to work with us.
2.2 It does not cover personal data we process on behalf of a client as part of a project. That is addressed separately in section 12.
2.3 It does not cover third-party websites we link to, such as Dribbble, Behance, Instagram, LinkedIn or Uplabs. Those services have their own privacy policies and we have no control over them.
This website is a set of static pages. Nothing on it asks you to submit personal data.
Like effectively every web server, our hosting provider automatically records a standard server log entry for each request: your IP address, the date and time, the page requested, the HTTP status returned, the referring page and your browser's user-agent string. These logs exist for security and diagnostics. We do not use them to build a profile of you, and we do not combine them with any other data about you.
The "Get in touch" link on our home page opens your own email program. When you email us we receive your email address, your name if you give it, and whatever you choose to put in the message and its attachments. Please do not send us sensitive information by email unless we have agreed a secure way to do so.
If you engage us, or ask us to quote, we hold the business contact details of the people we deal with (name, job title, email address, telephone number), the company's billing details and registered address, correspondence about the project, project materials you send us, and records of invoices and payments.
We hold contact, contractual and payment details for the freelancers and suppliers we work with. If you send us a portfolio or an enquiry about working together, we hold what you send us for as long as it is relevant.
Clients pay by bank transfer to the account shown on the invoice, so we hold no payment card details at any point.
4.1 This website does not set any cookies and stores nothing on your device.
4.2 We run no analytics or advertising products on this site, and no session recording, heat mapping or fingerprinting.
4.3 The pages do load a small number of static files from third-party content delivery networks, which is how the site gets its typeface, its icons and its JavaScript library:
| fonts.googleapis.com | Google Fonts, which supplies the Roboto typeface used across the site. |
|---|---|
| cdnjs.cloudflare.com | Cloudflare cdnjs, which supplies the Font Awesome icon stylesheet. |
| code.jquery.com | Supplies the jQuery library used for the page's small interactive touches. |
4.4 When your browser fetches those files, the operator of each service necessarily receives your IP address, your user-agent string and the address of the page you were viewing, because that is inherent in making an HTTP request. They do not set cookies through these requests and we receive nothing back from them about you. Their handling of that connection data is governed by their own privacy policies.
4.5 If you would rather block these requests entirely, a content blocker or a browser configured to block third-party requests will do so. The site remains readable, though the typeface and icons will fall back to your system defaults.
4.6 If we ever introduce analytics or any other technology that stores information on your device, we will update this policy and, where the law requires it, ask for your consent before it runs.
Where the EU or UK General Data Protection Regulation applies to our processing, we rely on the following legal bases.
| To answer your enquiry and prepare a proposal | Steps taken at your request before entering a contract, and our legitimate interest in responding to people who approach us. |
|---|---|
| To deliver a project and manage the client relationship | Performance of a contract with you, or our legitimate interest in performing our contract with the organisation you work for. |
| To invoice, take payment and chase overdue amounts | Performance of a contract, and our legitimate interest in being paid. |
| To keep accounting, tax and corporate records | Compliance with a legal obligation. |
| To keep our website and systems secure | Our legitimate interest in preventing abuse, fraud and unauthorised access. |
| To show completed work in our portfolio | Our legitimate interest in demonstrating our work, exercised in line with the portfolio permission in our Terms & Conditions, which you can withdraw at any time. |
| To establish, exercise or defend legal claims | Our legitimate interest in protecting our legal position. |
Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and we have concluded it is not. You can object at any time (see section 10).
6.1 We do not sell personal data or share it for anyone else's marketing.
6.2 We share it only with the service providers we need in order to operate, each acting on our instructions under a contract:
| Google Workspace | Email, calendar and document storage for our @untappedhq.com accounts. |
|---|---|
| Our web hosting provider | Serving this website and holding its server logs. |
| Accountants and bookkeepers | Preparing accounts and tax filings. |
| Banks and payment providers | Receiving payment and meeting financial regulatory requirements. |
| Subcontractors and freelance specialists | Where they work on your project, bound by confidentiality obligations. |
| Professional advisers | Lawyers and insurers, where we need advice or need to protect our position. |
| File sharing and project tools | Where we use them to collaborate with you on a project. |
6.3 We may also disclose personal data where we are required to by law, court order or a regulator; where necessary to establish, exercise or defend legal claims; or to a buyer or successor in connection with a merger, reorganisation or sale of our business, in which case this policy will continue to apply to it.
7.1 Untapped LLC is incorporated in Wyoming, United States. Our service providers operate internationally. This means personal data may be transferred to, stored in and accessed from countries outside your own, including the United States.
7.2 Some of those countries have not been assessed by the European Commission or the UK government as providing an equivalent level of data protection. Where we transfer personal data out of the European Economic Area or the United Kingdom, we rely on an appropriate safeguard recognised by applicable law, in most cases the European Commission's Standard Contractual Clauses, or the UK International Data Transfer Addendum, incorporated into our agreement with the relevant provider.
7.3 You can ask us for details of the safeguard applying to a particular transfer by writing to contact@untappedhq.com.
8.1 We keep personal data only as long as we need it for the purpose we collected it for, or as long as the law requires.
| Enquiries that do not become projects | Up to 24 months from the last contact, then deleted. |
|---|---|
| Client project records and correspondence | For the duration of the engagement and 6 years afterwards, to cover warranty, limitation and dispute periods. |
| Invoices and accounting records | As required by applicable tax and company law, generally at least 7 years. |
| Website server logs | As retained by our hosting provider, typically a matter of weeks. |
| Portfolio material | Indefinitely, unless permission is withdrawn under our Terms & Conditions. |
8.2 When a retention period ends we delete the data or irreversibly anonymise it. Backups are overwritten on their normal cycle.
9.1 We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include serving this website over HTTPS, multi-factor authentication on our email and business accounts, encrypted devices, access limited to those who need it, and confidentiality obligations on everyone we work with.
9.2 No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Email in particular is not a secure channel; tell us if you need a more secure way to send something.
9.3 If a personal data breach occurs that is likely to result in a risk to people's rights and freedoms, we will notify the relevant supervisory authority and, where required, the individuals affected, within the timeframes the law sets.
10.1 Depending on where you live, you may have some or all of the following rights over the personal data we hold about you:
10.2 To exercise a right, email contact@untappedhq.com. We will respond within one month. If a request is complex we may extend that by up to two further months and will tell you if we do. There is no charge unless a request is manifestly unfounded or excessive.
10.3 We may need to verify your identity before acting, to make sure we do not disclose your data to someone else.
11.1 If you are a California resident, the California Consumer Privacy Act as amended gives you the right to know what personal information we collect and why, to request a copy of it, to request its deletion, to request correction of inaccurate information, and not to be discriminated against for exercising those rights.
11.2 The categories of personal information we collect are described in section 3: identifiers such as name and email address, commercial information such as project and payment records, and internet activity limited to the server logs described in clause 3.1. The sources, purposes and recipients are set out in sections 3, 5 and 6.
11.3 We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months. Because we do not, there is no "Do Not Sell or Share My Personal Information" mechanism to offer.
11.4 We do not collect or process sensitive personal information for the purpose of inferring characteristics about you.
11.5 To exercise a California right, email contact@untappedhq.com. You may use an authorised agent, in which case we will ask for proof of their authority.
12.1 A project may involve us handling personal data that belongs to a client, for example user research participants, usability test recordings, analytics exports or content from a client's own systems. In that situation the client is the controller and we act as a processor.
12.2 When we act as a processor we only use the data on the client's documented instructions, we keep it confidential, we apply appropriate security measures, we do not engage a sub-processor without the client's authorisation, we assist the client with data subject requests and breach notification, and we return or delete the data at the end of the engagement.
12.3 Where applicable law requires it, we enter into a data processing agreement with the client setting these obligations out in full.
12.4 If you took part in research we ran for a client and you want to exercise a right over your data, contact that client. If you contact us instead, we will pass your request on and tell you we have done so.
Our services are directed at businesses and adults. We do not knowingly collect personal data from children under 16. If you believe a child has given us personal data, contact us and we will delete it.
We may update this policy to reflect changes to our practices or to the law. The date at the top shows when it was last revised. If a change materially affects how we use personal data we already hold, we will take reasonable steps to tell affected people directly.
For questions about this policy or to exercise a privacy right, email contact@untappedhq.com.
Untapped LLC
Registered address: 30 N Gould St Ste N, Sheridan, Wyoming 82801, United States
Email: contact@untappedhq.com
Please raise a concern with us first. We would rather fix it directly. You also have the right to complain to a data protection authority. In the European Economic Area or the United Kingdom, that is the supervisory authority in the country where you live, where you work, or where the issue arose.