Privacy Policy - The Low Studios
Last updated: 21 October 2026
The Low Studios respects the privacy of its clients, residents, visitors and anyone who contacts us. This policy explains what personal information we collect, why we use it, how we store it and your rights under UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended.
1. Who we are
The Low Studios is an independent recording studio operated by Frankie Worrall as a sole trader. Frankie Worrall trading as The Low Studios is the data controller responsible for the personal information described in this policy.
Email: bookings@thelowstudios.co.uk
Website: https://www.thelowstudios.co.uk
2. Information we collect
Depending on your interaction with the studio, we collect:
• Enquiries and communications: Names, contact details, social media usernames and relevant messages exchanged through email, our website, social media or messaging services.
• Bookings and services: Contact details, booking dates, service requirements, agreements, invoices, payment records and related correspondence.
• Studio residencies: Signed agreements, contact details, addresses, identity-verification documents, payment and deposit records, access arrangements and relevant correspondence.
• Access and security: Access credentials and, where generated by our access system, records of use linked to particular users; CCTV images and doorbell recordings as described in section 4.
• Session materials: Audio recordings, identifiable voices, project files, mixes and related materials supplied or created when providing studio services.
• Incident records: Relevant correspondence, photographs, CCTV extracts and other information necessary to document and investigate incidents, damage, security concerns or disputes.
• Website information: Information submitted through website forms and technical information processed through our website host, such as IP addresses, browser and device information and page requests. Cookie-based information depends on the features enabled and your choices, as explained in section 8.
We collect information directly from you, through your use of the premises and our systems, and where relevant from someone arranging a session on your behalf. Incident information may also be supplied by residents, visitors, witnesses, insurers or authorities. We aim to collect only what is necessary for the relevant purpose.
3. Why we use information and our lawful bases
Contract: We use information to take steps at your request before entering into a booking or residency agreement, provide agreed studio services, deliver session materials, administer payments and deposits, and manage your residency. This applies where the processing is necessary for our agreement with you.
Legitimate interests: We use information to respond to general enquiries, communicate with people involved in bookings, administer and protect the business, verify residents’ identities, manage access, undertake proportionate security checks, investigate incidents, and establish, exercise or defend legal claims. We also use limited information for administrative assistance through AI tools, as explained in section 6, and retain relevant working files for reasonably anticipated follow-up work.
Our interests include protecting the premises, equipment and belongings; maintaining a safe environment; communicating effectively; providing continuity of service; and handling disputes fairly. We consider these interests alongside the rights and reasonable expectations of the people concerned. Legitimate interests is the basis for our use of CCTV and related security recordings.
Legal obligation: We process information to meet applicable legal requirements, including keeping required tax and financial records and responding to legally binding requests for disclosure.
Consent: Where a separate activity requires consent, we will explain that activity and how to withdraw consent when requesting it. This includes cookies where consent is required. Entering the studio or accepting an agreement is not treated as consent to CCTV recording.
Certain contact, booking, payment and residency information is necessary to arrange and administer our services. We will explain which information is required when collecting it. If necessary information is not provided, we may be unable to proceed with the service or residency.
We do not sell or rent personal information. We do not use booking, residency or incident information for unrelated marketing.
4. CCTV and studio security
We use Ring security cameras, including an internal studio camera and an external video doorbell, to protect the premises, equipment and belongings, maintain safety and investigate incidents.
Recording and review
• Inside the studio: Video recording is enabled and audio recording is disabled. Images may be captured while the studio is occupied as well as when it is unoccupied.
• At the entrance: The video doorbell supports two-way communication, including assisting people who need help gaining access. Audio is enabled for this function and doorbell recordings may contain sound. We do not use this audio for routine monitoring of conversations.
• Signage: Signs inform residents and visitors about the cameras and provide a way to obtain further information. Entrance signage also identifies audio recording.
We may review footage following suspected damage, theft, unauthorised access, safety concerns or other relevant incidents. Occasional, limited checks may also be undertaken where necessary to verify authorised access, permitted occupancy, safe use of the premises and equipment, and compliance with studio rules relating to these matters. This applies to residencies and dry-hire bookings.
Checks are limited to what is necessary and proportionate for the relevant purpose. The system is not used for continuous watching of individual residents or clients, or routine assessment of their creative work.
Storage and retention
Both the Ring cameras and video doorbell are configured to retain routine recordings for 30 days before automatic deletion. This period allows time for incidents to be discovered and reported between studio visits.
Relevant extracts may be downloaded and kept longer for a specific incident, complaint, insurance matter, access request or legal claim. They are stored securely, reviewed as the matter progresses and deleted when no longer necessary.
Access to the studio’s camera account and separately retained footage is restricted to the studio operator, subject to the limited disclosures below and the processing necessary for Ring to provide its service.
Disclosure and access requests
Footage is not routinely shared with residents or clients. Where necessary and lawful, relevant footage may be disclosed to police or other authorities, insurers, professional advisers, people directly involved in an incident, or parties involved in a relevant legal claim.
We limit disclosure to what is necessary and consider the privacy of others, including whether footage should be cropped, redacted or otherwise restricted.
You can request access to footage containing your personal information using the contact details in section 1. Providing the approximate date, time and location helps us identify it before routine deletion. Other people’s privacy rights may affect what can be provided.
5. Storage, security and service providers
We use digital services to operate the studio. These include:
• Google Gmail and Google Drive: Email communications, documents, agreements, residency administration and secure storage, including identity-verification copies.
• Ring: Camera and doorbell operation, live communication and recording storage.
• Squarespace: Website hosting, website forms and associated technical services.
• OpenAI’s ChatGPT: Limited administrative assistance, as described in section 6.
• Other necessary providers: Banking and payment services, electronic signature services, messaging platforms, file delivery and storage services, and professional advisers where relevant.
We take appropriate technical and organisational measures to protect information against unauthorised access, loss, disclosure or misuse. Access is restricted to people who need it for an authorised purpose. We use account and device security controls and limit the information shared with each service.
Providers may process information on our behalf under their applicable data-processing terms. Some also act as independent data controllers for particular activities, such as their own account administration, fraud prevention or legal obligations. Their privacy notices explain those activities; they do not replace our responsibilities for information we collect and disclose.
International processing
These services may store or process information outside the UK, including in the United States, the European Economic Area and other countries in which they or their suppliers operate.
Where the UK recognises the destination or recipient as providing adequate protection, transfers may rely on UK adequacy regulations. This includes eligible transfers to certified US organisations covered by the UK Extension to the EU–US Data Privacy Framework. Other transfers require appropriate safeguards, such as approved standard contractual clauses with the UK International Data Transfer Addendum, or another lawful transfer mechanism.
The arrangements differ by provider, service and destination. Our providers publish further information through their own privacy and data-protection information.
Please contact us for further information about the arrangements applicable to your information, including how to obtain a copy of relevant contractual safeguards, subject to necessary redactions.
6. Use of AI tools
We may use AI tools, including OpenAI’s ChatGPT, to help draft or improve correspondence, summarise relevant information, organise administrative work and consider responses to booking, residency or studio-management issues.
This may involve processing limited extracts of relevant correspondence or descriptions of an issue. We minimise the personal information included and remove names, contact details and other identifying details wherever possible. We do not submit identity-document copies, payment credentials or security access codes for these purposes.
We review AI-assisted communications before sending them and verify information before relying on it. Decisions about bookings, access, deposits, complaints and residency matters remain with the studio operator. We do not make decisions with legal or similarly significant effects based solely on automated processing.
AI providers process submitted information under the terms and privacy controls applicable to the service used. We assess the suitability of those arrangements before sharing personal information. We retain necessary final correspondence or decisions in the relevant studio records and remove temporary working material when it is no longer needed.
You can contact us with questions or objections about the use of your personal information in AI-assisted administration.
7. Session recordings and project files
We process recordings, session files, mixes and related materials to provide and deliver agreed services. These materials may contain identifiable voices or other personal information.
Clients are responsible for downloading and retaining their own copies of delivered materials. Continued storage by the studio is not guaranteed.
We may retain working files after delivery for reasonably anticipated revisions, alternative versions or follow-up work. Retention depends on the project, ongoing client relationship, expected follow-up work and storage capacity. We review whether the files remain necessary rather than keeping them indefinitely simply because storage is available.
You may request deletion of files containing your personal information. Requests are considered alongside applicable legal obligations, ongoing contractual requirements and the rights of other people involved in the material.
8. Website and resident group communications
Our website is hosted by Squarespace. It processes technical information necessary to deliver and secure the website. Information you submit through website forms is used to respond to your request and administer the relevant service.
Cookies and similar technologies may support essential website functions and, where enabled, analytics or embedded content. Where consent is required, optional technologies should only operate after you agree. Details of enabled technologies, their purposes and durations, and available choices are provided through the website’s cookie information and consent controls. You can also manage cookies through your browser.
Where residents choose to join a studio WhatsApp group, their phone number and profile information, depending on their settings, are visible to other members. Groups support residency communication, including session swaps. Residents can contact the studio directly if they prefer not to join.
9. How long we keep information
We keep personal information for as long as necessary for its purpose. The criteria below apply to information held in email, messages, documents and other systems; an inbox is not exempt from retention review.
• General enquiries: Until the enquiry and reasonable follow-up have concluded. We consider whether a booking is anticipated, the correspondence remains relevant to an ongoing relationship, or a complaint or dispute requires preservation. Unneeded correspondence is deleted during retention reviews.
• Booking and service records: For the service and necessary follow-up, and afterwards where relevant to payment, complaints or potential contractual claims. We consider the applicable claim time limits and retain only the material necessary for those purposes.
• Tax and financial records: Normally at least five years after the relevant tax year’s 31 January Self Assessment submission deadline, and longer where required by HMRC or another applicable obligation. This does not require retaining every unrelated email or session file.
• Residency agreements and associated records: During the residency, then for necessary settlement, deposit administration, accounting and legal-claim purposes. We consider outstanding matters and applicable claim time limits; this does not justify keeping every associated item for the same period.
• Identity-verification copies: Stored securely in Google Drive with access restricted to the studio operator. Copies are deleted once the residency has ended, outstanding matters have been resolved, the deposit has been returned or otherwise settled, and access credentials have been removed. We review whether retaining the full copy remains necessary during the residency. Any exceptional further retention must relate to a specific unresolved matter or legal obligation.
• Access credentials and logs: Credentials are disabled or removed when authorisation ends. Related logs are retained only as necessary for access administration, security or a particular incident.
• Routine CCTV: Automatically deleted after the configured 30-day period.
• Incident records: While needed for the investigation, complaint, insurance matter or legal claim, including relevant follow-up and applicable claim periods. We review continuing necessity and avoid retaining unrelated material.
• Session materials: As explained in section 7, taking account of delivery, reasonably anticipated revisions and the continuing client relationship.
• AI working material: Only while needed for the administrative task or relevant ongoing matter. Necessary final records follow the applicable category above.
• Website data: According to its function, applicable host settings and cookie information. Website enquiries follow the enquiry or booking criteria above.
We review retained information periodically and securely delete or dispose of it when no longer required. Deletion from active systems may not immediately remove copies in routine backups; these remain protected and are removed through the applicable backup or provider deletion cycle.
10. Other disclosures
In addition to the providers and group communications described above, information may be disclosed where necessary and lawful to insurers, accountants, legal advisers, police, courts or other relevant authorities.
We may also share limited information with people directly involved in a booking, incident or dispute where necessary to provide the service, investigate the matter or resolve it fairly. We consider confidentiality and the rights of others before disclosure.
11. Your rights
Depending on the circumstances, you have rights to:
• Access your personal information.
• Correct inaccurate or incomplete information.
• Request deletion of information.
• Restrict its processing.
• Receive certain information you supplied in a portable format where the legal conditions apply.
• Withdraw consent at any time where processing relies on consent, without affecting the lawfulness of processing before withdrawal.
Your right to object
You have the right to object, on grounds relating to your particular situation, to processing based on legitimate interests, including CCTV and AI-assisted administration. We will stop that processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or it is necessary for establishing, exercising or defending legal claims.
To exercise your rights or withdraw consent, email bookings@thelowstudios.co.uk. We may need proportionate information to verify your identity. Requests are normally free of charge.
We respond in accordance with applicable law, normally within one calendar month. Where the law permits an extension or a pause to obtain necessary clarification or identity information, we will explain the position. Rights are subject to legal conditions and exceptions; for example, certain financial records or evidence relevant to a legal claim may need to be retained.
12. Complaints
You can raise a data protection complaint by emailing bookings@thelowstudios.co.uk.
We will acknowledge receipt within 30 days, investigate without undue delay and keep you informed about progress and the outcome.
We encourage you to contact us first so that we can address your concerns. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator:
https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113
13. Changes and contact
We may update this policy to reflect changes in studio operations, service providers or legal requirements. The latest version and update date will be available on our website. We will draw significant changes to affected people’s attention where appropriate.
For privacy enquiries, rights requests or complaints:
The Low Studios
Frankie Worrall – Studio Owner / Operator
Email: bookings@thelowstudios.co.uk
Website: https://www.thelowstudios.co.uk