Privacy policy

About this policy

At Made for the World (MFTW) we’re committed to protecting and respecting your privacy. For the purposes of UK data protection laws, Made for the World Ltd (company no. 08611297) is the controller of, and is responsible for, your personal data. We are registered with the Information Commissioner’s Office (ICO); our registration number is ZA470587.

This privacy policy applies to the website madefortheworld.studio. It explains how we obtain, process and store personal data provided to us – whether directly through this website, by email, by phone, in person, or through our work with clients – and it sets out your privacy rights and how the law protects you.

The policy covers:

• What personal information MFTW collects
• How MFTW uses this information
• How MFTW stores personal information and for how long
• What personal information MFTW shares
• Acting as a data processor for our clients
• Use of cookies
• Analytics
• Mailing list management
• Links to other sites
• Social media policy and usage
• Your rights
• Changes to this privacy policy
• Contact information

Article 5 of the GDPR requires that personal data shall be:

• Processed lawfully, fairly and in a transparent manner in relation to individuals
• Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes
• Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed
• Accurate and, where necessary, kept up to date
• Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed
• Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures

What personal information MFTW collects

We only process and store personal information that has been given with your consent, or where we have another lawful basis for processing it.

Personal information is collected when you fill out a form on our website, over email, by phone, or in person for example at an event.

The information we generally collect includes name, organisation name and email address.

If you sign up for one of our resources or regular email newsletters, we may ask you to provide certain personally identifiable information that can be used to contact or identify you (“Personal Data”). Personally identifiable information may include, but is not limited to:

• Email address
• First name and last name
• Organisation name
• Cookies and usage data

How MFTW uses this information

The information you provide to MFTW will be used to keep in touch with you and/or process your request. We will only process your personal data when there is a lawful basis for doing so.

Where you have given your express permission, we may use your details to send you information through our mailing list. This is done in accordance with the regulations named in the GDPR policy above.

How MFTW stores personal information and for how long

All personal information given to MFTW will be stored securely.

We store personal data in the following systems:

• Google Workspace (email and Drive) – correspondence, files and documents
• Notion – project and studio documentation
• Xero and Sage – accounting and bookkeeping
• ScoreApp and Brevo – mailing list and marketing communications

We hold personal information for only as long as is necessary for the purposes for which it was collected. We are legally required to retain some information (for example financial records) to fulfil our statutory obligations; where that applies, we keep it for the period required by law.

If you choose to cease an active relationship with us we will keep only basic details to comply with your request and ensure you are no longer contacted by us.

What personal information MFTW shares

MFTW will not, under any circumstance, sell or share your personal data with a third party for marketing purposes.

We share personal data only with the third-party service providers listed above (for example our hosting, email, accounting and mailing list providers), and only the information necessary to deliver the service. Where we do so, we ensure a data processing agreement is in place requiring them to keep your information secure.

We may also disclose personal information where we are required to do so by law, for example by a court order.

International transfers

Some of the providers listed above may process or store data outside the UK. Where that happens, we ensure a similar degree of protection is afforded to your personal data as in the UK, relying on UK adequacy regulations or the transfer safeguards required under UK GDPR.

Acting as a data processor for our clients

When we design, build, host or maintain websites and digital services on behalf of our clients, we may process personal data on their behalf. In these cases our client is the data controller and we act as a data processor under Article 28 of the UK GDPR / EU GDPR. This section explains how we handle that role. It supplements, and does not replace, the data processing agreement (“DPA”) we hold with each client, which governs the processing in question.

Our commitments as processor

• Instruction-based processing. We only process personal data on the documented instructions of the controller, unless required to do otherwise by law.
• Confidentiality. All personnel with access to personal data are bound by confidentiality obligations and receive regular data protection training.
• Security. We maintain appropriate technical and organisational measures, including encryption of personal data in transit (TLS) and at rest; role-based access controls and multi-factor authentication on systems holding personal data; hosting within the UK and/or EU, with data centre providers certified under recognised security standards (e.g. ISO 27001); regular backups, patching and vulnerability management; and logging and monitoring of access to production systems.
• Sub-processors. We use a limited set of vetted sub-processors (e.g. hosting, email and analytics providers). We maintain a list of current sub-processors, notify controllers of intended changes and allow reasonable time to object, as set out in each DPA.
• Data subject requests. If an individual contacts us about data we process on a client’s behalf, we will forward the request to the relevant controller without undue delay and assist them in responding.
• Breach notification. We will notify the affected controller without undue delay after becoming aware of a personal data breach affecting their data.
• Data return and deletion. On termination of our engagement, we will return or delete personal data at the controller’s choice, in line with the DPA.
• Records and audits. We keep records of processing activities carried out on behalf of controllers and make information available to demonstrate compliance, as required under Article 28.

If you are an individual whose data is held on one of our client’s websites, please contact the client (the data controller) directly – we will assist them with your request.

Use of cookies

This website uses cookies to improve the user’s experience. As required by law, this website uses a Cookie Consent Management Platform (CMP) – CookieYes – so that users may give permission for cookies to be used on their devices.

Cookies are files saved to the user’s device. They track, save and store information about user interactions so that the website can provide users with a personal experience.

Users who do not want cookies on their device are advised to take the necessary steps, including blocking cookies or using the cookie control system on their first visit.

Analytics

We use Google Analytics, a third-party service, to monitor and analyse the use of our website.

Google Analytics tracks and reports website traffic. Google uses the data collected to monitor the use of our website. This data may be shared with other Google services, and Google may use it to contextualise and personalise ads within its own advertising network.

You can opt out of having your activity on the website made available to Google Analytics by installing the Google Analytics opt-out browser add-on.

For more information on Google’s privacy practices, please visit the Google Privacy & Terms web page.

Mailing list management

Where you have given your express permission, we use ScoreApp and Brevo to manage our mailing lists and send you our newsletter and other communications.

You are able to opt out of our email newsletter at any time by clicking the unsubscribe link at the end of any MFTW newsletter email.

If you opt out of marketing communications, you will still receive service-related communications that are essential for administrative purposes, for example updates to this policy or our terms.

Links to other sites

Our website may contain links to other sites that are not operated by us. If you click on a third-party link, you will be directed to that third party’s site. We strongly advise you to review the privacy policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

Social media policy and usage

We use social media profiles to share our work and studio news. We never ask for passwords or personal details on social media platforms, and we would encourage you to verify the authenticity of a profile before engaging with it.

There may be instances where our website features social sharing buttons, allowing content to be shared from web pages to social media platforms. This is done at your own discretion, and you accept that sharing may publish content to your social media profile feed or page.

Your rights

Under data protection law you have a number of rights in relation to your personal data. You have the right to:

• Request a copy of the personal data we hold about you
• Have inaccurate personal data corrected or completed
• Have your personal data erased in certain circumstances
• Restrict or object to the processing of your personal data
• Ask us to transfer the personal information you gave us to another organisation, or to you, in certain circumstances
• Withdraw your consent at any time, where we rely on consent as our lawful basis, without affecting the lawfulness of processing before withdrawal

Changes to this privacy policy

We may update our privacy policy from time to time. We will notify you of any changes by posting the new privacy policy on this page.

We will let you know via email and/or a prominent notice on our website, prior to the change becoming effective, and update the “published on” date at the top of this policy.

You are advised to review this privacy policy periodically for any changes. Changes are effective when they are posted on this page.

Contact information

If you wish to exercise any of your rights, or update the information we hold or how we communicate with you, please contact us:

• Email us: hello@madefortheworld.studio
• Write to us: Made for the World Ltd, Unit D228 Parkhall Business Centre, 62 Tritton Road, London, SE21 8DE

You are able to opt out of the email newsletter by clicking the unsubscribe link at the end of any MFTW newsletter email.

Complaints

If you have concerns or complaints about how we process your personal information, you can raise them through our Complaints and Grievance Procedure or email complaints@madefortheworld.studio. The procedure explains how we acknowledge, review and resolve concerns, including the option of an independent review, and applies to any stakeholder affected by our work.

–

Approved by both directors of Made for the World, September 2026. This policy is reviewed annually.