Privacy Policy

This policy explains how WISESTUDIO VENTURES LTD, trading as Demandflow ("Demandflow", "we", "us"), collects and uses personal data when you visit demandflow.co, send us an enquiry, book a call, or work with us. It also explains the rights you have and how to use them.

How we use cookies is in our Cookie Policy. If you apply for a role with us, our Recruitment Privacy Notice explains how we handle your application.

1. Who we are

WISESTUDIO VENTURES LTD is the controller of the personal data described here, which means we decide how it’s used and are responsible for it. We’re a private limited company registered in England and Wales, company number 13721849, and our registered office is First Floor, Swan Buildings, 20 Swan Street, Manchester, M4 5JW.

For anything about your personal data or this policy, email privacy@demandflow.co or write to us at the address above.

2. What we collect

When you send an enquiry

The form on our Get started page asks for:

• your name and work email address;
• your company’s website, if you give it;
• the service you’re interested in, your budget, and how you heard about us;
• your message, if you write one.

With it, your browser sends:

• any campaign tags in the address of the page (the "utm_" parameters), the page that sent you to us, and the page you landed on, so we know which channels bring enquiries;
• a reference number for the enquiry, made in your browser, so a repeat or an edit updates the same enquiry instead of creating a new one;
• how many seconds the form took to fill in, and the result of an automatic check that you’re a person, not a bot (see part 6). For that check, your IP address goes to Cloudflare.

We use your enquiry to reply to you and follow up (part 3). It’s kept in our CRM and email, and our team is told about it in Slack (part 5). If it doesn’t lead to work, we keep it for up to 2 years after our last contact with you (part 8). We may also send you emails about our work and services, and you can stop them at any time (see "Marketing emails" in part 3).

If your enquiry can’t reach us, for example because your connection drops, your browser keeps a copy and tries again: twice while the page is open, then when you next open the Get started page. After 7 days it stops trying, and the copy is deleted the next time you open the Get started page. The copy stays on your device; the Cookie Policy explains it.

You don’t have to give us any of this, but we need your name and email address to reply. The other questions are optional unless the form marks them as required, and leaving them out only means we know less about what you need.

We don’t ask for, and don’t want, sensitive information such as health details. Please leave it out of your messages.

When you book a call

Booking uses Cal.com, shown on our page. When the booking step opens, before you book, Cal.com receives your name and email address and your answers to the form: the service, your budget, how you heard about us, your website and your whole message, with the enquiry’s reference number, the campaign tags, the page that sent you to us and the page you landed on. That way you don’t type anything twice, and the booking carries your whole enquiry if the form’s copy didn’t reach us. When you book, reschedule or cancel (with any reason you give), Cal.com tells us, and we add it to your enquiry, or create the enquiry from the booking if it never arrived.

When we talk on a call

We record and transcribe our calls with people who enquire and with clients, using a meeting transcription service, so we have an accurate record of what was discussed and agreed. The transcript holds what’s said on the call and who said it. The recording holds the same, and on a video call it can also hold the picture. We tell you at the start of each call that it’s being recorded and transcribed. If you’d rather we didn’t, tell us, before or during the call, and we won’t.

When you email us or work with us

What you write to us, and your contact details. If your company becomes a client or a supplier, we also hold the business contact details of the people we work with, our contracts, invoices and payment records, and the messages and files exchanged during the work.

When you visit the website

• Server logs. Like any website, ours runs on servers that record each request: your IP address, the page asked for, the time, your browser and device type, and the page you came from. Our hosting provider, Cloudflare, keeps these logs for a short time to run and protect the site.
• Images. Some images on our About and Careers pages load from Sanity, our content system, so Sanity receives your IP address and browser details when they load. It sets no cookies.
• Analytics, only if you agree. If you accept analytics in our cookie banner, we record how the site is used: the pages you view, what you click, how you move through a page, your device, browser and approximate location, and where you came from. We use Google Analytics and PostHog for this. Google Analytics measures visits and actions such as sending an enquiry or completing a booking. We send those actions to Google by name, without your form answers or booking details. PostHog may also record your visit as a replay of the screen on larger screens, with everything you type into a form hidden. Until you accept, no analytics loads at all: nothing is sent for analytics and nothing is stored on your device for it. The Cookie Policy lists what’s stored.
• Embedded videos. Our case studies show videos from Vimeo. Vimeo receives your IP address and device details when a player loads, and its player sets cookies. On larger screens the players load by themselves once the page has loaded, without waiting for a choice in the cookie banner.

Business contacts from other sources

We may get someone’s business contact details from somewhere other than them: from a person who introduces or refers them to us, or from a public professional source, such as their company’s website or a professional profile they’ve made public. What we hold is the kind of detail found there: name, job title, the company they work for, and work email address or phone number.

If we got your details this way, we tell you where they came from the first time we get in touch, and in any case within a month of getting them. You can object at any time: tell us, or use the unsubscribe link in any email, and we’ll stop and won’t contact you again.

3. How we use it, and why we’re allowed to

Data protection law says we need a lawful basis for each use of your data. Ours are:

Where we rely on legitimate interests, we’ve weighed them against your interests and rights, and you can object (see part 9). We don’t make decisions about you based only on automated processing that have legal or similarly significant effects. The bot check in part 6 doesn’t decide whether we read your enquiry: an enquiry that doesn’t pass it still reaches us, marked for a person to check. A form sent in under 3 seconds, or with a field hidden from people filled in, is treated as a bot and not passed on.

Marketing emails

We send emails about our work and services to business contacts: people who have enquired with us or are clients. If we got your business contact details from a referral or a public professional source (part 2), we may email you about our work too, under the same rules. We send them using an email marketing service. The Privacy and Electronic Communications Regulations (PECR) set the rules for marketing emails, and they depend on who you are:

• If you work for a company or another corporate body (including a limited liability partnership or a Scottish partnership) and we email you at work, the rules let us send you marketing without asking first. We must say who we are and give you a way to opt out, and we always do both.
• If you’re a sole trader, or in another kind of partnership, the rules treat you as an individual. We send you marketing emails only if you’ve agreed to them, or if all of these are true (the "soft opt-in"):
  • we got your details when you enquired about or bought our services;
  • the emails are about similar services of ours;
  • you were given a simple way to opt out when you gave us your details, and in every email since.

Every marketing email has an unsubscribe link. If you unsubscribe, or tell us in any other way that you don’t want marketing from us, we stop, every time. We keep a note of your email address so we don’t email you again by mistake.

Our newsletter. If you subscribe to The Demandflow Brief with the form at the foot of our pages, we add your email address to our newsletter list. We send it because you asked for it: the lawful basis is your consent, given by subscribing. Resend keeps the list for us (part 5). You can unsubscribe at any time with the link in every issue, or by emailing privacy@demandflow.co. We keep your address on the list until you unsubscribe, then only a note of it so we don’t email you again.

4. Cookies and analytics

We use only the cookies the site needs to work and the ones Vimeo’s video players set on our case studies, unless you choose otherwise. Analytics cookies wait until you accept them in the cookie banner. You can change your mind at any time from "Cookie settings", at the foot of every page. Our Cookie Policy lists every cookie, what it does and how long it lasts.

5. Who we share it with

We don’t sell your personal data, and we don’t share it with anyone for their own marketing. We use these providers to run the website and the business. Some are named; others are listed by the kind of service they provide. They handle personal data on our behalf and on our instructions, under contracts that require them to protect it. Two also use some of it for their own purposes, and their own privacy policies cover that: Cloudflare, to improve its bot detection (part 6), and Vimeo, for the data its video player collects.

We may also share personal data:

• with our professional advisers, such as accountants, lawyers and insurers, where they need it to advise us;
• with the police, regulators, courts or tax authorities where the law requires it, or to protect our rights or someone’s safety;
• with a buyer or investor, and their advisers, if all or part of the business is sold or restructured. They would have to use it as this policy describes.

6. Bot protection with Cloudflare Turnstile

The enquiry form is protected by Cloudflare Turnstile, which checks that a person, not a bot, is sending it. It runs in the background without a puzzle to solve, starting when you first move into the form. To do this, Cloudflare receives your IP address, your browser’s user agent, a technical fingerprint of its secure connection, and which website and form the check is for. Turnstile doesn’t read what you type into the form.

Cloudflare runs the check for us, and also uses these signals on its own behalf to improve how Turnstile detects bots. How Cloudflare handles them is set out in its Turnstile Privacy Addendum and its privacy policy.

We use Turnstile because it’s needed to keep the form you’re using free of spam, so it runs without asking first. Our lawful basis is our legitimate interest in keeping the form and our inbox secure.

7. International transfers

Several of our providers are based in, or use services in, the United States and other countries outside the UK. When personal data goes outside the UK, we make sure it’s protected to the standard UK law requires, through one of these:

• regulations made by the UK government approving transfers to that country (these cover the European Economic Area, among others);
• the provider is certified under the UK Extension to the EU-US Data Privacy Framework, which the UK recognises for US organisations that sign up to it;
• a contract approved for UK transfers: the International Data Transfer Agreement, or the UK Addendum to the European Commission’s Standard Contractual Clauses.

The table in part 5 gives the safeguard for each provider. For a copy of the relevant safeguard, email privacy@demandflow.co.

8. How long we keep it

We keep personal data only as long as we need it for the reasons in part 3, then delete it or make it anonymous.

How long that is depends on why we hold it, whether we’re still in touch with you or working together, how long the law requires us to keep records, and how long a legal claim could be brought. Where the table below gives a reason in place of a period, we keep the data while that reason applies, review what we hold, and delete what we no longer need.

We may keep data longer where the law requires it, or where we need it for a legal claim.

9. Your rights

Under UK data protection law you can ask us to:

• give you a copy of the personal data we hold about you, and tell you how we use it;
• correct data that’s wrong, or complete data that’s incomplete;
• delete your data, where we no longer have a good reason to keep it;
• restrict how we use your data, for example while we check a complaint about its accuracy;
• move data you gave us to you or to another organisation, in a common machine-readable format, where we use it with your consent or under a contract;
• object where we rely on legitimate interests. We’ll stop unless we have compelling reasons to continue or need the data for a legal claim. You can always stop us using it for direct marketing, including through the unsubscribe link in any marketing email;
• withdraw your consent where we rely on it, such as for analytics cookies (use "Cookie settings" at the foot of any page). This doesn’t affect what we did before you withdrew it. Withdrawing stops future analytics collection and removes the analytics cookies and storage we control in your browser. It doesn’t automatically delete data already collected, which follows the retention periods in part 8. Without a browser identifier, we may be unable to associate that data with you. You can still contact us about your rights (see our Cookie Policy).

To use any of these rights, email privacy@demandflow.co. It’s free. We may need to confirm who you are before we act. We’ll reply within one month, and we’ll search for your data in a way that’s reasonable and proportionate. If a request is complex, or you send several, we can take up to two months more, and we’ll tell you within the first month if we need to. Some rights have exceptions, and if one applies we’ll explain it.

10. Complaints

You have the right to complain to us if you’re unhappy with how we’ve handled your personal data, and we’d like the chance to put it right first. Email privacy@demandflow.co, or write to us at the address in part 1. We’ll acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator, on 0303 123 1113 or through its website. The ICO recommends giving us the chance to put things right first, but you can go to it at any time.

11. Keeping it secure

We limit access to personal data to the people who need it for their work, and we choose providers that protect it with recognised security standards. The website runs over an encrypted connection. No system is completely secure, so if something goes wrong that puts your data at risk, we’ll tell you and the ICO where the law requires it.

12. Children

Our website and services are for businesses, not children. We don’t knowingly collect personal data from anyone under 18. If you think a child has sent us their details, email us and we’ll delete them.

13. Changes to this policy

When we change how we use personal data, we’ll update this policy and the date at the top. If a change matters to people we’re already in touch with, we’ll tell them directly.

14. Contact us

WISESTUDIO VENTURES LTD, trading as Demandflow. First Floor, Swan Buildings, 20 Swan Street, Manchester, M4 5JW.

Privacy questions and requests: privacy@demandflow.co. Everything else: hello@demandflow.co.