Last updated: 29th September 2026

Hello, you’ve found our privacy policy. It’s not the most visited page on the site, but it’s an important one. It explains what personal information we collect, why we collect it, who we share it with and what rights you have.

It covers visitors to tribe.studio, people who enquire about working with us, newsletter subscribers, the people we work with at our clients and suppliers, and job applicants. If anything is unclear, just ask.

Who we are

Tribe is the trading name of Tribe Digital Consulting Limited, a company registered in England and Wales (company number 12238117, VAT number 333259411). Our registered office is 9 Southernhay West, Exeter, EX1 1JG.

For the information described in this policy we are the controller, which means we decide how and why it is used.

How to contact us

Our data protection lead is Ollie Ody, a director of the company. For any question, request or complaint about your personal information, email [email protected] or write to us at the address above.

Information you provide

Most of what we hold comes directly from you, for example when you:

  • fill in our enquiry form or email us (your name, work email, company, phone number if you give it, and your message)
  • sign up to our newsletter (your name and email address)
  • become a client or supplier (work contact details, billing details, and the contracts you sign, including the electronic signing record)
  • apply for a job with us (your CV, cover letter and anything else you choose to send)

Before a first meeting we may also look at publicly available business information, such as your LinkedIn profile or your company’s Companies House record.

How we use it, and our lawful basis

UK data protection law requires a lawful basis for each use of personal information. Ours are:

  • Replying to enquiries and preparing proposals: legitimate interests, in responding to people who contact us.
  • Delivering and managing client work, including meeting notes and, where we tell you at the time, call recordings: contract, where you are our client, or otherwise legitimate interests in running the work.
  • Signing contracts, invoicing and keeping financial records: contract and legal obligation.
  • Sending our newsletter: consent, which you can withdraw at any time.
  • Occasional emails about our services sent to company email addresses: legitimate interests, with an unsubscribe link in every email.
  • Running, securing and improving our website: legitimate interests, and consent where cookies require it.
  • Showing our adverts to people who have visited our site: consent, given through our cookie banner.
  • Recruitment: legitimate interests in hiring, and taking steps before entering a contract.
  • Meeting our legal duties and handling any disputes: legal obligation and legitimate interests.

Where we rely on legitimate interests, we have weighed them against your rights, and you can object at any time. We don’t make decisions about you based solely on automated processing. We don’t ask for sensitive information, such as health details, unless a job applicant tells us about a disability so we can make adjustments.

Our clients’ customer data

We design, build and grow ecommerce stores for brands, mostly on Shopify Plus. To do that, our clients give us access to their own platforms, which can contain their customers’ details and order histories.

That data belongs to our clients, and they are responsible for it. We work inside their systems using the access they grant us, only on their instructions and only for the work they have asked us to do. We don’t keep our own copies of their customer data, we don’t use it for our own purposes and we never sell it. When our work ends, our access is removed.

If you’re a customer of a brand we work with and have a question about your data, please contact that brand. If you contact us by mistake, we’ll pass your request on to them.

Cookies

Cookies are small text files a website stores on your device. We use three kinds:

  • Strictly necessary cookies, which make the site work and remember your cookie choices. These are always on.
  • Analytics cookies, which count visits and show us, in aggregate, which pages are useful so we can improve the site. UK law allows these without consent when they are used only for statistics, but you can still switch them off in our cookie settings.
  • Advertising cookies, which let advertising platforms show our adverts to people who have visited our site and tell us whether those adverts work. These only load if you accept them.

You can change your choices at any time through the cookie settings on our site, or by clearing cookies in your browser. To learn more about interest-based advertising and how to opt out, visit Your Online Choices.

Who we share information with

We don’t sell personal information. We share it only with trusted suppliers who help us run the business, such as providers of email, file storage, project management, CRM, email marketing, contract signing, accounting, payroll, website hosting and analytics. They receive only what they need, and they work under contracts that require them to protect it.

We may also share information with our professional advisers, with a buyer if the business is ever sold, or where the law requires it, for example with HMRC or a court.

International transfers

Some of our suppliers store data outside the UK, mainly in the European Economic Area and the United States. When that happens we make sure it stays protected. The UK recognises the EEA as providing adequate protection, and for US suppliers we rely on the UK Extension to the EU-US Data Privacy Framework or the ICO’s approved International Data Transfer Agreement. Ask us if you’d like details of the safeguard behind a particular transfer.

How long we keep it

We keep information only as long as we need it, then delete or anonymise it:

  • Enquiries that don’t become work: 2 years from our last contact.
  • Client contracts, correspondence and project records: 6 years after the contract ends.
  • Invoices and accounting records: 6 years from the end of the financial year they relate to.
  • Newsletter subscribers: until you unsubscribe. We then keep your email address on a suppression list so we don’t contact you again.
  • Unsuccessful job applications: 6 months after the role is filled, unless you agree to us keeping them longer.
  • Website analytics: 14 months.
  • Call recordings and transcripts: 12 months, unless needed for an active project or dispute.

How we protect it

Access to personal information is limited to the people who need it and protected by strong passwords and two-factor authentication. Our team is trained in data protection, and we check our suppliers’ security before we use them. No system is perfectly secure, but if a breach puts your rights at risk, we will tell you and the ICO as the law requires.

Your rights

You have the right to:

  • ask for a copy of the personal information we hold about you
  • have inaccurate information corrected
  • have your information deleted, where we have no good reason to keep it
  • ask us to limit how we use it while a concern is looked into
  • object to us using it on the basis of legitimate interests, including for marketing
  • receive information you gave us in a portable format
  • withdraw your consent at any time, where consent is our basis

To use any of these rights, email [email protected]. There’s no charge. We may ask you to confirm your identity, and we’ll reply within one month. For complex requests we can extend that by up to two further months, and we’ll let you know if we need to.

Email opt-out

You can stop our marketing emails at any time by clicking the unsubscribe link in any email or by contacting us.

Complaints

If you’re unhappy with how we’ve handled your information, please tell us first at [email protected]. We’ll acknowledge your complaint within 30 days, look into it and let you know the outcome without undue delay.

You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Links to other websites

Our website links to other websites, including our clients’ stores and our social media pages. Once you leave our site, their own privacy policies apply.

Updates to this policy

We review this policy at least once a year and whenever our practices change. The date at the top shows when it was last updated. If we make a significant change, we’ll say so on our website.