1A8 Agency — Privacy PolicySep 30, 2026 · @Alex
1. Who we areThis policy explains what personal data 1A8 Studio collects, why, and what rights you have over it. It applies to our website
1a8agency.ie, enquiries you send us, the work we do for clients, and our social media pages.
1A8 Studio is a trading name of Lingualink, a sole trader business owned by
Alexey Chesnokov and based in Ireland
based in Ireland. We are the "data controller" for the personal data described here, as defined in the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.
Contact for any privacy question or request:• Post: 1A8 Studio, 9 Orlagh Grove, Castlebar, Co. Mayo, F23 YY30, Ireland
• Email: 1a8agency@gmail.com (please use the subject line "Privacy request")
• Phone: +353 838 777 277
We are a small business and are not required to appoint a Data Protection Officer. The owner is responsible for data protection and handles every request personally.
2. What personal data we collectWe collect only what we need to answer you, do the work and run the business. We do not collect special category data (such as health, religion or ethnicity) and ask you not to send it.
Who you are | What we collect | Where it comes from |
Someone sending an enquiry | Name, email, phone, business name, and whatever you write about your project | Our website form, email, phone, or messages on Facebook, Instagram, Threads, LinkedIn or Telegram |
A client | Contact details of you and your staff, billing details (business name, address, VAT number), project correspondence, meeting notes, and the files, logins and content you give us to build your website or brand | You and your team |
A website visitor | IP address, browser and device type, pages viewed, time on site, how you arrived (e.g. a Google search), and cookie identifiers | Automatically, through our website platform and, only if you consent, analytics cookies (see section 4) |
A social media follower | Your public profile name, comments, messages and reactions on our pages, plus summary statistics the platforms give us | Facebook, Instagram, Threads, LinkedIn, Behance, Pinterest |
A supplier or freelancer | Name, business contact details, bank details for payment, and correspondence | You |
You don't have to give us any personal data. But if you don't give us contact details, we can't reply to your enquiry. If a client doesn't give us billing details, we can't issue an invoice or deliver the project.
3. Why we use your data and our legal basisThe GDPR requires a legal basis for every use of personal data (Article 6). Ours are set out below. We never sell your data and never use it for purposes unrelated to what's listed here.
Purpose | Legal basis (GDPR Art. 6(1)) |
Replying to your enquiry and preparing a quote | Steps you asked for before entering a contract (b); for general questions, our legitimate interest in answering people who contact us (f) |
Designing, building and delivering your project; project communication | Performance of our contract with you (b) |
Invoicing, accounts, VAT and tax records | Legal obligation under Irish tax law (c) |
Keeping project records to deal with questions, disputes or legal claims | Legitimate interest in defending our business and establishing or defending legal claims (f) |
Keeping the website secure and working, including essential cookies | Legitimate interest (f); essential cookies are exempt from consent under Irish ePrivacy law |
Website analytics and any non-essential cookies | Your consent (a), which you can withdraw at any time |
Managing our social media pages and replying to comments or messages | Legitimate interest in engaging with our community (f) |
Showing past client work in our portfolio (website, Behance, social media) | Our contract with the client or their permission (b)/(a). We only show project visuals and the client's business name, never private data of the client's customers |
Occasional follow-up emails to past clients about similar services | Legitimate interest (f) under the "soft opt-in" in Regulation 13 of S.I. 336/2011. Every email has an unsubscribe option. We do not send marketing to anyone else without consent |
Complying with lawful requests from authorities (e.g. Revenue, Gardaí, courts) | Legal obligation (c) |
Where we rely on legitimate interest, we have weighed our interest against your rights and are satisfied it's fair. You can object at any time (section 8). We do not use automated decision-making or profiling that has legal or similarly significant effects on you.
4. Cookies and analyticsWe only place non-essential cookies on your device if you say yes in our cookie banner. This follows Regulation 5 of the Irish ePrivacy Regulations (S.I. 336/2011) and the Data Protection Commission's guidance on cookies.
Type | What it does | Needs your consent? |
Essential | Makes the site and contact form work, remembers your cookie choice, protects against spam | Yes |
Analytics | Counts visits and shows which pages are useful, via [Google Analytics 4 through Google Tag Manager — confirm] | Yes |
Marketing | [None used — or list e.g. Meta Pixel, LinkedIn Insight Tag] | Yes |
You can change your choice at any time using the
"Cookie settings" link in the footer of every page, or by clearing cookies in your browser. Rejecting cookies is as easy as accepting them, and refusing them won't stop you using the site.
Where analytics is used, Google Analytics 4 does not store full IP addresses, Google Signals and advertising data sharing are switched off, and analytics data is kept for
14 months.
5. Who we share your data withWe share personal data only with service providers we need to run the business, and only as much as they need. They act on our instructions under data processing terms (GDPR Article 28) and may not use your data for their own purposes.
Provider | What they do for us | Where data is processed |
Tilda (Tilda Platform Cloud Services Co. LLC) | Hosts our website and receives contact-form submissions | Servers in Germany (Hetzner); company based in the UAE, with backups in the USA and support in Kazakhstan |
Google (Gmail, [Google Workspace / Drive], Tag Manager, [Analytics]) | Email, file storage, website analytics | EU and USA |
Meta (Facebook, Instagram, Threads) | Our social media pages and messages | EU and USA |
Metricool | Schedules our social media posts and shows page statistics | EU (Spain) |
LinkedIn, Behance (Adobe), Pinterest, Telegram | Our profiles and messages on those platforms | Varies; see each platform's policy |
[Accounting software / bank / payment provider] | Invoicing and payments | Ireland |
[Accountant / tax adviser] | Preparing accounts and tax returns | Ireland |
We may also disclose data where Irish or EU law requires it, for example to Revenue, An Garda Síochána or a court. We may share it with legal advisers or insurers if needed to establish or defend a legal claim. If the business is ever sold or restructured, the buyer would take over this policy.
When you contact us on a social media platform, that platform is also a controller of your data. For our Facebook and Instagram pages, we and Meta are joint controllers of the page statistics ("Insights"). Meta's
Page Insights Controller Addendum sets out who is responsible for what.
6. Transfers outside the EUSome of our providers process data outside the European Economic Area (EEA), mainly in the USA and the UAE. We only allow this where the transfer is protected in one of the ways GDPR Chapter V permits:
• an
adequacy decision by the European Commission, such as the EU-US Data Privacy Framework for US companies certified under it; or
• the European Commission's
Standard Contractual Clauses, included in the provider's data processing terms, with any extra safeguards needed.
You can ask us for more information about the safeguard used for any provider, or a copy of the relevant clauses, using the contact details in section 1.
7. How long we keep your dataWe keep data only as long as we need it, then delete or anonymise it. The longest period (6 years) comes from Irish law: Revenue requires business records to be kept for 6 years (section 886, Taxes Consolidation Act 1997), and most contract claims can be brought within 6 years (Statute of Limitations 1957).
Data | How long we keep it |
Enquiries that don't become a project | 12 months from our last contact |
Client project files, correspondence and contracts | 6 years after the project ends |
Invoices, payment and accounting records | 6 years after the end of the tax year they relate to |
Logins and access details you give us for a project | Deleted or handed back when the project ends (at most 30 days after) |
Supplier and freelancer records | 6 years after our last transaction |
Website analytics data | [14] months |
Social media comments and messages | As long as they stay on the platform; you can delete your own at any time |
Portfolio items showing client work | Until the client asks us to remove them |
Records of privacy requests and how we handled them | 3 years |
We may keep data longer only if the law requires it or it's needed for an ongoing legal claim. We'll delete it once that ends.
8. Your rightsUnder the GDPR you have the following rights over your personal data. Using them is free.
Right | What it means |
Access (Art. 15) | Get a copy of the data we hold about you and how we use it |
Rectification (Art. 16) | Have wrong or incomplete data corrected |
Erasure (Art. 17) | Have your data deleted where we no longer have a good reason to keep it |
Restriction (Art. 18) | Ask us to pause using your data, e.g. while we check its accuracy |
Portability (Art. 20) | Get data you gave us in a common digital format, or have it sent to someone else, where we use it by consent or contract |
Objection (Art. 21) | Object to uses based on legitimate interest; object to direct marketing at any time, and we will stop |
Withdraw consent (Art. 7) | Withdraw any consent you gave, e.g. to analytics cookies. This doesn't affect what we did before |
Complain (Art. 77) | Complain to the Data Protection Commission (section 11) |
How to make a request. Email 1a8agency@gmail.com with the subject "Privacy request", write to our postal address, or tell us in a social media message. You don't need to use any particular form or wording.
What happens next:1. We acknowledge your request within 5 working days.
2. If we can't be sure who you are, we may ask for reasonable proof of identity. We only ask for what's needed and delete it once we've confirmed who you are.
3. We respond in full within
one month of receiving your request (or of confirming your identity). If a request is complex or you've made several, we may extend this by up to two more months. If so, we'll tell you why within the first month.
4. If we can't do what you've asked, for example because the law requires us to keep invoices for 6 years, we'll explain why and tell you how to complain.
We may refuse, or charge a reasonable fee for, requests that are clearly unfounded or excessive, such as repeated identical requests. We'll explain our reasons if we do.
9. Websites and apps we build for clientsThis policy does not cover websites, online stores or apps we design or build for our clients. Each client is the data controller for the personal data collected on their own site or app, and is responsible for its privacy policy, cookie banner and legal compliance.
Where our work gives us access to personal data a client controls (for example, order data in an online store we're setting up), we act only as their
data processor. That means we:
• only use that data to carry out the client's instructions;
• keep it confidential and secure;
• delete or return it when the work ends; and
• help the client respond to any request from their customers.
If you're a customer of one of our clients and want to use your data rights, please contact that business directly. If you contact us instead, we'll pass your request to the client promptly and let you know we've done so.
10. Security, children and other websites
Security. We protect your data with measures suited to a small studio: two-factor authentication on all business accounts, encrypted connections (HTTPS) on our website, password-managed and encrypted storage for client logins, access limited to people who need it, and regular backups. No system is completely secure. If a breach is likely to put your rights at risk, we'll report it to the Data Protection Commission within 72 hours and tell you without undue delay where the law requires it.
Children. Our services are for businesses and adults. We don't knowingly collect data from anyone under 16, the age of digital consent in Ireland (section 31, Data Protection Act 2018). If you think a child has sent us their data, contact us and we'll delete it.
Other websites. Our site links to other sites and platforms, including our portfolio on Behance and our social media profiles. Their own privacy policies apply once you leave our site.
11. Complaints and changes to this policy
Complaints. If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the Irish supervisory authority at any time:
• Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland
• Online:
forms.dataprotection.ie/contact• Phone (general queries): (01) 765 01 00 or 1800 437 737
If you live in another EU country, you can also complain to the data protection authority there. You also have the right to go to court.
Changes. We may update this policy when our services, providers or the law change. The date at the top shows the latest version. If we make a significant change, we'll show a notice on our website and, where appropriate, email clients.
Last updated: 30.09.2026