Privacy Policy
1A8 Agency — Privacy PolicySep 30, 2026 · @Alex
1. Who we areThis policy explains what personal data 1A8 Studio collects, why, and what rights you have over it. It applies to our website 1a8agency.ie, enquiries you send us, the work we do for clients, and our social media pages.
1A8 Studio is a trading name of Lingualink, a sole trader business owned by Alexey Chesnokov and based in Ireland
based in Ireland. We are the "data controller" for the personal data described here, as defined in the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.
Contact for any privacy question or request:
•      Post: 1A8 Studio, 9 Orlagh Grove, Castlebar, Co. Mayo, F23 YY30, Ireland
•      Email: 1a8agency@gmail.com (please use the subject line "Privacy request")
•      Phone: +353 838 777 277
We are a small business and are not required to appoint a Data Protection Officer. The owner is responsible for data protection and handles every request personally.
2. What personal data we collectWe collect only what we need to answer you, do the work and run the business. We do not collect special category data (such as health, religion or ethnicity) and ask you not to send it.

Who you are

What we collect

Where it comes from

Someone sending an enquiry

Name, email, phone, business name, and whatever you write about your project

Our website form, email, phone, or messages on Facebook, Instagram, Threads, LinkedIn or Telegram

A client

Contact details of you and your staff, billing details (business name, address, VAT number), project correspondence, meeting notes, and the files, logins and content you give us to build your website or brand

You and your team

A website visitor

IP address, browser and device type, pages viewed, time on site, how you arrived (e.g. a Google search), and cookie identifiers

Automatically, through our website platform and, only if you consent, analytics cookies (see section 4)

A social media follower

Your public profile name, comments, messages and reactions on our pages, plus summary statistics the platforms give us

Facebook, Instagram, Threads, LinkedIn, Behance, Pinterest

A supplier or freelancer

Name, business contact details, bank details for payment, and correspondence

You

You don't have to give us any personal data. But if you don't give us contact details, we can't reply to your enquiry. If a client doesn't give us billing details, we can't issue an invoice or deliver the project.
3. Why we use your data and our legal basisThe GDPR requires a legal basis for every use of personal data (Article 6). Ours are set out below. We never sell your data and never use it for purposes unrelated to what's listed here.

Purpose

Legal basis (GDPR Art. 6(1))

Replying to your enquiry and preparing a quote

Steps you asked for before entering a contract (b); for general questions, our legitimate interest in answering people who contact us (f)

Designing, building and delivering your project; project communication

Performance of our contract with you (b)

Invoicing, accounts, VAT and tax records

Legal obligation under Irish tax law (c)

Keeping project records to deal with questions, disputes or legal claims

Legitimate interest in defending our business and establishing or defending legal claims (f)

Keeping the website secure and working, including essential cookies

Legitimate interest (f); essential cookies are exempt from consent under Irish ePrivacy law

Website analytics and any non-essential cookies

Your consent (a), which you can withdraw at any time

Managing our social media pages and replying to comments or messages

Legitimate interest in engaging with our community (f)

Showing past client work in our portfolio (website, Behance, social media)

Our contract with the client or their permission (b)/(a). We only show project visuals and the client's business name, never private data of the client's customers

Occasional follow-up emails to past clients about similar services

Legitimate interest (f) under the "soft opt-in" in Regulation 13 of S.I. 336/2011. Every email has an unsubscribe option. We do not send marketing to anyone else without consent

Complying with lawful requests from authorities (e.g. Revenue, Gardaí, courts)

Legal obligation (c)

Where we rely on legitimate interest, we have weighed our interest against your rights and are satisfied it's fair. You can object at any time (section 8). We do not use automated decision-making or profiling that has legal or similarly significant effects on you.
4. Cookies and analyticsWe only place non-essential cookies on your device if you say yes in our cookie banner. This follows Regulation 5 of the Irish ePrivacy Regulations (S.I. 336/2011) and the Data Protection Commission's guidance on cookies.

Type

What it does

Needs your consent?

Essential

Makes the site and contact form work, remembers your cookie choice, protects against spam

Yes

Analytics

Counts visits and shows which pages are useful, via [Google Analytics 4 through Google Tag Manager — confirm]

Yes

Marketing

[None used — or list e.g. Meta Pixel, LinkedIn Insight Tag]

Yes

You can change your choice at any time using the "Cookie settings" link in the footer of every page, or by clearing cookies in your browser. Rejecting cookies is as easy as accepting them, and refusing them won't stop you using the site.
Where analytics is used, Google Analytics 4 does not store full IP addresses, Google Signals and advertising data sharing are switched off, and analytics data is kept for 14 months.
5. Who we share your data withWe share personal data only with service providers we need to run the business, and only as much as they need. They act on our instructions under data processing terms (GDPR Article 28) and may not use your data for their own purposes.

Provider

What they do for us

Where data is processed

Tilda (Tilda Platform Cloud Services Co. LLC)

Hosts our website and receives contact-form submissions

Servers in Germany (Hetzner); company based in the UAE, with backups in the USA and support in Kazakhstan

Google (Gmail, [Google Workspace / Drive], Tag Manager, [Analytics])

Email, file storage, website analytics

EU and USA

Meta (Facebook, Instagram, Threads)

Our social media pages and messages

EU and USA

Metricool

Schedules our social media posts and shows page statistics

EU (Spain)

LinkedIn, Behance (Adobe), Pinterest, Telegram

Our profiles and messages on those platforms

Varies; see each platform's policy

[Accounting software / bank / payment provider]

Invoicing and payments

Ireland

[Accountant / tax adviser]

Preparing accounts and tax returns

Ireland

We may also disclose data where Irish or EU law requires it, for example to Revenue, An Garda Síochána or a court. We may share it with legal advisers or insurers if needed to establish or defend a legal claim. If the business is ever sold or restructured, the buyer would take over this policy.
When you contact us on a social media platform, that platform is also a controller of your data. For our Facebook and Instagram pages, we and Meta are joint controllers of the page statistics ("Insights"). Meta's Page Insights Controller Addendum sets out who is responsible for what.
6. Transfers outside the EUSome of our providers process data outside the European Economic Area (EEA), mainly in the USA and the UAE. We only allow this where the transfer is protected in one of the ways GDPR Chapter V permits:
•      an adequacy decision by the European Commission, such as the EU-US Data Privacy Framework for US companies certified under it; or
•      the European Commission's Standard Contractual Clauses, included in the provider's data processing terms, with any extra safeguards needed.
You can ask us for more information about the safeguard used for any provider, or a copy of the relevant clauses, using the contact details in section 1.
7. How long we keep your dataWe keep data only as long as we need it, then delete or anonymise it. The longest period (6 years) comes from Irish law: Revenue requires business records to be kept for 6 years (section 886, Taxes Consolidation Act 1997), and most contract claims can be brought within 6 years (Statute of Limitations 1957).

Data

How long we keep it

Enquiries that don't become a project

12 months from our last contact

Client project files, correspondence and contracts

6 years after the project ends

Invoices, payment and accounting records

6 years after the end of the tax year they relate to

Logins and access details you give us for a project

Deleted or handed back when the project ends (at most 30 days after)

Supplier and freelancer records

6 years after our last transaction

Website analytics data

[14] months

Social media comments and messages

As long as they stay on the platform; you can delete your own at any time

Portfolio items showing client work

Until the client asks us to remove them

Records of privacy requests and how we handled them

3 years

We may keep data longer only if the law requires it or it's needed for an ongoing legal claim. We'll delete it once that ends.
8. Your rightsUnder the GDPR you have the following rights over your personal data. Using them is free.

Right

What it means

Access (Art. 15)

Get a copy of the data we hold about you and how we use it

Rectification (Art. 16)

Have wrong or incomplete data corrected

Erasure (Art. 17)

Have your data deleted where we no longer have a good reason to keep it

Restriction (Art. 18)

Ask us to pause using your data, e.g. while we check its accuracy

Portability (Art. 20)

Get data you gave us in a common digital format, or have it sent to someone else, where we use it by consent or contract

Objection (Art. 21)

Object to uses based on legitimate interest; object to direct marketing at any time, and we will stop

Withdraw consent (Art. 7)

Withdraw any consent you gave, e.g. to analytics cookies. This doesn't affect what we did before

Complain (Art. 77)

Complain to the Data Protection Commission (section 11)

How to make a request. Email 1a8agency@gmail.com with the subject "Privacy request", write to our postal address, or tell us in a social media message. You don't need to use any particular form or wording.
What happens next:
1.     We acknowledge your request within 5 working days.
2.     If we can't be sure who you are, we may ask for reasonable proof of identity. We only ask for what's needed and delete it once we've confirmed who you are.
3.     We respond in full within one month of receiving your request (or of confirming your identity). If a request is complex or you've made several, we may extend this by up to two more months. If so, we'll tell you why within the first month.
4.     If we can't do what you've asked, for example because the law requires us to keep invoices for 6 years, we'll explain why and tell you how to complain.
We may refuse, or charge a reasonable fee for, requests that are clearly unfounded or excessive, such as repeated identical requests. We'll explain our reasons if we do.
9. Websites and apps we build for clientsThis policy does not cover websites, online stores or apps we design or build for our clients. Each client is the data controller for the personal data collected on their own site or app, and is responsible for its privacy policy, cookie banner and legal compliance.
Where our work gives us access to personal data a client controls (for example, order data in an online store we're setting up), we act only as their data processor. That means we:
•      only use that data to carry out the client's instructions;
•      keep it confidential and secure;
•      delete or return it when the work ends; and
•      help the client respond to any request from their customers.
If you're a customer of one of our clients and want to use your data rights, please contact that business directly. If you contact us instead, we'll pass your request to the client promptly and let you know we've done so.
10. Security, children and other websitesSecurity. We protect your data with measures suited to a small studio: two-factor authentication on all business accounts, encrypted connections (HTTPS) on our website, password-managed and encrypted storage for client logins, access limited to people who need it, and regular backups. No system is completely secure. If a breach is likely to put your rights at risk, we'll report it to the Data Protection Commission within 72 hours and tell you without undue delay where the law requires it.
Children. Our services are for businesses and adults. We don't knowingly collect data from anyone under 16, the age of digital consent in Ireland (section 31, Data Protection Act 2018). If you think a child has sent us their data, contact us and we'll delete it.
Other websites. Our site links to other sites and platforms, including our portfolio on Behance and our social media profiles. Their own privacy policies apply once you leave our site.
11. Complaints and changes to this policyComplaints. If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the Irish supervisory authority at any time:
•      Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, Ireland
•      Online: forms.dataprotection.ie/contact
•      Phone (general queries): (01) 765 01 00 or 1800 437 737
If you live in another EU country, you can also complain to the data protection authority there. You also have the right to go to court.
Changes. We may update this policy when our services, providers or the law change. The date at the top shows the latest version. If we make a significant change, we'll show a notice on our website and, where appropriate, email clients.
Last updated: 30.09.2026