Privacy policy
Last updated: 1 October 2026
1. Who we are
This website, beyondordinary.digital, is operated by Beyond Ordinary (trading as Beyond Ordinary Digital), a sole trader business run by Jon Quayle ("we", "us", "our"). We are the data controller for personal data collected through this website and through our dealings with prospective and current clients.
Address: 36 Hildon Close, Worthing, West Sussex, BN13 2SP, United Kingdom
Email: studio@beyondordinary.digital
We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
2. What personal data we collect
Information you give us:
When you contact us, fill in an enquiry or intake form, book a call, or work with us, you may give us your name, email address, phone number, company name, job title, project details, and anything else you choose to include in your message. If you become a client, we also hold contract, invoicing and payment records, and the content, brand assets and account access you provide for your project.
Information collected automatically:
When you visit the website, our hosting provider and any analytics tool may record technical information such as your IP address, browser type, device type, pages viewed, referring page, and approximate location.
Information from third parties:
If you contact us via LinkedIn, email or another platform, we may see the profile or contact details you make available there.
We do not knowingly collect special category data (such as health data) and ask that you do not send it to us. Our services are for businesses and are not directed at anyone under 18.
3. How we use your data
| Purpose | Lawful basic |
|---|---|
| Responding to enquiries and arranging introductory calls | Legitimate interests (running our business and replying to people who contact us), or steps taken at your request before entering a contract |
| Preparing proposals, delivering projects, and managing the client relationship | Performance of a contract |
| Invoicing, taking payment, and keeping accounting and tax records | Performance of a contract and legal obligation |
| Keeping the website secure, preventing spam and fraud, and understanding how the site is used | Legitimate interests (and consent where cookies or similar technologies require it) |
| Sending marketing emails or newsletters, if you opt in | Consent, which you can withdraw at any time |
| Showing client work in our portfolio and case studies | Contract terms with the client, and legitimate interests. Client work is shown in line with our agreement, including confidentiality requests |
We do not sell your personal data. We do not use it for automated decision-making or profiling that has legal or similarly significant effects on you.
4. Who we share data with
We only share personal data where needed to run the website and deliver our services. Our service providers act on our instructions and include:
- Hosting and deployment: Vercel
- Content management: Sanity
- Video delivery (if used on the site): Mux
- Client records, project management and invoicing: Notion, Freeagent
- Email, file storage and video calls: Google Workspace, Zoom, or similar
- Forms and automation: Resend
- Code hosting: GitHub
- Payment and accounting: Mettle
We may also share data with freelancers or subcontractors working with us on a project. They are bound by confidentiality obligations no less protective than ours. We may disclose data where required by law, by a court or regulator, or to protect our legal rights.
Artificial intelligence:
We may use AI tools for internal administrative tasks such as scheduling, drafting routine correspondence and organising notes. We do not use AI to produce creative work for clients. We may at times use AI for development work for clients to speed up routine work. Guardrails are applied to these workflows with human oversight. We do not knowingly enter client confidential material into AI tools that train on user inputs.
5. Cookies and similar technologies
Cookies are small files stored on your device. This site uses only strictly necessary cookies and similar technologies needed for it to work, which do not require consent. We use Vercel Analytics to understand how the site is used. It does not use cookies.
Some embedded content, such as video, can set its own cookies. We'll ask for consent before loading anything non-essential.
6. How long we keep your data
- Enquiries that don't lead to a project: up to 12 months, then deleted.
- Client and project records: for the life of the project and up to 6 years afterwards, in case of disputes or queries.
- Invoices and accounting records: 6 years, to meet tax and accounting requirements.
- Marketing subscriptions: until you unsubscribe.
- Website analytics data: No personal data is collected through Vercel Analytics.
Personal data accessed on a client's systems in the course of a project is kept only as long as strictly necessary to deliver the services.
7. Security
We take reasonable technical and organisational steps to protect personal data, including access controls, password management, encrypted connections (HTTPS) and the use of reputable providers. No system is completely secure. If a breach affects your data and poses a risk to you, we will tell you and, where required, the ICO.
8. Your rights
Under UK data protection law you have the right to:
- be informed about how we use your data (this policy)
- access a copy of the personal data we hold about you
- have inaccurate data corrected
- have your data erased in certain circumstances
- restrict how we use your data in certain circumstances
- receive your data in a portable format where we process it by consent or contract
- object to processing based on legitimate interests, and to direct marketing at any time
- withdraw consent at any time, where we rely on it
To use any of these rights, email studio@beyondordinary.digital. We'll respond within one month. We may need to verify your identity first.
If you're unhappy with how we've handled your data, please contact us first so we can try to put it right.
9. Our clients' websites
When we build a website or digital product for a client, the client is responsible for the personal data collected through it, including its privacy notice and cookie policy. This policy covers only beyondordinary.digital and our own business dealings. If a project requires us to access systems containing personal data belonging to a client's customers or users, we will enter into a separate data processing agreement first.
10. Links to other sites
This website may link to third-party sites, including social platforms. We aren't responsible for their privacy practices, so please read their policies.
11. Changes to this policy
We may update this policy from time to time. The "last updated" date at the top shows when it last changed. Material changes will be highlighted on the website.