Privacy & GDPR Policy

1. Who We Are

1.1 This policy explains how Klyppy Lab Studio (“KLS”, “we”, “us”) collects, uses, and protects personal data in connection with our website at www.klyppylab.studio, our social media channels and community spaces, our alternate reality game (ARG) and interactive storytelling activities, and our business operations.

1.2 Data controller: Klyppy Lab Studio · Registered office: Klyppy Lab Studio, Sackville Road, Bexhill, East Sussex, TN39 3JE, UK · Contact for privacy matters: team@klyppylab.studio.

1.3 We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR). Where our content reaches viewers in the EU/EEA, the EU GDPR may also apply.

2. The Data We Collect

2.1 Website visitors

• Technical data — IP address, browser type and version, device identifiers, operating system, referral source, pages viewed, and interaction data, collected via server logs and analytics cookies (see Section 7).
• Contact data — name, email address, and message content when you contact us via forms or email.
• Newsletter data — email address and subscription preferences where you opt in to mailing lists.

2.2 Social media and community participants

• Public interaction data — usernames, handles, avatars, comments, replies, duets/stitches/remixes, likes, and shares on our channels on TikTok, YouTube, Instagram, Facebook, X, and similar platforms.
• Community server data — usernames, messages, and activity within KLS community spaces such as our Discord server, subject also to Discord's own privacy policy.
• ARG participation data — puzzle submissions, theories, emails or messages sent to in-fiction addresses or accounts, and other interactive storytelling contributions. In-fiction personas and channels are operated by KLS; data sent to them is processed by KLS under this policy.

2.3 Clients, partners, and suppliers

• Business contact data — names, job titles, organisation, email addresses, phone numbers, and correspondence relating to commissions, brand partnerships, and supplier relationships.
• Financial data — billing details, bank account details for payments, and transaction records. We do not store full card numbers; payments are handled by payment providers.

2.4 Data we do not intentionally collect

We do not seek to collect special category data (such as health, religious, or biometric data) or criminal offence data, and we ask that you do not submit it through our channels. Our content and community activities are not directed at children under 13, and we do not knowingly collect their data (see Section 5).

3. How and Why We Use Personal Data (Lawful Bases)

Under UK GDPR we must have a lawful basis for each use of personal data. We rely on the following:

• Contract (Art. 6(1)(b)) — to negotiate and perform client SOWs, manage partnerships, and respond to service enquiries.
• Legitimate interests (Art. 6(1)(f)) — to operate, secure, and improve the Site and Channels; to moderate communities; to run and document ARG and interactive storytelling activities; to analyse audience engagement; to feature public interactions (e.g. comments, fan theories) in community round-ups; and to conduct business development. We balance these interests against your rights and expectations.
• Consent (Art. 6(1)(a)) — for newsletters and direct marketing to individuals, for non-essential cookies and analytics, and for featuring identifiable UGC beyond ordinary platform interaction where consent is appropriate. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)) — to keep accounting and tax records, respond to lawful requests, and meet regulatory duties.

4. Personal Data in Our Production Pipeline

4.1 KLS operates an AI-assisted production pipeline using third-party generative tools for image, video, and voice creation, plus automation and editing software. Our productions are fictional and are built from original creative direction; we do not use personal data of viewers or community members to generate content, and we do not use audience personal data to train AI models.

4.2 Where a client engagement requires processing identifiable material through our pipeline — for example a real person's likeness or voice supplied by a client — we will only do so with documented rights and consents supplied by the client, under a written agreement addressing data protection roles, and in accordance with the tool providers' terms. We do not create synthetic media of real, identifiable people without documented consent.

4.3 Limited personal data (such as staff or contractor account details) is processed by our pipeline tool providers as processors or independent controllers under their own terms; see Section 8.

5. Younger Audiences (16–24, Including Under-18s)

5.1 Our channels target a Gen Z audience (broadly 16–24), which includes minors. We take the following approach:

• Our services are not directed at children under 13, and we do not knowingly collect personal data from under-13s. If we learn we hold such data, we will delete it.
• Where we rely on consent for online services offered directly to a child, UK GDPR sets the age of consent at 13; below that age, parental consent is required. Platform age gates (e.g. TikTok, YouTube, Discord minimum ages) also apply.
• We have regard to the ICO's Age Appropriate Design Code (Children's Code) in how our Site and community features are configured: data minimisation by default, no profiling of minors for our own marketing, no geolocation collection, and age-appropriate community standards.
• We do not knowingly send direct marketing to under-18s, and our ARG mechanics are designed for entertainment, not for extracting personal information; participants are asked never to share real-world personal details in ARG play.

5.2 Parents or guardians with questions or requests regarding a child's data can contact team@klyppylab.studio.

6. Sharing Personal Data

We do not sell personal data. We share personal data only with:

• Service providers (processors) — hosting, email, analytics, newsletter, cloud storage, and productivity providers acting on our instructions under contracts containing UK GDPR Article 28 terms. Current processors: 123-Reg.co.uk.
• Social and community platforms — TikTok, YouTube (Google), Instagram and Facebook (Meta), X, and Discord act as independent or joint controllers for data processed on their platforms; their own privacy policies apply alongside ours.
• Production tool providers — the third-party AI and automation tools in our pipeline, in the limited circumstances described in Section 4.
• Professional advisers and authorities — accountants, insurers, legal advisers, and regulators or law enforcement where required by law.
• Business transfers — a purchaser or successor in the event of a sale or restructuring of the business, under appropriate safeguards.

7. Cookies and Analytics

7.1 The Site uses cookies and similar technologies. Strictly necessary cookies are used to make the Site work. Non-essential cookies — including analytics and any embedded-content cookies (e.g. embedded video players and social widgets) — are set only with your consent via our cookie banner, in accordance with PECR.

7.2 Cookies in use:

You can withdraw or change your choices at any time via the cookie settings link and through your browser settings. Embedded content from platforms may set cookies governed by those platforms. Full details are in our Cookies Policy.

8. International Transfers

Some of our providers and platforms store or process data outside the UK, including in the United States. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, or the ICO's International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, together with any necessary supplementary measures.

9. Data Retention

We keep personal data only as long as necessary for the purposes described, then delete or anonymise it. Indicative retention periods:

• Enquiries and general correspondence — 24 months after the last contact.
• Client contracts, SOWs, and related correspondence — 6 years after the end of the engagement (limitation periods).
• Accounting and tax records — at least 6 years, as required by law.
• Newsletter data — until you unsubscribe, plus a suppression record to honour opt-outs.
• Community and ARG interaction data on third-party platforms — governed by the relevant platform; KLS-held exports or archives are reviewed annually and minimised.
• Server and security logs — 12 months.

10. Security

We apply appropriate technical and organisational measures to protect personal data, including access controls and least-privilege access, strong authentication (including multi-factor authentication on studio accounts), encryption in transit, reputable hosted services, device security, and staff/contractor confidentiality obligations. No system is completely secure; transmission of data is at your own risk, and we will act promptly on any suspected compromise.

11. Your Rights

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you;
• Rectification — have inaccurate or incomplete data corrected;
• Erasure — ask us to delete your data in certain circumstances (“right to be forgotten”);
• Restriction — ask us to limit how we use your data in certain circumstances;
• Portability — receive data you provided to us in a structured, machine-readable format where processing is based on consent or contract;
• Objection — object to processing based on legitimate interests, and object at any time to direct marketing (which we will stop);
• Withdraw consent — at any time, without affecting prior processing;
• Automated decision-making — we do not make decisions producing legal or similarly significant effects about you based solely on automated processing.

To exercise any right, contact team@klyppylab.studio. We will respond within one month (extendable by two further months for complex requests). We may need to verify your identity. Requests are free of charge unless manifestly unfounded or excessive. Note that data held on third-party platforms may need to be addressed to the platform as controller; we will assist where we can.

12. Personal Data Breaches

We maintain a breach log and response procedure. Where a breach is likely to result in a risk to individuals' rights and freedoms, we will notify the ICO without undue delay and within 72 hours of becoming aware; where the risk is high, we will also inform affected individuals without undue delay.

13. Accountability and Governance

KLS maintains: a record of processing activities appropriate to its size; this policy and internal data handling guidance for staff and contractors; Article 28 processor agreements with suppliers; data protection due diligence when adopting new pipeline tools (including a Data Protection Impact Assessment where processing is likely to result in high risk, such as any processing involving minors' data at scale or new synthetic-media use cases); and an annual review of this policy. Responsible person: K. Reilly, Creative Director.

14. Complaints

If you have a concern about our use of your personal data, please contact us first at team@klyppylab.studio and we will try to resolve it. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk · 0303 123 1113 · Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. If you are in the EU/EEA, you may complain to your local supervisory authority.

15. Changes to This Policy

We may update this policy from time to time. The current version will always be published at klyppylab.studio/privacy. Material changes will be highlighted on the Site or notified to subscribers where appropriate.

16. Contact

Klyppy Lab Studio · Sackville Road, Bexhill, East Sussex, TN39 3JE, UK · team@klyppylab.studio · www.klyppylab.studio

© 2026 KLYPPY LAB STUDIO. All rights reserved.