Legal

Privacy Policy

Last updated: 17 June 2026

1. Who we are

The Access Studio ("we", "us", "our") is a London-based model management and photography studio operating from Shoreditch, London. We are the data controller for the personal information described in this policy. You can reach us at enter@theaccessstudio.co.uk.

2. What we collect

Application data: name, email, phone, age, height, location, social handles, and any photos or notes you submit.
Account data: if you have a member portal account, your login credentials and profile information.
Payment data: when you pay for a package, payment is processed by our payment provider (e.g. Stripe). We receive a confirmation and the last four digits of your card — we never see or store your full card details.
Usage data: basic technical information such as IP address, device type and pages visited, used to keep the site secure and improve it.

3. Why we use it (and our lawful basis)

To review your application and contact you about it — legitimate interest and steps prior to entering a contract.
To deliver the access package you've paid for (studio sessions, submissions, portfolio hosting) — contract.
To submit you to castings, brands and UGC briefs we believe match your profile — contract (paid members) or consent (Free Access).
To process payments and keep records required by HMRC — legal obligation.
To send service emails (e.g. shoot confirmations, account updates) — contract. Marketing emails only with your consent, with an unsubscribe link in every one.

4. Who we share it with

We do not sell your data. We share limited information only with:

Casting directors, agencies and brands we submit you to — and only the parts of your profile relevant to that submission.
Service providers we rely on to run the studio: our hosting provider, our database/auth provider (Lovable Cloud / Supabase), our email provider (Resend) and our payment provider (Stripe). Each is bound by data protection agreements.
Authorities where required by law.

5. International transfers

Some of our service providers process data outside the UK. Where they do, we rely on UK-approved safeguards (UK International Data Transfer Agreement / Addendum to the EU SCCs).

6. How long we keep it

Application data for unsuccessful applicants: up to 12 months, then deleted.
Member data: for the duration of your access plus 24 months, then deleted or anonymised.
Payment and tax records: 6 years, as required by HMRC.

7. Your rights under UK GDPR

You have the right to access, correct, delete, restrict or port your personal data, and to object to processing based on legitimate interest. Where we rely on consent, you can withdraw it at any time. To exercise any right, email enter@theaccessstudio.co.uk. We respond within 30 days. If you're unhappy with our response, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.

8. Cookies

We use a small number of essential cookies to keep you logged in and to keep the site secure. We do not use advertising cookies. If we add analytics in future we will ask for consent first.

9. Security

Data is stored on encrypted, access-controlled infrastructure with row-level security. Admin access is limited to named staff. No system is perfectly secure — if a breach affects your data, we'll notify you and the ICO within 72 hours where required.

10. Changes

We may update this policy. Material changes will be communicated by email to active members. The "last updated" date above always reflects the current version.