Privacy & Cookie Policy
Keeping you informed.
Last updated: 24 August 2026
1. Who we are
ATLUS Design Ltd (ATLUS, we, us or our) is the controller of personal information described in this policy. This means that we decide why and how that information is used.
ATLUS Design Ltd is registered in England and Wales under company number 17294453. Our registered office is 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.
This policy explains how we collect, use, share and protect personal information when you:
visit https://www.atlus-design.com/ (the Website);
contact us about our services or a potential project;
act as a client, prospective client, supplier, consultant, collaborator or other business contact;
apply for a role or send us recruitment information; or
otherwise communicate with us in connection with the Website.
In some professional engagements, a client may provide personal information that ATLUS processes only on the client's documented instructions. In that situation, the client is normally the controller, ATLUS acts as its processor, and the relevant project contract or data-processing terms will govern that activity.
Our contact details for privacy matters are in section 18.
2. Personal information we collect
The information we collect depends on how you interact with us and may include:
Contact and enquiry information
your name, work email address, telephone number, job title and organisation;
your correspondence with us;
information about a potential project, site, asset, requirement, budget or programme; and
documents, drawings, images or other files you choose to provide.
Client, supplier and professional-contact information
business contact details and relationship history;
proposal, appointment, contract, project and account information;
records of meetings, instructions, decisions and correspondence; and
payment and transaction information where relevant to our relationship.
Recruitment information
If you apply for a role or register an interest in working with us, we may collect:
your contact details;
your CV, portfolio, employment history, education, qualifications and skills;
information you provide in an application or interview;
work eligibility information and references where appropriate; and
records of our assessment and communications with you.
Please do not include special-category information—such as details about health, ethnicity, religion, political opinions, trade-union membership, genetics, biometrics or sexual life or orientation—unless it is relevant, necessary and requested. Where we need to use special-category or criminal-offence information, we will do so only where the law permits and with appropriate safeguards.
Website and device information
When you visit the Website, we and our website provider may receive:
your IP address;
browser, network, operating-system and device information;
referring pages and links;
pages viewed and the date and time of visits;
interactions such as clicks, internal links, scrolling and searches; and
cookie identifiers, consent choices and diagnostic or security logs.
Some of this information is collected using cookies and similar technologies. Section 9 explains this in more detail.
Marketing preferences
If we offer updates or marketing communications and you choose to receive them, we may keep your contact details, preferences and a record of consent or opt-out requests.
We do not intentionally collect payment-card details through the Website.
3. How we collect personal information
We collect information:
directly from you, including by email, telephone, meetings and any form we make available;
from your employer, colleague, agent or another organisation involved in a project or business relationship;
automatically when you use the Website;
from recruitment agencies, professional networks or referees where relevant; and
from public professional sources, such as an organisation's website or Companies House, where it is reasonable and lawful to do so.
If you provide personal information about another person, you should make sure you are authorised to do so and, where appropriate, that they have been given this policy.
4. How and why we use personal information
UK data protection law requires us to have a lawful basis for each use of personal information. Depending on the circumstances, we use personal information for the following purposes and bases.
Responding to enquiries and preparing proposals
We use contact details, correspondence and project information to understand and respond to an enquiry, arrange discussions, assess whether we can assist, and prepare a proposal or quotation.
Our lawful basis is taking steps at your request before entering a contract, or our legitimate interests in responding to business enquiries and developing our services. Where you act for an organisation, we will usually rely on legitimate interests.
Providing and managing services and business relationships
We use relevant contact, contract, project and transaction information to enter into and perform agreements, deliver and administer services, communicate about projects, manage suppliers and collaborators, invoice, maintain business records and support our clients.
Our lawful bases are performance of a contract, compliance with legal obligations and our legitimate interests in operating and protecting our business and managing professional relationships.
Recruitment
We use application information to communicate with candidates, assess suitability, arrange interviews, check eligibility and references where appropriate, and make recruitment decisions.
Our lawful bases are taking steps before entering an employment contract, complying with employment and other legal obligations, and our legitimate interests in recruiting and managing candidates. If we ask to retain an unsuccessful candidate's details for a future opportunity, we will normally rely on their consent.
Operating, securing and improving the Website
We use technical, usage and diagnostic information to deliver the Website, protect it and our systems, prevent spam and misuse, investigate faults, understand general performance, and improve content and user experience.
For functions that are strictly necessary to operate and secure the Website, our lawful basis is our legitimate interests in providing a reliable and secure website. Where the law requires consent for analytics or another non-essential technology, we rely on your consent and do not use that technology until consent has been given.
Marketing and professional communications
We may use business contact details to send relevant information about ATLUS and our services where permitted by law. Our lawful basis may be consent or our legitimate interests in developing professional relationships and promoting our services. We will respect marketing preferences, and every electronic marketing communication will provide a straightforward way to opt out.
Legal, regulatory and business protection
We use information where necessary to meet legal, tax, accounting, insurance and regulatory requirements; prevent or investigate fraud and security incidents; establish, exercise or defend legal claims; enforce agreements; and protect our rights, property and people.
Our lawful bases are compliance with legal obligations and our legitimate interests in protecting and administering our business.
Business changes
If we consider or carry out a reorganisation, investment, sale, merger or transfer of all or part of our business, relevant information may be reviewed and disclosed under suitable confidentiality arrangements. Our lawful basis is our legitimate interests in planning and carrying out a legitimate business transaction.
Where we rely on legitimate interests, we consider whether the use is necessary and balance our interests against your rights and reasonable expectations. You can ask for more information about this assessment.
5. If you do not provide information
You may choose whether to make a general enquiry. If we need particular information to respond, prepare a proposal, enter or perform a contract, assess an application or comply with law, we will normally explain this. If you do not provide it, we may be unable to respond fully, proceed with an engagement or consider an application.
6. Who we share personal information with
We do not sell personal information.
We share information only where reasonably necessary and may share it with:
Squarespace, which hosts and supports the Website and provides website analytics and related services;
providers of business email, cloud storage, IT support, cybersecurity, document management and other systems we use to run our business;
professional advisers, including solicitors, accountants, insurers and auditors;
engineering consultants, subconsultants, suppliers, project partners and clients where this is necessary for an enquiry, proposal or agreed service and is consistent with our obligations;
recruitment agencies, referees and screening providers where relevant to an application;
regulators, courts, law-enforcement bodies, government authorities or other parties where disclosure is required or permitted by law; and
prospective buyers, investors or advisers involved in a genuine corporate transaction, subject to appropriate confidentiality measures.
Service providers acting on our behalf are permitted to use personal information only for the agreed service and must protect it appropriately. Some providers, including Squarespace, may also process limited information for their own purposes under their own privacy notices.
7. International transfers
Some of our service providers operate, store information or provide support outside the United Kingdom, including in the United States. This means personal information may be transferred to a country with different data protection laws.
Where a restricted transfer takes place, we use an approved protection where required. This may include:
a UK adequacy regulation;
the UK Extension to an approved data privacy framework where applicable;
the UK International Data Transfer Agreement;
the UK Addendum to the European Commission's standard contractual clauses; or
another legally permitted safeguard.
We also consider whether additional technical or organisational safeguards are appropriate. You can contact us for more information about the safeguards relevant to your information.
8. Fonts and third-party services
The Website currently uses Squarespace services and Adobe Fonts. When font files or other website resources are delivered, the relevant provider's servers may receive technical information such as your IP address and browser, network or device details so that the content can be supplied and protected.
The Website may also contain links to third-party sites such as LinkedIn. Following a link takes you to a service that controls its own collection and use of information. Its privacy notice will apply to that service.
If we add embedded video, maps, booking tools, advertising pixels or other third-party services, we will review this policy and our cookie controls before enabling them.
9. Cookies and similar technologies
Cookies are small files or pieces of data stored or read on a device when a website is visited. Similar technologies can include local storage, pixels and scripts.
Strictly necessary and functional cookies
Squarespace uses required cookies and similar technologies to securely serve the Website, provide its basic functions, prevent abuse, maintain sessions and remember privacy choices. These technologies are necessary for the service requested and cannot normally be switched off through our cookie controls, although browser settings may block them and could affect how the Website works.
Analytics and performance cookies
With your consent, we use Squarespace Analytics to understand general Website traffic and activity, such as pages visited, referrals and interactions. This helps us assess performance and improve content. Analytics and performance cookies will not be placed until you make an affirmative choice through the cookie banner where consent is required.
Advertising and marketing cookies
We do not currently knowingly use advertising or remarketing cookies on the Website. If this changes, we will update this policy and request consent before those technologies are used where required.
Managing your choices
When you first visit the Website, the cookie banner allows you to accept or reject non-essential cookies. You can change or withdraw your choice at any time using the Cookie Settings link on the Website. Withdrawal does not affect the lawfulness of processing that took place before it.
You can also block or delete cookies using your browser settings. Blocking required cookies may cause parts of the Website not to work correctly.
Squarespace's current description of the cookies its platform may use is available at: https://support.squarespace.com/hc/en-us/articles/360001264507-The-cookies-Squarespace-uses.
The exact cookies used can change when Website features or providers are added, removed or updated. We review the live Website and this section periodically so that the information remains accurate.
10. Direct marketing
You can ask us to stop sending marketing communications at any time by using the unsubscribe method in the message or emailing info@atlus-design.com.
Opting out of marketing does not prevent us from sending non-marketing communications needed for an enquiry, project, contract or legal obligation. We may keep a minimal suppression record so that we can respect an opt-out.
We do not sell personal information or share it with unrelated organisations for their own direct marketing.
11. How long we keep personal information
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, insurance and reporting requirements. We consider the nature and sensitivity of the information, the risk of harm, the purpose of use and any applicable limitation or contractual periods.
Our usual starting points are:
Enquiries that do not become projects: up to 24 months after the last meaningful contact, unless a longer period is reasonably needed for a live opportunity, dispute or legal obligation.
Client, contract and project records: for the engagement and normally for 7 years after completion or the end of the relationship. We may retain relevant records longer where a contract executed as a deed, professional-indemnity requirement, project lifespan, legal claim or other legal or regulatory reason requires it.
Supplier and professional-contact records: for the relationship and normally up to 7 years afterwards where they form part of contractual, tax or project records.
Unsuccessful recruitment applications: normally for up to 6 months after the recruitment decision. If you agree to join a future-opportunities or talent pool, we may retain relevant information for up to 12 months and then ask whether you want us to keep it longer.
Successful recruitment applications: relevant information becomes part of the individual's employment record and is retained under our employee privacy and retention arrangements.
Marketing preferences: while communications continue. We may keep a minimal record of an opt-out for as long as needed to ensure we do not market to you again.
Website analytics and security information: in accordance with our provider settings and for no longer than is reasonably needed for analytics, security and fault investigation. Aggregated information that no longer identifies anyone may be kept for longer.
We may retain information for longer if required by law, a regulator, an insurer, a legal hold or an actual or reasonably anticipated claim. We may securely delete or anonymise information when it is no longer needed.
12. Security
We use reasonable technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure, destruction or access. Measures may include access controls, reputable service providers, secure configurations, backups and staff or contractor confidentiality obligations as appropriate.
No internet transmission or storage system is completely secure. Please take care when deciding what to send by ordinary email or through a general website form. Contact us before sending particularly sensitive or security-critical project information so that an appropriate method can be agreed.
13. Your data protection rights
Depending on the circumstances, UK data protection law gives you rights to:
access your personal information and receive a copy;
correct inaccurate or incomplete information;
erase information in certain circumstances;
restrict how information is used in certain circumstances;
object to processing based on legitimate interests and to direct marketing;
receive or transfer certain information in a portable format where the right applies; and
withdraw consent at any time where we rely on consent.
These rights are not absolute and exemptions may apply. We may need to ask for information to confirm your identity and understand your request. We will not normally charge a fee and will respond within the period required by law.
To exercise a right, email info@atlus-design.com and describe your request.
14. Your right to object
You have an absolute right to object at any time to our use of your personal information for direct marketing.
You may also object where we rely on legitimate interests. In that case, we will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.
15. Automated decisions
We do not use Website visitor, enquiry or recruitment information to make decisions that have legal or similarly significant effects solely by automated means.
16. Children
The Website and our services are directed at businesses and professionals, not children. We do not knowingly collect personal information from children through the Website. If you believe a child has provided information to us, please contact us so that we can review and, where appropriate, delete it.
17. Changes to this policy
We may update this policy when our services, Website technology, providers or legal obligations change. The revised policy will be posted on the Website and the date at the top will be updated. Where appropriate, we will provide additional notice of a significant change.
18. Contact and complaints
For questions, requests or complaints about personal information, contact:
Email: info@atlus-design.com
Post: ATLUS Design Ltd, 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
Please contact us first so that we have an opportunity to address your concern.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. Information about making a complaint is available at https://ico.org.uk/make-a-complaint/data-protection-complaints/, or you can telephone the ICO on 0303 123 1113.
If you are outside the United Kingdom, you may also have the right to contact the data protection authority where you live or work.