Privacy policy
Last updated: 5 November 2026
Koto Design Limited is an architecture and design studio. This policy explains what personal information we collect, why we collect it, who we share it with and the choices you have.
Who we are
Koto Design Limited is the data controller for the information described here. We are registered in England and Wales under company number 10951752. Our registered office is 1 Fosketh Terrace, Westward Ho!, Bideford, Devon EX39 1AG. We are registered with the Information Commissioner's Office under number 00013383315.
If you have a question about this policy or about your information, email poppy@koto.co.uk or write to us at the address above.
What this policy covers
It covers the koto.co.uk website, the enquiry forms on it, the emails, calls and meetings that follow an enquiry, our work with clients and the people they appoint, our suppliers and manufacturing partners, our social media accounts and the advertising we run on Meta and Google.
It does not cover other companies' websites that we link to, which have their own policies.
The information we collect
When you enquire. Our enquiry forms ask for your name, email address, phone number if you choose to give it, the organisation you represent, where the site or property is, what you have in mind, roughly when you want to start and when you would like to talk. If you arrive from one of our advertisements, the form also records which advertisement brought you, so we know what is working.
When we talk. We keep the emails, messages, notes and documents exchanged with you. We record and transcribe introductory video calls using a notetaking service so the team can refer back to what was discussed. The notetaker joins the call as a visible participant, and you can ask us to switch it off at any time.
When we work together. A project involves site addresses, land and planning details, drawings, budgets, contracts, invoices and the contact details of the people on your side and ours.
When you download or subscribe. If you request our lookbook or a guide, or sign up for updates, we keep your name and email address and a record of what you asked for.
When you visit the website. Our website and advertising tools collect technical information: your device and browser, your approximate location from your IP address, the pages you look at and how you reached them, and an identifier set by a cookie if you have allowed cookies. The section on advertising, analytics and cookies explains this.
On social media. If you follow, message or interact with our Instagram, Facebook or LinkedIn accounts, we see what those platforms show us, under their own policies.
We do not ask for, and do not want, any special category information such as health details. If a project needs something of that kind, for example an accessibility requirement for a home, we will ask you for it directly and explain why.
How we use it, and why we are allowed to
UK data protection law requires a lawful basis for each use. These are ours.
Replying to your enquiry, arranging a call and sending you information about how we work and what it costs. Basis: taking steps at your request before a contract, and our legitimate interest in running the studio.
Designing and delivering a project, including sharing details with the manufacturers, engineers and consultants working on it. Basis: performing our contract with you.
Keeping project, financial and insurance records. Basis: legal obligations under tax and company law, and our legitimate interest in defending claims.
Recording and transcribing introductory calls. Basis: our legitimate interest in accurate notes; the notetaker is visible in the call and you can ask for it to be switched off.
Sending occasional updates about our work to people who have enquired or worked with us. Basis: our legitimate interest in staying in touch with business contacts, and consent where the law requires it. Every message has an unsubscribe link.
Sending the lookbook or a guide you have requested. Basis: performing what you asked for.
Measuring how the website and our advertising perform. Basis: your consent for cookies and similar technologies, and our legitimate interest in understanding aggregated results.
Showing our advertising to people likely to be interested, including people who have visited the site or enquired before. Basis: your consent for cookies, and our legitimate interest in reaching the right audiences, with the opt-outs described below.
Protecting the website, our systems and our people. Basis: our legitimate interest in security.
Where we rely on legitimate interests we have weighed them against your rights, and you can object at any time (see Your rights).
Advertising, analytics and cookies
We advertise on Instagram and Facebook (Meta) and measure the website with Google Analytics. To do this we use the following tools.
Meta pixel and Conversions API. With your consent, the Meta pixel on our website tells Meta which pages you visit and when you send an enquiry. We also send the same event information to Meta directly from our systems (the Conversions API) so that it is not lost when a browser blocks cookies. Meta uses this to show our advertisements to people who have visited the site, to find people with similar interests, and to report how our advertising performs. Meta is a separate controller for what it does with this information under its own privacy policy.
Customer lists. We may upload the email addresses of people who have enquired or worked with us to Meta as a customer list. The list is hashed (scrambled) before it leaves us, Meta uses it only to match the people on it against its own users so that we can show them our advertising or find similar audiences, and Meta does not keep the list for its own purposes. If you would rather not be included, email us and we will remove you.
Google Analytics and Google Tag Manager. With your consent, Google Analytics tells us how people use the website, in aggregate: which pages are read, how visitors arrive, and which enquiries follow which pages. Google Tag Manager is the tool that loads these tags. Google's use of the information is described in its privacy policy.
Forms and bookings. Our enquiry forms are provided by Typeform and the details you enter are stored with Typeform and in our Monday.com system. The forms carry a hidden reference to the advertisement or page you came from.
Cookies. The website sets cookies in three groups. Essential cookies are needed for the site to work (Squarespace's own cookies for security, load balancing and remembering your cookie choice). Analytics cookies belong to Google Analytics. Advertising cookies belong to Meta. Only the essential ones are set until you accept the others in the cookie banner, and you can change your choice at any time through the banner or your browser settings.
Opting out. You can decline analytics and advertising cookies in our banner; turn off ad personalisation in your Meta ad preferences and Google ad settings; install Google's opt-out add-on; or email us to be removed from any customer list we hold.
Who we share information with
We do not sell personal information. We share it only as follows.
Companies that provide our systems, who process it on our instructions: Squarespace (website hosting), Typeform (forms), Google (Workspace email and documents, Analytics, Tag Manager), Monday.com (enquiry and project tracking), Meta (advertising, as described above), our call notetaking service, DocuSign (signing agreements), our accounting software and our email service for updates.
The people working on your project, where you have appointed us: the manufacturing partners, engineers, surveyors, planning consultants and other specialists the project needs. They receive what they need to do their part of the work and no more. Where a client's project involves our sister studio Koto Living Limited for interiors and furniture, the two studios share the project information needed to work together.
Our professional advisers: accountants, insurers and lawyers, when the matter they are advising on requires it.
Authorities and courts, where the law requires it or to establish or defend legal claims.
A buyer of the business, if Koto Design Limited or substantially all of its assets are sold, in which case this policy continues to apply to your information.
Where information is kept
Our systems run on servers in the United Kingdom, the European Economic Area and the United States. Where a provider holds information outside the UK, we rely on the UK's adequacy decisions (including the UK extension to the EU-US Data Privacy Framework for certified US companies) or on the International Data Transfer Agreement or Addendum approved by the Information Commissioner, so that your information has protection equivalent to UK law.
How long we keep it
Enquiries that do not become projects, including call recordings and transcripts: 3 years from our last contact, so we can pick the conversation up if you come back.
Project records, drawings, contracts and correspondence: 15 years after the project ends, because of the time limits for professional liability claims.
Financial records: 7 years, as tax and company law require.
Marketing lists: until you unsubscribe or ask to be removed.
Website analytics: 14 months in Google Analytics, then aggregated.
Advertising audiences: website visitor audiences last up to 180 days; customer lists are refreshed or deleted when we review them.
When a period ends we delete the information or anonymise it so it no longer identifies you.
Your rights
You can ask us to:
tell you what information we hold about you and give you a copy
correct anything that is wrong
delete your information, where we have no good reason to keep it
stop using it for direct marketing, which we will always do
restrict or object to other uses based on our legitimate interests
give you the information you provided in a form you can take elsewhere
withdraw consent you have given, for example for cookies, without affecting what was done before
Email poppy@koto.co.uk. We will reply within one month. We may ask you to confirm who you are first.
If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would welcome the chance to put things right first.
Children
Our website and services are for adults and businesses. We do not knowingly collect information from anyone under 18, and we will delete it if we learn that we have.
Security
We keep your information in systems with access controls, two-factor authentication and encryption in transit, and only the people who need it to do their work can see it. No system is completely secure, so if you are sending us something sensitive, ask us for a secure way to do it.
Links to other websites
We link to other companies' websites, including our manufacturing partners' and our clients' booking pages. Their privacy policies, not this one, apply there.
Changes to this policy
We will update this page when our practices change and show the date at the top. If a change affects you significantly, we will tell you directly where we can.
Contact
Koto Design Limited, 1 Fosketh Terrace, Westward Ho!, Bideford, Devon EX39 1AG. Email poppy@koto.co.uk.