UNDER·STUDY
The Model What We Do The Playbook The Benchmark Insights Pricing About Apply
Understudy · Privacy

[REVIEW: solicitor — placeholder, not final]

Privacy Policy

How we collect, use and protect your personal data — and the rights you have over it under UK data protection law.

Last updated: 2026. This policy is written to be UK GDPR-aware and is provided as a placeholder pending review by a qualified solicitor.

1. Who we are

Understudy ("we", "us", "our") is the operating company behind the creator described on this website. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Understudy is the data controller for the personal data described in this policy. Our contact details for data matters are set out in section 9.

2. What data we collect

We only collect data we actually need. Depending on how you interact with us, this may include:

  • Contact and application data — your name, email address, social media handle, platforms, follower range, and the information you choose to share about what you've built and what you want, when you submit our contact or application forms.
  • Communications — the content of messages you send us and our replies.
  • Technical data — limited information your browser sends automatically, such as IP address and device or browser type, where this is collected by our hosting or analytics providers.

We do not knowingly collect special-category data, and we ask that you do not send it to us through our forms.

3. Why we use it and our lawful basis

We process your data on the following lawful bases under UK GDPR:

  • Legitimate interests — to respond to your enquiry, assess applications, and run and improve our business, where this is not overridden by your rights.
  • Consent — where you opt in to receive a report, newsletter or other marketing, which you can withdraw at any time.
  • Contract — where processing is necessary to take steps at your request before entering into, or to perform, an agreement with you.
  • Legal obligation — where we must keep records to comply with the law.

4. Marketing

If you ask us for a report or sign up to hear from us, we will send you relevant updates. Every marketing message includes a way to unsubscribe, and you can opt out at any time by contacting us or using the link in the email.

5. Who we share it with

We do not sell your personal data. We share it only with trusted service providers who help us operate — for example form handling, email, hosting and analytics — and only to the extent they need it to provide their service. These providers act on our instructions under appropriate agreements. We may also disclose data where required by law.

6. International transfers

Some of our service providers may process data outside the UK. Where they do, we take steps to ensure an appropriate level of protection, such as relying on adequacy regulations or standard contractual clauses with UK addendums.

7. How long we keep it

We keep personal data only for as long as necessary for the purposes set out above, after which it is deleted or anonymised. Application and enquiry data is retained for a reasonable period to allow us to follow up, then removed where there is no ongoing relationship.

8. Your rights

Under UK GDPR you have the right to:

  • be informed about how your data is used;
  • access a copy of the data we hold about you;
  • have inaccurate data corrected;
  • have your data erased in certain circumstances;
  • restrict or object to processing;
  • data portability; and
  • withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us using the details below. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, though we'd ask you to come to us first so we can put things right.

9. Cookies and analytics

This site uses only the cookies necessary for it to function and, where applicable, privacy-conscious analytics to understand how the site is used. Where any non-essential cookies are introduced, we will request your consent first.

10. Contact

For any data protection question, or to exercise your rights, contact us via our contact page. We aim to respond within one month, in line with UK GDPR.

11. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top shows when it last changed. Material changes will be made clear on this page.