Your data
Privacy notice
This page explains what data mamakatiopa.com and Bana Bilaka Studio process, why, for how long, and how to exercise your rights. It follows the information the UK GDPR requires us to give you, as set out by the Information Commissioner's Office (ICO) in its "right to be informed" guidance.
Who is responsible for your data
The data controller is MAMAKATIOPA LTD (trading as Bana Bilaka Studio), a company registered in England and Wales, number 13332618, registered office 104 Whitmore Road, Birmingham, England, B10 0NP. Contact: hello@banabilaka.com, WhatsApp +44 7751 198490. Given the size of the business, no data protection officer has been appointed, which is not a legal requirement at this scale; data requests are handled directly at the address above.
No cookies, but technical resources loaded from third parties
This site sets no cookies and uses no third-party analytics, advertising or tracking tool. It does load two technical resources hosted elsewhere, needed to display it: the site's fonts, served by Google Fonts (fonts.googleapis.com, fonts.gstatic.com), and an animation script, served by Cloudflare through cdnjs.cloudflare.com. Loading these resources mechanically sends your IP address to Google and to Cloudflare, as with any element loaded from an external server, without setting a cookie on your device or any tracking on our part.
The server that hosts this site does, however, keep a visit log, with no cookie: for each visit it records the page requested, the date and the browser used, with the IP address truncated (the last two octets erased). The log is used only to measure traffic and keep the site secure, and is kept for 90 days at most.
If a measurement tool or advertising pixel is ever added to this site, a consent banner will be put in place before it goes live, and this page will be updated to reflect it, in line with the Privacy and Electronic Communications Regulations (PECR) on non-essential cookies.
What data we process
When you write to us on WhatsApp or by email, we receive whatever you choose to tell us: your name, phone number or email address, and the content of your message (your project, your budget, your timeline).
The site also has four forms: quote request, contact, Academy waitlist, and the house letter. Depending on the form you fill in, we receive:
- your name, email address, phone number (optional), project type, budget, timeline and message, for a quote request;
- your name, email address and message, for the contact form;
- your email address, for the Academy waitlist and for the house letter.
Every form submission also automatically records: the consent box you ticked and the text shown next to it at the time you sent it, the page you wrote from, the form's language, and the IP address and browser type (user agent) your device sends to any server it contacts.
We collect nothing else, and we do not gather anything about you from any third party.
Why we process it, and on what legal basis
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Responding to your quote or information request | Legitimate interest in promoting and selling our services (art. 6.1.f) |
| Preparing, sending and revising a quote | Legitimate interest, then performance of the contract once the quote is signed (art. 6.1.b) |
| Delivering the project you commissioned | Performance of the contract (art. 6.1.b) |
| Keeping invoices and accounting records | Legal obligation to keep accounting records (art. 6.1.c) |
| Handling your quote request or message sent through the site's forms | Steps taken at your request, prior to a contract (art. 6.1.b) |
| Adding you to the Academy waitlist or sending you the house letter | Your consent, which you can withdraw at any time (art. 6.1.a) |
| Securing our forms, preventing abuse, and keeping proof of your consent | Legitimate interest (art. 6.1.f) |
We do not use your data for any other purpose, and we do not send you marketing messages without your explicit consent.
Who your data is shared with
Your data stays within the Bana Bilaka Studio team. It is never sold, rented, or shared with a third party for commercial purposes. Several technical providers do have access to it, purely to run the tools we use for contact and for our forms:
- Meta, which runs WhatsApp, processes the messages you send us through that app under its own privacy policy; we do not control how it processes that data and encourage you to read it directly on whatsapp.com.
- Our email provider hosts the messages you send us, under the standard terms of a business email service.
- The site's forms are sent to our n8n automation, hosted on the same server as the site, then recorded by Supabase Inc. in a database hosted in Ireland (eu-west-1 region, on Amazon Web Services infrastructure), so we can read them and reply to you.
- A notification of every form submission is sent instantly to the studio's phone through Telegram Messenger Inc., so we can respond quickly to your request.
- Google LLC provides the site's fonts (Google Fonts) and Cloudflare, Inc. provides an animation script (cdnjs); both providers receive your IP address when the page loads, without setting a cookie or tracking on our part.
Transfers outside the UK
This site is hosted on a server located in Finland, and the Supabase database that records your form submissions is hosted in Ireland: both countries are in the European Union, and this transfer is covered by the UK's adequacy decision for the European Economic Area, with no extra safeguard needed.
WhatsApp (Meta), Telegram Messenger Inc., Google LLC and Cloudflare, Inc. are all US-based companies, outside the UK and the EU, and may transfer the data you send them as part of running their own service, under their own safeguards. We have no control over those transfers and point you to each provider's own privacy policy for the safeguards it applies.
How long we keep it
How long we keep your data depends on the nature of your request:
- a quote request or contact message that led nowhere: 3 years from our last exchange with you;
- a quote request that became an order: for as long as our business relationship lasts, then 6 years after it ends, to meet our accounting obligations under UK law;
- an Academy waitlist or house letter subscription: until you unsubscribe;
- the IP address and browser type recorded with a form: 12 months.
After these periods, your data is deleted.
Your rights
Under the UK GDPR, you have the right to:
- ask for access to the data we hold about you;
- ask us to correct it if it is inaccurate;
- ask us to erase it, within the limits of our legal retention duties;
- object to processing based on our legitimate interest;
- withdraw, at any time, a consent given for the Academy waitlist or the house letter, with no effect on the lawfulness of processing carried out before that withdrawal, by writing to us at hello@banabilaka.com;
- lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection authority, at ico.org.uk/make-a-complaint, if you believe your rights have not been respected.
To exercise any of these rights, write to us at hello@banabilaka.com. We reply within the one-month period the law allows us.
Last updated: 8 October 2026.