Privacy and cookies
Last updated: 2 November 2026
Who we are
The data controller is Blackin Design Ltd, London, United Kingdom, referred to below as “BLVCKIN”. You can write to us at blvckindesign@gmail.com.
What data we process and why
| Situation | Data | Purpose | Legal basis (GDPR art. 6) |
|---|---|---|---|
| Contact form and emails | Name, email, your message | To reply and prepare an offer | Steps before a contract (b) or legitimate interest (f) |
| Client area account | Name, email, password (stored only as a cryptographic hash), language, the projects you can access | To give you access to your project | Performance of a contract (b) |
| Project materials | Renders, plans, documents and updates, which may include details about your home | To deliver the design services | Performance of a contract (b) |
| Comments and approvals in the portal | Your name, your comments on renders, the name you sign with when you approve a stage, its date | To work on the project with you and keep a record of what was approved | Performance of a contract (b) |
| Portal emails | Name, email | Invitations, password resets, project news | Performance of a contract (b) |
| Backups | The account and project data above, without passwords | Recovery after an incident | Legitimate interest (f) |
| Traffic statistics | Pages visited, online identifiers, device details | To understand how the site is used | Consent (a) |
We do not sell your data and we make no automated decisions with legal effects on you.
Who receives the data
We use providers that process data on our behalf:
- Netlify: hosting of the site and portal, receiving form messages.
- Supabase: portal accounts and database, in an EU region (Frankfurt).
- Cloudflare R2: storage of project files and backups, in the EU.
- Google: sending emails (Gmail) and, only with your consent, Google Analytics.
We may also pass data to authorities when the law requires it.
Transfers outside the EU
We are based in the United Kingdom, and some providers are based outside the EU, for example in the US. In those cases we rely on the safeguards in the GDPR and the UK GDPR, such as standard contractual clauses or an adequacy decision.
How long we keep data
- Contact messages with no contract following: 2 years.
- Account and project materials: for the project and 3 years after completion, or less if you ask us to delete them and we have no duty to keep them.
- Accounting documents: as long as the law requires.
- Backups: the latest 10 copies, one every 3 days, so about a month.
- Google Analytics statistics: for the period set in our Google Analytics account.
Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent, which does not affect what was done until then. For any of these, write to the address above. We reply within one month.
You can complain to the data protection authority in your country: in Romania the ANSPDCP, www.dataprotection.ro, and in the United Kingdom the ICO, ico.org.uk.
The data needed for an account and project is required to use the portal. Without it we cannot give you access.
Cookies and local storage
| Name | Role | Duration | Consent |
|---|---|---|---|
| cookie-consent | Remembers your cookie choice (local storage) | Until you delete it | No, necessary |
| nf_country | Remembers the language chosen on the site | Up to 1 year | No, necessary |
| blvckin-theme, blvckin-grid | Remember the portal theme and the number of columns (local storage) | Until you clear your data | No, necessary |
| sb-…-auth-token, locale | Keeps you signed in to the portal and remembers the language (local storage) | Until you sign out or clear your data | No, necessary |
| _ga, _ga_* | Google Analytics: traffic statistics | Up to 2 years | Yes |
You can change your choice at any time from the Cookie settings link, also at the foot of every page.
Security
Access to projects is limited to the people attached to them, and files are kept in private storage and open through links that expire. No measure removes all risk, so we recommend a unique password.
Changes
If we update this policy, we publish the new version here and change the date above.