Privacy Policy
How Magic Three collects, uses and protects your information.
- Last updated: 7 August 2026
- Estimated reading time: 14 minutes
01. WHO WE ARE
Magic Three is an independent creative studio based in London, United Kingdom. We provide branding, website design, digital marketing, content production, printing, signage, display and packaging services.
For the purposes of UK data protection law, Przemyslaw Mackaszwili, trading as Magic Three, is the data controller responsible for personal information collected through magicthree.co.uk and in connection with our services.
In this Privacy Policy, “Magic Three”, “we”, “us” and “our” refer to the business operating under the Magic Three name. You can contact us using the details provided in the Contact us section of this policy.
02. Personal information we collect
The personal information we collect depends on how you interact with Magic Three. It may include:
Identity and contact information — your name, company or business name, email address, telephone number and WhatsApp details.
Enquiry and project information — your website address, the services you are interested in, your business challenges, preferred contact method, intended timescale, project brief and any other information included in your enquiry.
Files and creative materials — logos, photographs, artwork, documents and other files you upload through our website or provide during a project.
Client and transaction information — quotations, contracts, invoices, payment status, services purchased and correspondence relating to our work with you.
Technical and website usage information — such as your IP address, browser and device type, pages visited, referring website and cookie preferences. Where required, analytics and other non-essential technologies are used only with your consent. Further information is available in our Cookie Policy.
We do not intentionally request special category personal data, such as information about health, religious beliefs, political opinions or biometric data. Please do not provide this type of information unless it is necessary for a specific project and has been agreed with us in advance.
If you provide personal information relating to another person, including photographs or content featuring identifiable individuals, you must ensure that you are authorised to provide it to us.
03. How we use your personal information
We use personal information only where it is necessary and we have a lawful basis to do so. We may use your information for the following purposes:
Responding to enquiries — to contact you, discuss your requirements, assess whether we can assist and prepare an initial quotation. We rely on steps taken at your request before entering into a contract or our legitimate interest in responding to business enquiries.
Providing our services — to plan, manage and deliver agreed services, communicate with you, process project files, obtain approvals and provide support. We rely on the performance of a contract or, where the contract is with an organisation you represent, our legitimate business interests.
Managing payments and business records — to issue quotations and invoices, monitor payment status and maintain accounting and tax records. We rely on contractual necessity, legal obligations and our legitimate interest in managing our business.
Operating and protecting our website and business — to maintain website security, prevent spam, misuse and fraud, resolve technical problems and protect our legal rights. We rely on our legitimate interests and, where applicable, legal obligations.
Understanding website performance — to measure how visitors use our website and improve its content and functionality. Where this involves analytics or other non-essential cookies, we rely on your consent. You can change or withdraw your consent through the Cookie Settings panel.
Handling disputes and legal claims — to retain relevant communications and project records where necessary to establish, exercise or defend legal claims. We rely on our legitimate interests or legal obligations.
Where we rely on legitimate interests, these include operating and improving Magic Three, responding to clients and prospective clients, protecting our systems, recovering payments and defending our legal rights. We consider whether these interests are proportionate and whether your rights and freedoms could be affected.
We will not use your personal information for a materially different purpose without informing you and identifying an appropriate lawful basis.
04. How we collect your personal information
We may collect personal information from the following sources:
Directly from you — when you complete a website form, request a quotation, contact us by email, telephone, WhatsApp or social media, provide project materials, approve work or communicate with us during a project.
Through our website — when technical information is collected through server logs, cookies and similar technologies. Non-essential cookies are used only in accordance with your consent preferences.
From another person or organisation — for example, when a colleague, employer, business partner or existing client introduces you, includes you in project correspondence or provides your details in connection with an enquiry.
From publicly available business sources — such as company websites, professional social media profiles and business directories, where it is reasonable and lawful to use the information for relevant business communication.
From service providers — including payment, hosting, website security and analytics providers, where they provide information necessary to operate our website, deliver our services or manage transactions.
Where you provide personal information about another person, you must ensure that you are authorised to share it with us.
If we obtain your personal information from a source other than you, we will provide the required privacy information within the timeframe required by law, unless an applicable exemption applies.
05. Who we share your personal information with
We do not sell or rent your personal information.
Where necessary, we may share limited personal information with:
Website and technology providers — including providers of website hosting, email, online forms, file storage, security, analytics and cookie management services.
Professional advisers and business service providers — such as accountants, payment service providers, insurers and legal advisers.
Suppliers, subcontractors and production partners — including printers, sign manufacturers, installers, developers, photographers, videographers and couriers involved in delivering an agreed service.
Platforms or providers selected by you — where a project requires us to work with your website host, domain registrar, social media account, advertising platform or another service authorised by you.
Public authorities and legal bodies — where disclosure is required by law or is necessary to protect our rights, prevent fraud, recover payments or respond to legal proceedings.
We share only the information reasonably necessary for the relevant purpose. Where a recipient processes personal information on our behalf, we require appropriate contractual, confidentiality and security protections.
Some providers may process information outside the United Kingdom. Any such transfer is handled as described in the International transfers section of this Privacy Policy.
06. International transfers
Some of the service providers we use may store or process personal information outside the United Kingdom.
Where personal information is transferred internationally, we take steps to ensure that the transfer complies with UK data protection law. Depending on the destination and circumstances, we may rely on:
UK adequacy regulations — where the UK has recognised that the destination provides an adequate level of protection.
Appropriate safeguards — such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses.
Another legally permitted transfer mechanism — where applicable under UK data protection law.
Where required, we assess the risks associated with the transfer and any additional measures needed to protect the information.
You may contact us if you would like further information about the safeguards used for international transfers of your personal information.
07. How long we keep your personal information
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including any legal, accounting, tax or reporting requirements.
Our usual retention periods are:
Enquiries that do not become projects — normally up to 24 months after our last meaningful contact.
Client, project and correspondence records — normally for the duration of the project and up to six years after completion or the end of the client relationship.
Quotations, invoices and transaction records — for the period required by applicable tax, accounting and legal obligations.
Uploaded files and creative materials — normally for the duration of the project and for up to six years after completion where reasonably necessary for repeat production, project support, payment recovery, dispute resolution or legal claims. Files may be deleted earlier where they are no longer required.
Website, analytics and cookie information — for the periods described in our Cookie Policy or configured by the relevant service provider.
Consent and preference records — for as long as necessary to demonstrate that we have respected your choices and complied with our legal obligations.
We may retain information for longer where necessary to deal with a complaint, resolve a dispute, recover payment, establish or defend a legal claim, or comply with a legal requirement.
When personal information is no longer required, we will securely delete or anonymise it. We periodically review the information we retain and the reasons for keeping it.
08. How we protect your personal information
We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration, accidental loss, destruction or misuse.
Depending on the nature of the information and the risks involved, these measures may include:
limiting access to personal information to people who reasonably need it;
using password protection, access controls and multi-factor authentication where available;
maintaining website, device and software security;
using reputable hosting, email, storage and technology providers;
securely transferring, storing and disposing of project files and business records;
maintaining backups and procedures for responding to security incidents; and
requiring suppliers and subcontractors to protect information shared with them.
We regularly review our security arrangements and update them where reasonably necessary. However, no method of transmission or electronic storage is completely secure, and we cannot guarantee absolute security.
If we become aware of a personal data breach, we will assess it and notify the Information Commissioner’s Office and affected individuals where required by law.
09. Your data protection rights
Under UK data protection law, you may have the following rights in relation to your personal information:
Right of access — to request confirmation that we process your personal information and receive a copy of the information we hold about you.
Right to rectification — to ask us to correct inaccurate information or complete information that is incomplete.
Right to erasure — to ask us to delete your personal information in certain circumstances.
Right to restrict processing — to ask us to limit how we use your personal information in certain circumstances.
Right to data portability — to receive certain information you provided to us in a structured, commonly used and machine-readable format, or ask us to transfer it to another organisation where technically feasible.
Right to object — to object to processing based on our legitimate interests. You have an absolute right to object where your information is used for direct marketing.
Right to withdraw consent — where we rely on your consent, you may withdraw it at any time. This will not affect the lawfulness of processing carried out before consent was withdrawn.
Rights relating to automated decision-making — to request safeguards where a decision producing legal or similarly significant effects is made solely by automated means. Magic Three does not currently use personal information for this type of decision-making.
These rights are not absolute and may depend on the circumstances and the lawful basis on which we process your information.
To exercise any of your rights, please contact us using the details in the Contact us section. We may ask for information necessary to verify your identity and understand your request. We normally respond within one month and do not charge a fee, although the law allows limited exceptions.
10. Complaints
If you have concerns about how Magic Three has collected, used or protected your personal information, please contact us using the details in the Contact us section.
We will acknowledge a data protection complaint within 30 days of receiving it. We will take appropriate steps to investigate the matter, keep you informed where necessary and provide an outcome without undue delay.
You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK regulator for data protection:
Information Commissioner’s Office
Website: ico.org.uk/make-a-complaint
The ICO recommends giving us an opportunity to address your concerns first, but this does not affect your right to contact the ICO.
11. Children’s privacy
Our website and services are primarily intended for businesses and adults. We do not knowingly collect personal information directly from children through our website.
Some client projects may include photographs, videos, artwork or other materials containing information about children. In these circumstances, the client providing the materials is responsible for ensuring that they have an appropriate lawful basis, permissions and privacy information in place.
We use such materials only as necessary to deliver the agreed services and in accordance with the client’s documented instructions, applicable law and appropriate security measures.
If you believe that a child has provided personal information to us without appropriate authorisation, please contact us. We will review the circumstances and delete or restrict the information where appropriate.
We will not use identifiable photographs, videos or other materials featuring children in our portfolio or promotional materials unless the Client has confirmed in writing that an appropriate lawful basis and all necessary permissions cover that use.
12. Third-party links
Our website may contain links to websites, platforms or services operated by third parties.
When you follow an external link, the third party may collect and use personal information in accordance with its own privacy policy. Magic Three does not control how independent third parties process your information, and this Privacy Policy does not apply to their websites or services.
We recommend reviewing the privacy information provided by each third party before submitting personal information or using its services.
13. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our services, website, technology providers, business practices or legal obligations.
The latest version will always be published on this page. When we make changes, we will update the “Last updated” date shown at the top of the policy.
Where a change materially affects how we use personal information, we will provide additional notice where appropriate or required by law.
We recommend reviewing this Privacy Policy periodically to remain informed about how we collect, use and protect personal information.
14. Marketing communications
We may use your contact information to send relevant updates about Magic Three’s services, previous projects or opportunities that may be of interest to you, where permitted by law.
Depending on the recipient and method of communication, we may rely on your consent or our legitimate interests in promoting our services. Where consent is required under the Privacy and Electronic Communications Regulations, we will obtain it before sending marketing communications unless a lawful exception applies.
Submitting an enquiry or becoming a client does not automatically mean that you have agreed to receive marketing communications.
You can ask us to stop using your personal information for direct marketing at any time by:
using the unsubscribe option included in the communication, where available; or
contacting us using the details in the Contact us section.
We will action your request as soon as reasonably possible. We may retain limited information on a suppression list to ensure that we continue to respect your preference.
15. Cookies and similar technologies
Our website currently uses cookies and similar technologies that are necessary to operate and protect the website, prevent spam and record your cookie preferences.
If we introduce analytics, advertising or other non-essential technologies in the future, they will not be activated unless you provide consent where required.
You can review or change your choices at any time through the Cookie Settings panel.
Further information about the technologies currently used, their purposes and duration is available in our Cookie Policy.
16. If you do not provide personal information
You are not generally under a statutory obligation to provide personal information to Magic Three. However, certain information may be necessary for us to respond to your enquiry, prepare a quotation, enter into an agreement or deliver the requested services.
Where information is required, we will normally identify this in the relevant form, communication or project documentation.
If you do not provide information that is reasonably necessary, we may be unable to:
respond fully to your enquiry;
assess your requirements or prepare an accurate quotation;
verify your identity or authority;
enter into or perform a contract;
process payments or maintain legally required records; or
complete or support your project.
Providing information for marketing purposes and accepting non-essential cookies are optional. Refusing them will not prevent you from contacting us or purchasing our services.
17. Contact us
If you have any questions about this Privacy Policy, how we use your personal information, or if you wish to exercise your data protection rights, please contact:
Przemyslaw Mackaszwili, trading as Magic Three
Email: info@magicthree.co.uk
Website: https://magicthree.co.uk
Contact form: https://magicthree.co.uk/contact/
Please include sufficient information to help us identify you and understand your request. Do not send identification documents unless we specifically ask for them.
We may request additional information where reasonably necessary to confirm your identity, protect personal information and respond to your request.