Privacy Policy

Last updated: 17 July 2026

This privacy policy describes how personal data is collected and used when you visit grm.design or make contact through it, and the rights available to you in relation to that data.

Who I am

GRM.DESIGN is the independent design and development studio of Gabriel Ramos Melillo. I act as the data controller for the personal data described in this policy. Privacy-related enquiries may be directed to gabriel@grm.design.

Information collected

Information you provide

If you contact me through the enquiry form or by email, I receive your name, your email address, and any information you choose to include about your company or project. The site has no user accounts, registration, or mailing lists, and no further personal information is requested.

Information collected automatically

Where you have consented to analytics cookies, the services described below record usage data, including the pages you visit, the source of your visit, the duration of your session, your device and browser type, your approximate location at country or city level, and your interactions with the site. This data is aggregated and is not used to identify you.

Cookies and consent

Cookie consent on this site is managed by CookieYes, which displays the consent banner and stores a cookie recording your preference. Non-essential cookies are set only after you have accepted them, and the site remains fully functional if you decline. You may review, change, or withdraw your consent at any time through the cookie settings panel.

Analytics and measurement

This site uses Google Tag Manager to load the measurement services listed below. Tag Manager does not itself collect personal data; it determines whether and when these services run, in accordance with your consent preferences.

Google Analytics 4

Google Analytics 4 records aggregated usage statistics, including pages visited, traffic sources, session duration, device and browser information, and approximate location. IP addresses are not logged or stored. This data is processed by Google; further detail is available in the Google privacy policy.

Microsoft Clarity

Microsoft Clarity produces heatmaps and anonymised session replays covering clicks, scrolling, and cursor movement, which I use to understand how the site is navigated. Text entered into forms is masked and is not captured. This data is processed by Microsoft; further detail is available in the Microsoft privacy statement.

Neither service runs unless you have consented to analytics cookies. If consent is declined, no analytics data is collected.

Enquiries

Messages submitted through the enquiry form are delivered to my inbox by Resend, an email delivery service. The information you provide is used solely to respond to your enquiry and, where an engagement follows, to carry out the work. It is not used for marketing purposes.

Legal bases for processing

  • Consent, in respect of analytics and measurement cookies.
  • Legitimate interest and steps taken prior to entering into a contract, in respect of enquiries and the administration of the studio.

Service providers

Personal data is shared only with the service providers required to operate this site, each acting as a processor on my behalf:

  • Google, which provides Tag Manager and Analytics 4;
  • Microsoft, which provides Clarity;
  • CookieYes, which provides consent management;
  • Resend, which delivers enquiry form messages;
  • my hosting provider, which serves the site and maintains standard server logs.

I do not sell personal data, and this site carries no third-party advertising.

International transfers

Certain providers listed above process data in the United States and in other countries outside the European Economic Area and the United Kingdom. Such transfers are made under the EU–US Data Privacy Framework or Standard Contractual Clauses, as applicable.

Data retention

  • Enquiry correspondence is retained for as long as necessary to handle the enquiry and any resulting engagement.
  • Google Analytics 4 event data is retained for up to fourteen months.
  • Microsoft Clarity session recordings are retained for approximately thirty days; aggregated heatmap data is retained for up to thirteen months.
  • CookieYes retains the record of your consent for twelve months.

Your rights

Subject to the law applicable in your place of residence, including the GDPR and UK GDPR, you have the right to request access to, correction of, or deletion of your personal data; to receive a copy of it in portable form; to restrict or object to its processing; and to withdraw consent at any time. Requests may be sent to gabriel@grm.design. You also have the right to lodge a complaint with your local supervisory authority.

Changes to this policy

This policy may be revised as the site or the services it relies on change. The date shown above indicates the most recent revision.