Privacy Policy

Last updated: November 2026

This Privacy Policy explains what personal data thelegacy (thelegacy.agency) collects when you visit the website or get in touch with us, why we collect it, and what control you have over it. We collect only what we need to answer you and to understand how the site is used.

1. Who we are

thelegacy is an independent design studio that has worked remotely since 2012 for crypto, fintech, web3 and tech companies worldwide. For the purposes of this policy, thelegacy is the controller of the personal data described below.

2. What data we collect and why

Contact forms

When you send a request through a form on the site, we collect what you enter, such as your name, email address and message. We use it only to read your request and reply to you. The message is delivered to our email and a copy is kept in the site’s database.

Analytics data

With your consent, we use Google Analytics 4 (loaded through Google Tag Manager) to understand how the site is used: which pages are viewed, how visitors arrive, what device and browser they use, and roughly which country they are in. This data is statistical and is not used to identify you personally.

Performance data

To make the site load quickly, we use the WP Rocket caching plugin. It may store technical data in your browser. It is not used to track you.

Scheduling

If you book a call through Calendly, the details you enter there (such as your name, email and chosen time) are processed by Calendly under its own privacy policy. We receive the booking details so that we can hold the meeting.

What we do not collect

The site has no user accounts, no online payments and no newsletter. We do not ask for payment card data and do not knowingly collect special categories of personal data. Please do not include sensitive information in your messages.

3. How we use your data

To respond to your requests and discuss possible projects.
To schedule and hold meetings you ask for.
To understand how the site is used and improve its content and performance (only if you accept analytics cookies).
To keep the site secure and working.

Under the GDPR, our legal bases are: steps taken at your request before a possible contract (form messages and bookings), our legitimate interest in running the site securely (performance and security), and your consent for analytics cookies.

We do not sell your personal data and do not use it for automated decision-making.

4. Cookies and Google Analytics

On your first visit, a banner asks whether you accept Google Analytics cookies. Until you accept, Google Analytics sets no cookies: under Google Consent Mode it may only send Google anonymous, cookieless signals that a page was viewed. If you accept, Google Analytics 4 sets its cookies (such as _ga) to count visits and sessions. If you decline, analytics stays without cookies.

Your choice is saved in your browser’s local storage (cookie-consent). You can change it at any time with the Cookies link at the bottom of every page, or by clearing site data in your browser. Google’s details: how Google uses cookies; you can also use the Google Analytics opt-out add-on.

WP Rocket’s technical data supports caching and is needed for the site to work quickly; it does not require consent.

5. Third parties

Google (Google Analytics, Google Tag Manager). See the Google Privacy Policy.
Calendly, for scheduling. See the Calendly Privacy Policy.
Our email and hosting providers, which process data on our behalf to deliver messages and serve the site.

Some of these providers are located outside the European Economic Area, including in the United States. Such transfers rely on the providers’ own safeguards, such as standard contractual clauses.

6. Data retention

Form messages and emails are kept while they are useful: while we discuss a project, while we work together, and afterwards for our records. You can ask us to delete them at any time.
Google Analytics 4 data is kept according to the retention settings of our Google Analytics account.
Calendly data is kept according to Calendly’s policy and our account settings.

7. Your rights

If the GDPR applies to you, you have the right to access, rectify and erase your personal data, to restrict or object to processing, to data portability, and to withdraw consent at any time (for cookies, through the Cookies link). To use these rights, write to us at the address below. We normally reply within one month and may need to confirm your identity first. You may also complain to your local data protection authority.

8. Security

We take reasonable technical and organizational steps to protect the data we hold, such as limiting access and using reputable providers. No method of transmission or storage is completely secure.

9. Children

Our services are intended for businesses. The site is not directed at children, and we do not knowingly collect data from anyone under 16.

10. Contact

11. Changes to this policy

We may update this policy when the site or the law changes. The date at the top shows the last revision.