How we run 738 Studios.

738 Studios processes personal data on its own behalf as a controller, and on behalf of clients as a processor when we build, host or support their systems. In both roles we apply the same standard.

• Lawful, fair and transparent. We identify a lawful basis before processing, tell people what we do with their data in plain English, and never use data for purposes they would not expect.
• Minimised and accurate. We collect only what a task needs, keep it accurate, and delete it when it is no longer required under our retention schedule.
• Secure. Personal data is protected by the controls in our Information Security Policy, including encryption in transit and at rest, access on a need-to-know basis and tested backups.
• Client data stays client data. When we act as a processor we work only on documented instructions, under a written data processing agreement, and we never use client data to train AI models or for our own purposes.
• International transfers. Data is hosted in the UK or EEA by default. Transfers elsewhere take place only with appropriate safeguards in place.
• Rights honoured. We respond to access, rectification, erasure, portability and objection requests within one calendar month.
• Breaches handled properly. Suspected breaches are logged, assessed and, where required, reported to the Information Commissioner's Office within 72 hours and to affected people without undue delay.

Our website-specific notice, covering the enquiry form and cookies, is in the privacy policy.

Security is part of quality, not an add-on. Every system we design, build and host is protected by controls that are proportionate to the data it holds and the harm a breach could cause.

• Access control. Unique accounts, least-privilege permissions, multi-factor authentication on all administrative access, and prompt removal of access when roles change or end.
• Secure engineering. Code review, dependency and vulnerability scanning, secrets kept out of source control, and security testing before anything goes live.
• Infrastructure. Hardened server builds, patching within defined timescales, firewalls, encrypted connections and continuous monitoring with alerts that reach a person.
• Backups and recovery. Automated, encrypted, off-site backups with restores tested on a schedule, not assumed.
• Incident response. A documented plan with named responsibilities, covering containment, investigation, notification and lessons learned.
• People. Security awareness training for all staff and contractors, device encryption, and a clear acceptable-use standard.
• Suppliers. Hosting and tooling providers are assessed for their security posture before use and reviewed periodically.

We use AI to work faster and we build AI into client systems. We do both under rules designed to keep people in control and data safe.

• Human accountability. AI assists our engineers; it does not replace their judgement. Every line of code and every recommendation is reviewed and owned by a person.
• Data boundaries. Client and personal data is never entered into AI tools unless the tool and its data handling have been approved for that purpose. We do not allow client data to be used to train third-party models.
• Governed deployment. AI features we build run under the client's access controls, with logging, cost limits and the ability to switch them off. Outputs that affect people are reviewable and explainable to a reasonable standard.
• Transparency. We tell clients where AI is used in their systems and how. We do not present AI-generated content as human-authored where it matters.
• Fairness and safety. We test AI features for inappropriate bias and unsafe output before release and monitor them afterwards.
• Open about commercial relationships. Where we resell or have a referral arrangement with an AI platform we recommend, we tell you before you decide.

738 Studios has a zero-tolerance approach to modern slavery, forced labour and human trafficking in any part of our business or supply chain. Although our turnover may be below the threshold at which a statement is legally required, we publish one voluntarily because we expect to work with organisations that are required to, and because it is the right thing to do.

• Our business. We are a UK-based professional services company. Our people are employed or contracted directly on fair terms, paid at least the Real Living Wage, and free to leave their employment.
• Our supply chain. It consists mainly of hosting and cloud providers, software licences, hardware and professional services. We assess suppliers for modern slavery risk when onboarding them and expect them to meet the standards in our Supplier Code of Conduct.
• Due diligence. Higher-risk categories, such as hardware manufacturing, are sourced from suppliers who publish their own statements and audit their supply chains.
• Reporting. Anyone who suspects slavery or trafficking in connection with our business can raise it through our Whistleblowing Policy, in confidence and without fear of reprisal.

This statement is approved by the directors and reviewed annually.

We win work on the quality of what we do. We do not offer, give, request or accept bribes, kickbacks, facilitation payments or any improper advantage, directly or through third parties, anywhere in the world.

• Gifts and hospitality. Modest, proportionate and transparent only, recorded in a register, and never offered or accepted where they could influence a decision.
• Commissions and referrals. We disclose any referral arrangement to the client concerned. Our recommendations are never influenced by undisclosed payments.
• Public officials. Extra care is taken in any dealing with public bodies; no payment or benefit is offered to officials.
• Records. Accurate books and records are kept so that no payment can be hidden.
• Reporting. Concerns can be raised under our Whistleblowing Policy. Breaches are treated as gross misconduct and may be reported to the authorities.

Software has a physical footprint. Ours runs on servers that use energy, so we take responsibility for choosing and running them well, and for the way we work day to day.

• Efficient by design. We build lean software and websites that need less computing power to run, which is good for the planet and for performance.
• Hosting. We favour data centres powered by renewable energy and right-size infrastructure so that servers are not left running idle.
• Operations. We are remote-first, which keeps commuting and office energy to a minimum. Travel is by public transport where practical and limited to where it adds real value.
• Hardware. Equipment is bought for longevity, repaired where possible and disposed of through certified electronic-waste recyclers.
• Measurement. We track our main sources of emissions and set reduction targets, and we help clients understand the footprint of the systems we build for them when asked.
• Compliance. We comply with all applicable environmental legislation and expect the same of our suppliers.

We want 738 Studios to be a place where people do their best work because they are respected for who they are. We do not tolerate discrimination, harassment or victimisation on the grounds of age, disability, gender reassignment, marriage or civil partnership, pregnancy or maternity, race, religion or belief, sex or sexual orientation, or any other characteristic.

• Recruitment and progression are based on skills, experience and potential, with structured processes designed to reduce bias.
• Reasonable adjustments are made for staff, candidates and clients with disabilities, and flexible working is the default rather than the exception.
• Conduct. Everyone is expected to treat colleagues, clients and suppliers with dignity. Concerns are taken seriously and dealt with promptly and confidentially.
• Our work. We design inclusive products: accessible by default and tested with a range of users, so the systems we build work for everyone who needs them.

We are committed to providing a safe and healthy working environment for everyone who works with us, wherever they work. As a remote-first business most of our risks relate to display screen equipment, workstation set-up and wellbeing, and we manage them accordingly.

• Workstations. Every member of staff completes a display screen equipment assessment and is provided with the equipment needed to work safely at home or in a client's office.
• Wellbeing. Sensible working hours, regular breaks and open conversations about workload and mental health are part of how we manage.
• Client sites and data centres. We follow the host's safety rules, carry out site-specific risk assessments where needed, and never undertake work we are not trained for.
• Incidents. Accidents and near-misses are recorded, investigated and, where required, reported under RIDDOR.
• Responsibility. The directors hold overall responsibility; every individual is responsible for their own safety and that of others affected by their work.

Our reputation rests on software that works on day one and keeps working. Quality is built into how we scope, design, build, test and support every project.

• Clear scope. Every project starts with documented requirements and acceptance criteria agreed with the client.
• Engineering standards. Version control, code review, automated testing, staging environments and documented releases on every project.
• Measured delivery. Regular previews, defect tracking and post-launch reviews so that problems are found early and lessons are carried forward.
• Continuous improvement. We review our processes, tooling and training regularly and act on client feedback.
• Accountability. The engineers who build a system support it, so quality is owned, not handed over.

Clients depend on the systems we run. We plan for things going wrong so that, when they do, the impact on our clients is small and short-lived.

• Hosted systems. Every hosted system has defined recovery time and recovery point objectives, documented restore procedures and backups that are tested against them.
• Redundancy. Critical infrastructure is designed without single points of failure where the client's requirements justify it, and monitored around the clock.
• Our own operations. Our tooling, source code and documentation are held in resilient, backed-up services so that work can continue if any one provider, device or location is lost.
• People. Knowledge of every client system is shared across more than one engineer, and documented, so support does not depend on one person.
• Testing and review. Continuity plans are exercised at least annually and updated after any incident.

We hold our suppliers to the same standards we hold ourselves. Working with 738 Studios means agreeing to the following.

• Lawful and ethical. Compliance with all applicable laws, including on bribery, competition, tax and sanctions.
• Labour and human rights. No forced, bonded or child labour; fair pay and hours; freedom of association; safe working conditions; no discrimination.
• Data and security. Protection of any data shared with them to at least the standard in our Information Security and Data Protection policies, with prompt notification of any incident.
• Environment. Compliance with environmental law and reasonable efforts to reduce their own impact.
• Transparency. Accurate records, cooperation with reasonable due diligence, and immediate disclosure of any conflict of interest.
• Consequences. Serious or unremedied breaches may lead to termination of the relationship.

If something is wrong, we want to know. Anyone who has a genuine concern about wrongdoing connected with 738 Studios, such as a crime, a breach of the law, a danger to health, safety or the environment, a data breach, or an attempt to cover any of these up, can raise it under this policy.

• How to raise a concern. In the first instance to a director, by email or in person. Concerns can be raised anonymously, although we can investigate more effectively if we can talk to you.
• What happens next. We acknowledge the concern, investigate it proportionately and confidentially, and tell you the outcome where we can.
• Protection. Nobody who raises a concern in good faith will suffer any detriment for doing so. Retaliation against a whistleblower is itself a disciplinary matter.
• External routes. Concerns can also be raised with a relevant regulator, such as the Information Commissioner's Office or the Health and Safety Executive, where appropriate.

We aim to get things right, and when we don't we want to hear about it and put it right quickly.

• Step one. Raise the issue with your usual contact at 738 Studios. Most problems are resolved at this stage.
• Step two. If you are not satisfied, write to hello@738studios.co.uk marked "Complaint". We acknowledge complaints within two working days and respond fully within ten working days, or explain why we need longer.
• Step three. If the response does not resolve the matter, you can ask for a review by a director who has not previously been involved.
• Learning. Every complaint is logged and reviewed so that we can improve the way we work.

We want everyone to be able to use this website and the systems we build, whatever their abilities or the technology they use.

• This website is designed to meet WCAG 2.2 Level AA: it can be navigated by keyboard, works with screen readers, respects reduced-motion preferences, uses sufficient colour contrast and scales to any screen size.
• Our work. Accessibility is a requirement on every project, not an optional extra, and we test with assistive technologies as part of our quality process.
• Known limitations. Decorative dot patterns are hidden from assistive technology. If you find any part of this site difficult to use, please tell us.
• Feedback. Email hello@738studios.co.uk and we will respond within five working days and fix genuine issues as a priority.