Privacy Policy

1. Who We Are

This website is operated by EIT Creative Solutions Ltd, a company registered in England and Wales.

EIT Creative Solutions Ltd is the data controller for personal data collected through this website. We are not currently required to register with the Information Commissioner's Office (ICO) as we do not process data at a scale that triggers mandatory registration, however we comply fully with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data We Collect

2.1 Data you provide directly

When you submit the contact form on this website, we collect:

• Your name
• Your email address
• Your company or organisation name (optional)
• A description of your project or enquiry

2.2 Data collected automatically

When you visit this website, our web server may log basic technical data including:

• Your IP address (used for rate-limiting form submissions and server security, not for tracking)
• Browser type and version
• Date and time of your visit
• Pages accessed

We do not use Google Analytics, Facebook Pixel, or any third-party tracking or behavioural analytics tools on this website. No tracking cookies are placed on your device.

2.3 Data we do NOT collect

• Payment card details (we have no online payment facility)
• Sensitive personal data (health, ethnicity, religion etc.)
• Data from children under 16

3. How We Use Your Data

We use the data you submit through the contact form solely to:

• Respond to your enquiry
• Discuss and scope a potential project with you
• Send you a proposal or quotation if requested
• Fulfil a contract if you become a client

We do not use your data for marketing, profiling, automated decision-making, or any purpose unrelated to your enquiry.

4. Legal Basis for Processing

Under UK GDPR, we rely on the following legal bases:

• Legitimate interests (Article 6(1)(f)) � to respond to enquiries submitted through our contact form
• Contract (Article 6(1)(b)) � to perform services agreed with clients
• Legal obligation (Article 6(1)(c)) � where we are required to retain records by law (e.g. accounting records)

5. Data Retention

We retain your data only for as long as necessary:

• Enquiries that do not lead to a contract: deleted within 12 months of last contact
• Client project records: retained for 7 years from project completion in accordance with HMRC requirements
• Server access logs: retained for up to 30 days and then deleted automatically

You may request deletion of your data at any time (see Your Rights below).

6. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access � request a copy of the data we hold about you
• Right to rectification � ask us to correct inaccurate data
• Right to erasure � request deletion of your data where there is no overriding legal reason to retain it
• Right to restriction � ask us to restrict processing in certain circumstances
• Right to data portability � receive your data in a structured, machine-readable format
• Right to object � object to processing based on legitimate interests
• Right not to be subject to automated decisions � we do not carry out any automated decision-making or profiling

To exercise any of these rights, contact us using the details in Section 13. We will respond within 30 days. There is no charge for reasonable requests.

7. Sharing Your Data

We do not sell, rent, or trade your personal data to any third party.

Your data may be shared only in the following limited circumstances:

• Email delivery: enquiry emails are transmitted via SMTP (e.g. Gmail/Google Workspace infrastructure). Google's privacy policy applies to transmission only � Google does not have access to your data for advertising purposes when using Gmail for business.
• Legal requirement: if required by law, court order, or a regulatory authority

No data is transferred outside the United Kingdom or European Economic Area unless covered by an appropriate safeguard under UK GDPR.

8. Cookies

This website does not use tracking cookies, advertising cookies, or any persistent cookies that identify you as an individual.

Strictly necessary session data (e.g. CSRF tokens used to protect the contact form) may be stored temporarily in your browser session. These are deleted when you close your browser and are not used for tracking.

No cookie consent banner is shown because no non-essential cookies are set.

9. Security

We take reasonable technical and organisational measures to protect your data, including:

• HTTPS encryption for all data in transit
• Server-side honeypot and rate-limiting to prevent abuse of the contact form
• No plain-text storage of contact details in publicly accessible files
• Email addresses on this website are obfuscated to prevent automated scraping

No method of internet transmission is completely secure. In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify you and the ICO as required under UK GDPR within 72 hours.

10. Third-Party Links

This website may contain links to third-party websites. We are not responsible for the privacy practices of those websites and recommend you review their policies independently.

11. Children

Our services are directed at businesses and professionals. We do not knowingly collect data from anyone under the age of 16. If you believe a minor has submitted data through this website, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of this website after any changes constitutes acceptance of the updated policy.

13. Contact & Complaints

For any questions about this Privacy Policy, to exercise your rights, or to raise a concern:

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):