This policy explains how we handle personal information from website visitors, enquiries and business clients. We provide services only to businesses, but information about sole traders, business contacts and people shown in project materials is still personal information.
1 Who we are
Iwona Romanska trading as Creativa Studio is the data controller. Business address: 43 Shepherds Croft, Melton Mowbray, LE13 1LG. For privacy questions or requests, email info@creativastudio.co.uk.
2 Information we collect
We handle contact and business details, enquiries, correspondence, project materials, approvals, invoices and bank-transfer records. Materials you provide may include names or photographs. We normally receive information from you, your authorised representative or a supplier involved in your project.
Our contact form requires your name, email and message. Telephone, company name, company address and the services you are interested in are optional. There are no file uploads. Please do not send passwords or sensitive information without first agreeing a secure method.
Website and security services also process technical information such as IP addresses, request times and browser or device details. Our anti-spam check uses a verification token and IP address. If it blocks your enquiry, you can email or telephone us instead.
3 Why we use it
We use information to respond to enquiries, prepare quotes, deliver projects, take payment and provide support. We rely on steps requested before a contract or performance of a contract. For contacts representing a business, we rely on our legitimate interests in communicating with that business and delivering its services.
We rely on legal obligations for tax and accounting records, and legitimate interests for proportionate security, business administration and resolving disputes. Optional analytics measurement and any promotional use of an identifiable photograph for which we request permission rely on consent. You can withdraw that consent at any time.
Providing information is voluntary, but we may be unable to reply or complete a project without the necessary details. We accept payment by bank transfer only and do not collect card details on this website. We do not currently send newsletters.
4 Who receives information
Cloudflare provides hosting and website security. A transactional email-delivery provider passes contact-form messages to our business mailbox at Fasthosts. The website does not maintain a separate enquiry database. Enquiries are held in email, and project files are stored on our business computer.
Other relevant recipients include providers of website analytics, embedded maps, web fonts and business messaging, our bank, professional advisers and authorities where required. Each receives information relevant to its role. You can contact us for the identities of providers involved in handling your information.
External production suppliers receive artwork and instructions needed for agreed work. Orders and deliveries use our own contact details and address, although artwork may contain personal information included in the design.
If you contact us through a messaging platform, we use the number, profile details, messages and attachments you share to respond and discuss the project. The platform also handles information under its own privacy terms.
5 Overseas processing
Some technology providers process information outside the UK, including in the United States. Our email-delivery provider stores message content and delivery records in the United States; a European sending region does not change that storage location.
The published terms for that provider and Cloudflare include Standard Contractual Clauses with the UK Addendum for relevant restricted transfers. Other services may use applicable adequacy arrangements or contractual safeguards. You can request details of the safeguards relevant to your information and how to obtain a copy.
6 Cookies and website services
Optional analytics helps us understand visits, pages viewed, interactions, referral sources and browser or device information. Our form code does not send your message or contact-field values to analytics.
The analytics library loads before a cookie choice is made and after rejection. Its provider therefore receives technical connection information, including your IP address, even when measurement is disabled. The website code disables measurement without a valid acceptance. Reject cookies disables measurement, attempts to remove first-party analytics cookies and reloads the page. Withdrawal does not delete information already received.
Embedded maps and web fonts load independently of analytics consent and send technical connection information to their provider. Maps may use cookies or similar storage. Security checks also run independently. Cookie settings does not disable these services or control external messaging platforms.
To change your choice, select Cookie settings at the bottom of any page, then Accept cookies or Reject cookies.
Your preferences: We remember your cookie choice in your browser for 180 days, then ask again. You can change your choice at any time through Cookie settings.
Analytics cookies (_ga and _ga_4TCTCCH46Y) help distinguish visitors and understand visits. The provider’s default lifetime is two years, but account settings and browser limits can change this. This is separate from how long we remember your consent.
Maps and security services may use their own cookies or browser storage. Their duration varies by service and settings. The analytics cookie controls do not manage these services.
7 How long we keep information
Unsuccessful enquiries: 12 months after the last substantive contact. Core contracts, approvals, invoices and payment records: six years after project completion, or longer where tax requirements or an unresolved dispute require it. Routine project working files: 12 months after completion, unless ongoing services or an agreed archive require longer retention.
Email-delivery records, security logs and backups follow separate provider schedules. The email-delivery provider documents 30-day message and log retention on standard plans and seven-day backups; other plans can differ. These periods do not delete correspondence already held in our mailbox.
We retain records only as needed for their purpose, service recovery, security, legal obligations or disputes. Deletion from backups may follow their scheduled expiry. Analytics cookie expiry does not determine the retention of previously collected analytics data. Contact us for details or to request deletion.
8 Security and your rights
We restrict access and use proportionate measures to protect information. No online system is completely secure. If we process your customers’ information on your instructions, separate data-processing terms apply.
Subject to applicable conditions, you can request access, correction, deletion, restriction or a portable copy of your information. You can withdraw consent without affecting earlier lawful processing. We may need to verify your identity and normally respond within one month; we explain any lawful extension.
Your right to object: you can object to processing based on legitimate interests for reasons relating to your situation. You can object to direct marketing at any time.
Email privacy concerns to info@creativastudio.co.uk. You may also complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/ or call 0303 123 1113 without contacting us first.
We update this policy when our practices change and show the revision date above.