Privacy Policy

Content Girl Creations Limited respects the privacy of everyone who contacts us or uses this website. This notice sets out, in plain English, what we collect, why we collect it, how long we keep it and what you can ask us to do about it. It is written to meet our obligations under the UK GDPR and the Data Protection Act 2018.

Controller details

Content Girl Creations Limited, Unit 12, Sevendale House, 7 Dale Street, Northern Quarter, Manchester M1 1JA, United Kingdom. Privacy enquiries: [email protected] · +44 161 496 0217. We are not required to appoint a statutory Data Protection Officer; privacy questions are handled by our operations lead.

Information we hold

Information you give us

When you complete the enquiry form, email us or speak to us by telephone, we record your name, organisation, contact details and whatever you choose to tell us about your requirements. If we go on to work together, we hold the contract, project correspondence and billing information associated with the engagement.

Information collected automatically

Our host records standard server log data (IP address, timestamp, requested URL, user agent, referrer) for security and reliability. If you accept analytics cookies, we also receive aggregated usage statistics such as page views, approximate region and traffic source.

Why we process it

• To answer enquiries and prepare quotations — our legitimate interest in responding to prospective clients.
• To deliver, invoice and support the services you engage us for — performance of a contract.
• To meet accounting, tax and statutory record-keeping duties — legal obligation.
• To keep the site secure and available — our legitimate interest in protecting our infrastructure.
• To measure how the site performs — your consent, given through the cookie banner and withdrawable at any time.

How long we keep it

Enquiries that do not lead to work are deleted 24 months after the last contact. Client records are retained for the engagement plus six years, which reflects the statutory limitation period and HMRC requirements. Server logs are rotated after 12 months. Analytics data expires after a maximum of 14 months. Consent records remain in your browser until you clear them.

Who else sees it

Only the suppliers who make our business function: hosting, email, cloud storage, accounting and — subject to consent — analytics. All act on our documented instructions under Article 28 UK GDPR. We never sell or rent contact details, and we do not share them for third-party marketing. Disclosure to authorities occurs only where legally required.

Transfers outside the United Kingdom

Where a supplier processes data outside the UK, we rely on an adequacy decision or on the International Data Transfer Agreement together with a transfer risk assessment. Details of the safeguards for any specific supplier are available on request.

Your rights in summary

You can ask for a copy of your data, ask us to correct or delete it, ask us to restrict how we use it, object to processing carried out under legitimate interests, or request portability of data you provided to us. Where processing relies on consent, you may withdraw it at any time without affecting processing that has already taken place. Email [email protected] and we will reply within one month.

Security measures

Business accounts are protected with multi-factor authentication, devices are encrypted, access to client material is limited to the people working on it, and permissions are reviewed when a project closes. We test restores of our backups and we notify affected individuals and the ICO where a breach meets the reporting threshold.

Complaints and updates

Raise any concern with us first at [email protected]. If you remain dissatisfied you may complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113). We update this notice when our practices change; material changes are highlighted at the top of this page.