Charbucks Creative is a creative and digital design studio offering branding and website design. This policy explains what personal information we collect through charbuckscreative.co.uk and when you work with us, how we use it, and your rights under UK data protection law (the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations, as amended by the Data (Use and Access) Act 2025).

Charbucks Creative is the controller of your personal information. In this policy, "we", "us" and "our" mean Charbucks Creative.

• Business name: Charlotte Buck trading as Charbucks Creative / Charlotte Buck Creative

• Address: 14 Tornado Way, Market Deeping, PE6 8UW

• Email: charlottebuckcreative@gmail.com

• ICO registration number: ZC251945

If you have any questions about this policy or how we handle your information, email us at the address above.

What information we collect

We only collect the information we need to answer enquiries, deliver projects and run our website.

Information you give us

• Enquiries: your name, email address, phone number, company name and the details of your project when you use our contact form, email us or message us on social media (such as LinkedIn).

• Client projects: contact and billing details, project briefs, and any materials you share with us, such as logos, images, copy, brand guidelines and website or hosting logins needed to do the work.

• Newsletter (if offered): your name and email address if you choose to sign up.

• Purchases (if offered): name, billing and delivery address and order details. Card payments are handled by our payment provider; we never see or store your full card number.

Information collected automatically

• Technical information such as your IP address, browser type, device, pages viewed, how you arrived at the site and the time of your visit. This is collected through cookies and similar technologies (see our Cookies Policy below) and our website host's server logs.

We do not knowingly collect information from children under 13, and we do not ask for special category data (such as health information).

How we use your information

UK law requires us to have a lawful basis for each use of your information. These are ours:

• Replying to your enquiry and preparing quotes: legitimate interests (responding to people who contact us) or steps before entering a contract.

• Delivering branding and website projects, communicating with you and managing the work: contract.

• Sending invoices, taking payments and keeping accounting records: contract and legal obligation (tax law).

• Sending our newsletter or marketing emails: consent (you can unsubscribe at any time).

• Showing finished work in our portfolio or on social media: consent, or legitimate interests where the work is already public; we will always ask before naming you or showing unreleased work.

• Running, securing and improving our website, including essential cookies and basic visitor statistics: legitimate interests.

• Setting non-essential cookies (where used): consent.

• Dealing with legal claims or disputes: legitimate interests and legal obligation.

Where we rely on legitimate interests, we have balanced our interests against yours. You can object at any time (see Your rights). We do not use your information for automated decision-making or profiling, and we never sell it.

Who we share it with

We share your information only with trusted service providers who help us run the business, and only as far as they need it. They act on our instructions and must keep it secure.

• Squarespace: website hosting, contact forms, site analytics and online store (USA / Ireland).

• [Email provider, e.g. Google Workspace or Microsoft 365]: email and file storage ([USA / UK / EU]).

• [Payment provider, e.g. Stripe or PayPal]: taking payments ([USA / UK / EU]).

• [Accounting software, e.g. Xero, FreeAgent or QuickBooks]: invoicing and bookkeeping ([UK / USA]).

• [Newsletter tool, e.g. Squarespace Email Campaigns or Mailchimp]: sending newsletters ([USA]).

• Our accountant: tax and accounts (UK).

We may also share information where the law requires it, to protect our rights, or with a buyer if the business is ever sold.

International transfers. Some providers store data outside the UK. Where they do, we make sure the transfer is protected by UK adequacy regulations (including the UK–US Data Bridge for certified US companies) or by approved contract terms such as the UK International Data Transfer Addendum.

How long we keep it and how we protect it

We keep information only as long as we need it:

• Enquiries that don't become projects: 12 months from our last contact.

• Client project files and correspondence: 6 years after the project ends (to deal with any claims).

• Invoices and accounting records: 6 years after the end of the tax year, as HMRC requires.

• Logins or passwords you give us for a project: deleted as soon as the project is handed over.

• Newsletter subscribers: until you unsubscribe.

• Website analytics: as set by Squarespace (see Cookies Policy).

We protect your information with secure, password-protected accounts, two-factor authentication where available, encrypted devices and reputable service providers. No system is completely secure, but if a breach affecting you ever happens, we will tell you and the ICO where the law requires.

Your rights

You have the right to:

• Access a copy of the information we hold about you

• Correct anything inaccurate or incomplete

• Delete your information, where we no longer have a reason to keep it

• Restrict how we use it in certain circumstances

• Object to us using it on the basis of legitimate interests, and to direct marketing at any time

• Move information you gave us to another organisation (data portability)

• Withdraw consent at any time, where we rely on consent

To use any of these rights, email charlottebuckcreative@gmail.com. It's free, and we'll respond within one month. We may need to check your identity first.

Complaints. If you're unhappy with how we've handled your information, please contact us first so we can put it right. We will acknowledge your complaint within 30 days and respond without undue delay. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.