CJJCreatives
Legal

Privacy policy

How we collect, use and protect your personal data, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Last updated: May 2026

1. Who we are

This site is operated by CJJCREATIVES Ltd ("we", "us", "our"), a company registered in England and Wales.

We are the data controller for the personal data described in this policy.

2. What data we collect

When you complete the contact form we collect:

  • Your name
  • Your email address
  • The subject and contents of your enquiry
  • A hashed version of your IP address (used solely to prevent abuse)

We also collect anonymous, aggregate analytics (page paths, referrers, user-agent string) when you have accepted cookies via our cookie banner. We do not use third-party advertising trackers.

3. Why we use it (lawful bases)

  • Contact enquiries: consent (you tick the GDPR box) and our legitimate interest in responding to prospective clients.
  • Analytics: consent, given via the cookie banner.
  • Security & abuse prevention: our legitimate interest in keeping this site available and free of spam.

4. How long we keep it

Enquiry data is kept for up to 24 months from your last contact with us, after which it is deleted. Analytics records are retained for up to 12 months in aggregate form.

5. Who we share it with

We use the following processors, each contractually obliged to protect your data:

  • Supabase (database & authentication, EU region)
  • Resend (transactional email delivery)
  • Cloudflare / Vercel (hosting and DDoS protection)

We do not sell your personal data to anyone, ever.

6. Your rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you
  • Have inaccurate data corrected
  • Have your data erased ("right to be forgotten")
  • Restrict or object to processing
  • Receive your data in a portable format
  • Withdraw consent at any time

To exercise any of these rights, email hello@cjjcreatives.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

7. Security

All traffic is served over HTTPS. Data is stored in encrypted databases hosted in the EU with strict access controls. We never store payment card data on this site.

8. Changes to this policy

We may update this policy from time to time. Material changes will be flagged on this page with an updated "Last updated" date.