Undo Creative Lab ("we", "our", or "us") is a creative studio based in the United Kingdom and the data controller for your personal data. This Privacy Policy explains how we collect, use, store, and share your information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Contact Details
For any questions about this policy or how we handle your data, please contact us:
Email: ready@undocreativelab.com
2. What Information We Collect
a. Information You Provide
Name, email address, phone number, and other contact details.
Billing and payment information when purchasing our services.
Project briefs, brand materials, creative assets, and other information shared in the course of working together.
b. Information Collected Automatically
IP address, browser type, device information, and website usage data.
Cookie and tracking data — see Section 5.
3. Legal Basis for Processing
We rely on the following lawful bases under UK GDPR:
Contract performance: to fulfil our obligations when you engage our services.
Legitimate interests: to manage our business and communicate with clients, where not overridden by your rights.
Legal obligation: where required by UK law.
Consent: for marketing communications and non-essential cookies.
4. How We Use Your Information
To provide and deliver our creative services.
To process payments and send invoices or confirmations.
To communicate with you about projects and enquiries.
To send marketing communications where you have consented.
To improve our website and services.
To comply with legal obligations and protect our rights.
5. Cookies
We use essential, analytics, and marketing cookies. Essential cookies are necessary for the site to function; analytics and marketing cookies are only used with your consent. You can manage preferences through your browser settings or our cookie tool at any time.
6. Portfolio and Client Work
We regularly feature completed client work on our website and in promotional materials. By engaging our services, you acknowledge that we may do so. If you would prefer your project not be featured publicly, please let us know in writing during our engagement.
7. Sharing Your Information
We do not sell or rent your personal data.
We may share it with:
Service providers (e.g. payment processors, hosting services) who process data on our behalf under UK GDPR-compliant agreements.
Legal authorities where required by law or to protect our rights.
Successors in the event of a business merger or acquisition.
Where we use services hosted outside the UK, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA).
8. Data Retention
Client and project data: retained for a minimum of six years following engagement, in line with UK legal obligations.
Marketing data: retained until you withdraw consent or opt out.
Analytics and cookie data: typically no longer than 26 months.
When data is no longer needed, we securely delete or anonymise it.
9. Data Security
We implement appropriate technical and organisational measures to protect your data against unauthorised access, disclosure, or loss. In the event of a breach affecting your rights, we will notify you and the ICO as required by UK GDPR.
10. Your Rights
Under UK GDPR you have the right to access, correct, delete, or restrict your personal data, and to object to processing based on legitimate interests or for direct marketing. To exercise any of these rights, contact us at [Insert Contact Email]. We will respond within one calendar month.
You also have the right to complain to the Information Commissioner's Office (ICO) at www.ico.org.uk or on 0303 123 1113.
11. Third-Party Links
Our website may link to third-party sites. We are not responsible for their privacy practices and encourage you to review their policies.
12. Changes to This Policy
We may update this policy periodically. Changes will be posted here with an updated effective date.