Privacy & Cookies Policy

2. Privacy notice

Our approach to privacy

We aim to be clear about what information we collect and why. We do not collect personal information simply because it may be useful later, and we do not sell personal information. We use appropriate technical and organisational measures to protect information and review our data-handling practices as our website and services change.

What information we collect

Depending on how you use the website, we may collect the following categories of information:

• Contact and enquiry information, such as your name, email address, telephone number, organisation, project information, estimated budget and anything else you choose to include in a message submitted through a form.
• Technical and usage information, such as device and browser information, pages viewed, approximate location derived from network information, referring pages, interactions with the site and similar usage data where collected through analytics tools.
• Cookie and consent information, including the choices you make through our cookie controls and information needed to remember those choices.
• Communications information, including emails or other correspondence you send to us and our responses.

Please do not include special category personal data or other highly sensitive information in a general website enquiry unless it is genuinely necessary for your request.

How we collect personal information

• Directly from you when you complete a contact form, email us, telephone us or otherwise contact us.
• Automatically from your browser or device when you use the website, subject to your cookie preferences and applicable consent requirements.
• From service providers that help us operate, secure, host or analyse the website, where they provide information to us in connection with those services.

How we use your information

Responding to enquiries and discussing potential work

Information used: Contact details and the content of your enquiry

Lawful basis: Legitimate interests in responding to genuine business enquiries, or steps at your request before entering into a contract.

Operating, maintaining and securing the website

Information involved: Technical, security and limited usage information

Lawful basis: Legitimate interests in operating a reliable and secure website; where PECR requires consent for a technology, we will obtain consent first unless an exemption applies.

Website analytics and experience improvement

Information involved: Usage and interaction information collected through analytics technologies

Lawful basis: Where consent is required for analytics technologies, we rely on your consent before activating them. We also have a legitimate interest in understanding how our website performs and how it can be improved, where that interest can lawfully be relied upon.

Complying with legal or regulatory obligations

Information involved: Information relevant to the obligation

Lawful basis: Legal obligation.

Establishing, exercising or defending legal claims

Information involved: Relevant contact, communications and transaction information

Lawful basis: Legitimate interests and, where applicable, legal obligation.

Contact forms and website enquiries

Our website uses contact forms to provide enquiry and contact forms. When you submit a form, the information you enter is sent to us so that we can respond to your request. When you submit a form, your information may be processed by our website and trusted service providers to help deliver your enquiry securely, prevent spam and ensure your message reaches us successfully. We do not use information submitted through a general enquiry form for unrelated purposes without an appropriate lawful basis.

Analytics and website measurement

We use Google Analytics and Microsoft Clarity to help us understand how visitors use the website and where the experience can be improved. These tools help us understand which pages are most useful, identify areas for improvement and monitor the overall performance of our website. These services can collect technical and interaction information when enabled. We configure optional analytics so that they are subject to the visitor’s cookie choices where consent is required under UK law.

Google Tag Manager is used to manage and deploy website tags. Tag Manager is not described here as a separate cookie in itself; the important point is what services and technologies are loaded through it. Where a tag uses a technology that requires consent, it should not be activated until the required consent has been obtained.

Hosting, security and content delivery

Our website is hosted by a UK-based hosting provider and uses Cloudflare services to help support the delivery, performance and security of the website. In the course of providing these services, our providers may process technical information such as IP addresses, request logs, device or browser information, and other security-related data where necessary to operate and protect the website.

Some storage or access technologies used solely for security, load balancing or essential website functionality may be subject to different requirements under the Privacy and Electronic Communications Regulations (PECR) where a legal exemption applies.

Embedded video and third-party content

Some pages may include embedded video or other content provided by third parties, including YouTube or Vimeo. These services are not necessarily present or active on every page. When embedded third-party content is loaded or interacted with, the third party may receive technical information and may use cookies or similar technologies under its own privacy terms. Where consent is required before such content or related tracking can load, we aim to respect your cookie preferences.

Sharing personal information

We may share personal information with service providers where this is reasonably necessary to operate the website, respond to enquiries, deliver our services, protect our systems or comply with the law. For this website, relevant service providers may include:

WP Engine

Website hosting and related infrastructure.

Cloudflare

Website security, content delivery and performance services.

Google Analytics

Website analytics, where enabled with the appropriate consent.

Microsoft Clarity

Website usage and interaction analytics, where enabled with the appropriate consent.

Google Tag Manager

Tag management used to deploy and control website services.

YouTube / Vimeo

Embedded video content on pages where such content is used.

We may also disclose information where required by law, to regulators or law-enforcement bodies, or where reasonably necessary to establish, exercise or defend legal rights. We do not sell personal information.

International transfers

Some of the technology providers used by our website are international organisations and may process information outside the United Kingdom. Where personal information is transferred outside the UK, we take steps to ensure that the transfer complies with UK data protection law. Where required, this may include relying on UK adequacy regulations or appropriate safeguards such as approved contractual protections. You can contact us if you would like further information about safeguards relevant to a particular transfer.

How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and dispute-resolution requirements. Retention can vary depending on the nature of the information and the relationship we have with you.

Website enquiries

Kept for as long as reasonably necessary to respond to the enquiry, follow up on the potential project and maintain appropriate business records. Enquiries that do not develop into an ongoing relationship are reviewed periodically and deleted when no longer needed.

Analytics information

Retained in accordance with the retention settings configured in the relevant analytics service and our ongoing need for aggregated website performance information.

Cookie consent records

Kept for as long as needed to remember and demonstrate the choices associated with the website, subject to the consent platform configuration.

Security and server logs

Kept for periods appropriate to security, troubleshooting, fraud prevention and infrastructure operations, subject to provider settings and legal requirements.

Your data protection rights

Depending on the circumstances and the lawful basis we rely on, UK data protection law may give you rights to:

• ask for access to personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to erase personal information in certain circumstances;
• ask us to restrict the use of personal information in certain circumstances;
• object to certain processing, including processing based on legitimate interests;
• receive certain personal information in a portable format where the right to data portability applies; and
• withdraw consent at any time where we rely on consent. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Your right to object: where we rely on legitimate interests, you have the right to object to our use of your personal information in appropriate circumstances. You also have an absolute right to object to processing for direct marketing purposes.

To exercise a right, contact hello@feelcreated.com. We may need to confirm your identity before acting on a request. Rights are not always absolute and legal exemptions may apply.

Complaints

If you have concerns about how we use personal information, please contact us first so we can try to resolve the issue. You also have the right to complain to the UK Information Commissioner’s Office (ICO). Current contact details and complaint routes are available at ico.org.uk.

Security

We use appropriate technical and organisational measures designed to protect personal information against accidental loss, unauthorised access, alteration or disclosure. Measures are proportionate to the nature of the information and the risks involved and may include access controls, secure hosting, encryption in transit, account protection, monitoring, backups and staff procedures. No internet transmission or storage system can be guaranteed to be completely secure.

Automated decision-making

We do not use information collected through this website to make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.