This Privacy Policy explains how Creensight Private Limited (CIN U74999GJ2020PTC114611), a private company incorporated in India in 2020 and registered with the Registrar of Companies, Gujarat, with its registered office in Ahmedabad, Gujarat, India. creensight.uk/ is the website of the UK office of Creensight Private Limited in London, United Kingdom (“Creensight UK”, “Creensight”, “we”, “us” or “our”). The UK office is not a separately incorporated UK company; it is part of Creensight Private Limited. Our global website is creensight.com, collects, uses, shares and protects personal data when you visit creensight.uk/, contact our UK office, subscribe to our newsletter, buy a service package from our shop or work with us as a client. It is written for people in the United Kingdom and reflects the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
We have tried to keep this policy clear and practical. If anything is unclear, please email [email protected] and we will explain.
1. Who is responsible for your personal data
The controller of personal data processed through creensight.uk/ is Creensight Private Limited (CIN U74999GJ2020PTC114611), Ahmedabad, Gujarat, India, acting through its UK office in London. Because the UK office is part of the Indian company and not a separate UK entity, the same company is responsible for your data whether you deal with our London team or with colleagues in India.
1.1 UK representative
Article 27 of the UK GDPR requires certain controllers established outside the UK to appoint a representative in the UK. Where this requirement applies to our processing, we will appoint a UK representative, and the representative’s details will be available on request at [email protected] and published on this page. In the meantime, you can exercise every right described in this policy by writing to our Data Protection Contact.
1.2 Data Protection Contact
We have not appointed a statutory Data Protection Officer, because we are not required to. Our Data Protection Contact, Creensight UK handles privacy questions and requests. Contact details are in section 16.
2. Scope of this policy
This policy covers personal data we process:
- when you browse creensight.uk/, including through cookies and similar technologies;
- when you complete our contact or enquiry form, or email or call our UK office;
- when you subscribe to the newsletter in the website footer;
- when you place an order for a fixed-scope service package in our WooCommerce shop;
- when you or your organisation become a client, supplier or partner;
- when you apply for a role with us.
It does not cover personal data that our clients ask us to process on their behalf inside the software we build or host for them. In those projects the client is normally the controller and we act as a processor under a written data processing agreement. The client’s own privacy notice applies to that data.
3. Personal data we collect
| Category | Examples | Source |
|---|---|---|
| Identity and contact data | Name, email address, phone number, company name, job title | You (contact form, emails, calls, orders) |
| Enquiry data | Service of interest, budget range, project description, files or links you share | You |
| Order and billing data | Billing name and address, package ordered, order value in GBP, invoices, payment status | You and our payment provider |
| Payment data | Payment confirmation, last digits of a card and card type where the provider shares them | Payment gateway (we never see or store full card numbers) |
| Newsletter data | Email address, date and time of subscription | You |
| Technical and security data | IP address, browser and device type, pages requested, timestamps, failed login attempts, firewall events | Our servers, Wordfence security logs |
| Cookie and consent data | Your cookie choices, consent identifier and date | CookieYes consent banner |
| Client relationship data | Contracts, statements of work, meeting notes, support tickets, feedback | You and your colleagues |
| Recruitment data | CV, portfolio, work history, references, right-to-work information where lawfully required | You, recruiters, referees |
We do not ask for special category data (such as health, religious beliefs or ethnicity) through this website. Please do not include it in enquiry messages.
4. How and why we use your personal data
Under the UK GDPR we must have a lawful basis for each use of personal data. The table below sets out our purposes and the basis we rely on.
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Replying to your enquiry and preparing quotes or proposals | Steps at your request before entering into a contract; legitimate interests in responding to business enquiries |
| Processing shop orders, issuing invoices and delivering services | Performance of a contract |
| Keeping accounting and tax records | Legal obligation |
| Sending our newsletter | Consent (you can withdraw at any time) |
| Sending service-related messages to existing clients | Performance of a contract; legitimate interests |
| Keeping the website secure, preventing fraud and abuse, blocking malicious traffic | Legitimate interests in protecting our systems, users and clients |
| Non-essential cookies such as analytics | Consent under the Privacy and Electronic Communications Regulations 2003 (PECR) and UK GDPR |
| Improving our website, services and content | Legitimate interests (using aggregated or consented data) |
| Recruitment | Steps before a contract; legitimate interests; legal obligation for right-to-work checks where applicable |
| Establishing, exercising or defending legal claims | Legitimate interests |
Where we rely on legitimate interests, we have balanced our interests against yours. You can ask us for more information about that assessment and you have the right to object (see section 11).
4.1 Direct marketing
We send marketing emails only to people who have subscribed, or to business contacts where PECR allows it, and every message includes a simple way to unsubscribe. We do not sell or rent mailing lists.
4.2 Automated decisions
We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.
5. The website stack and the tools that see your data
- WordPress stores form submissions only where needed to reply, newsletter sign-ups and account data for registered customers.
- WooCommerce processes orders, basket sessions and customer accounts. Prices are shown in pounds sterling (GBP).
- Contact Form 7 sends the details you enter (name, email, phone, company, service, budget, message and consent) to our team by email.
- Yoast SEO generates metadata and sitemaps and does not track visitors.
- Wordfence logs IP addresses, request details, login attempts and live traffic to protect the site against attacks.
- WP Hide & Security Enhancer hardens the website and does not collect additional personal data.
- CookieYes records your cookie choices in the
cookieyes-consentcookie.
Our Cookie Policy lists individual cookies and how long they last.
6. Who we share personal data with
We share personal data only where necessary and under appropriate contractual safeguards:
- Our colleagues at Creensight Private Limited in India, who deliver projects, support and administration for UK clients;
- Hosting, email and IT providers that run our website, email and internal tools;
- Payment providers that process card and online payments for shop orders; they act as independent controllers for payment data under their own privacy notices;
- Professional advisers such as accountants, auditors, insurers and lawyers;
- Subcontractors who help deliver a client project, only with the client’s knowledge where required by contract;
- Authorities, regulators and courts where we are legally required to, or to protect our rights.
We do not sell your personal data.
7. International transfers
Because our operating company and much of our delivery team are based in India, personal data collected through creensight.uk/ is transferred to and accessed from India. Some of our service providers may also process data in other countries.
India does not currently benefit from UK adequacy regulations. When we transfer personal data from the UK to India or to another country without UK adequacy, we protect it with an appropriate safeguard recognised under the UK GDPR, such as the International Data Transfer Agreement (IDTA) issued by the ICO or the International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, together with a transfer risk assessment and supplementary measures such as encryption and access controls. You can ask for more information about these safeguards by emailing [email protected].
8. How long we keep personal data
| Data | Typical retention period |
|---|---|
| Enquiries that do not lead to a contract | Up to 24 months after our last contact |
| Client contracts, project records and correspondence | Duration of the relationship plus 6 years (limitation period for contract claims in England and Wales) |
| Orders, invoices and accounting records | At least 6 years from the end of the relevant financial year, and longer where Indian law requires |
| Newsletter subscription | Until you unsubscribe; we keep a suppression record so we do not email you again |
| Security and firewall logs | Usually up to 90 days, longer if needed to investigate an incident |
| Cookie consent records | Up to 12 months, in line with the consent cookie lifetime |
| Unsuccessful job applications | Up to 12 months, unless you agree to a longer period |
When data is no longer needed we delete it or anonymise it securely.
9. How we protect personal data
We use technical and organisational measures appropriate to the risk, including:
- HTTPS encryption across the website;
- a web application firewall, malware scanning and login protection (Wordfence);
- hardening of the WordPress installation and limited administrator accounts;
- role-based access to client data, multi-factor authentication on key systems and staff confidentiality obligations;
- regular updates and backups, and a documented process for handling security incidents.
If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours where required, and we will tell you without undue delay if the risk is high.
10. Children
creensight.uk/ is a business website and our services are aimed at organisations and adults. We do not knowingly collect personal data from children under 13, and our shop is not intended for anyone under 18. If you believe a child has provided personal data to us, please contact us and we will delete it.
11. Your rights under UK data protection law
Subject to certain conditions and exemptions, you have the right to:
- be informed about how we use your personal data (this policy);
- access your personal data and receive a copy;
- rectification of inaccurate or incomplete data;
- erasure of your data in certain circumstances;
- restrict our processing in certain circumstances;
- data portability for data you provided to us, where processing is based on consent or contract and carried out by automated means;
- object to processing based on legitimate interests, and to direct marketing at any time;
- withdraw consent at any time where we rely on consent, without affecting processing that took place before.
12. How to make a request
Email [email protected] with the subject line “Data protection request” and tell us which right you want to exercise. We may ask for information to confirm your identity. We will respond within one month of receiving your request. If the request is complex or we receive several requests from you, we may extend this by up to two further months and will tell you why. Requests are free of charge unless they are manifestly unfounded or excessive.
13. Complaints
We would appreciate the chance to resolve any concern first, so please contact us. You also have the right to complain to the UK supervisory authority, the Information Commissioner’s Office (ICO), at ico.org.uk or by calling the ICO helpline.
14. Links to other websites
Our website links to other sites, including our global website creensight.com, social networks and Wikimedia Commons pages that credit our images. We are not responsible for the privacy practices of third-party sites, so please read their privacy notices. creensight.com is operated by the same company and has its own privacy policy written for visitors outside the UK.
15. Changes to this policy
We review this policy regularly and will update it when our processing or the law changes. The “last updated” date at the top of the page shows when it was last changed. If we make significant changes, we will highlight them on the website or tell you directly where appropriate.
16. Contact us
This website is operated by the UK office of Creensight Private Limited (CIN U74999GJ2020PTC114611). You can reach us using the details below.
| Operating company | Creensight Private Limited (CIN U74999GJ2020PTC114611), incorporated in India in 2020 |
|---|---|
| Registered office | Ahmedabad, Gujarat, India (Registrar of Companies, Gujarat) |
| UK office | London, United Kingdom |
| Contact | Data Protection Contact, Creensight UK |
| [email protected] | |
| UK website | https://creensight.uk/ |
| Global website | https://creensight.com |