Creative Marketing Group Ltd is committed to protecting your personal data and upholding your privacy rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Last updated: 11th March 2026 · Company Reg No. 15329031
The UK General Data Protection Regulation (UK GDPR) is the United Kingdom's primary data protection framework, retained and adapted from the EU GDPR following Brexit. It works alongside the Data Protection Act 2018 to govern how organisations collect, use, store, and erase personal data.
The UK GDPR is enforced by the Information Commissioner's Office (ICO) and grants individuals comprehensive rights over their personal data, including the right to access, rectify, erase, and port their information.
Since leaving the European Union, the UK has maintained its own adequacy framework for international data transfers. The UK Extension to EU adequacy decisions, UK International Data Transfer Agreements (IDTAs), and the UK Addendum to EU Standard Contractual Clauses provide mechanisms for lawful cross-border data transfers.
As of 2026, the Data Protection and Digital Information Act has introduced further refinements to the UK's data protection landscape, including streamlined Subject Access Request processes, updated rules on legitimate interests, and enhanced provisions for research and innovation. Creative Marketing Group Ltd monitors all legislative developments and updates its practices accordingly.
Creative Marketing Group Ltd takes data protection seriously. We have embedded privacy by design and by default into every aspect of our operations, from initial data collection through to secure storage and eventual deletion.
We process personal data lawfully, fairly, and transparently. We collect only the minimum data necessary for the stated purpose, retain it only for as long as required, and protect it with industry-standard technical and organisational measures.
Our team receives regular data protection training, and we maintain comprehensive records of all processing activities. We work closely with our sub-processors to ensure they meet the same high standards we hold ourselves to.
Whether you are a client, a website visitor, or a prospective customer, your privacy matters to us. This page outlines how we comply with the UK GDPR and explains your rights in clear, straightforward language.
The UK GDPR grants you comprehensive rights over your personal data. Creative Marketing Group Ltd is committed to facilitating the exercise of these rights promptly and free of charge.
You may request that we delete all personal data we hold about you. We will comply without undue delay unless a legal obligation requires retention.
You have the right to obtain confirmation of whether we process your personal data, and to receive a copy of that data in a structured, commonly used format.
You may request that we correct inaccurate personal data or complete incomplete data that we hold about you.
You have the right to object to the processing of your personal data where we rely on legitimate interests, including profiling and direct marketing.
You may request that we transfer your personal data to another organisation in a machine-readable format where technically feasible.
You may request that we restrict the processing of your personal data while we verify its accuracy or assess an objection you have raised.
How to exercise your rights: To make a request regarding any of your data protection rights, please contact us at info@creativemarketingltd.co.uk or call 01706 318200. We will respond to your request within one calendar month. In certain circumstances, we may extend this period by a further two months, but we will inform you of any such extension within the initial one-month period.
Under the UK GDPR, we must have a valid lawful basis to process your personal data. We rely on the following bases depending on the context:
Where you have given clear, informed, and unambiguous consent for us to process your personal data for a specific purpose.
Where processing is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract.
Where processing is necessary for our legitimate interests or those of a third party, provided your fundamental rights do not override those interests.
Where processing is necessary to comply with a legal obligation to which Creative Marketing Group Ltd is subject under UK law.
We collect and process the following categories of personal data. We adhere to the principle of data minimisation, collecting only what is necessary for the stated purpose.
Category
Examples
Identity Data
Full name, job title, company name
Contact Data
Email address, telephone number, postal address
Technical Data
IP address, browser type, operating system, device identifiers
Usage Data
Pages visited, interaction data, referral source
Marketing Data
Communication preferences, consent records, campaign interactions
Financial Data
Payment details, billing address, transaction history (where applicable)
Where we rely on consent as our lawful basis, we ensure that consent is freely given, specific, informed, and unambiguous. Under the UK GDPR:
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our retention periods are reviewed annually and documented in our Records of Processing Activities.
We implement robust technical and organisational security measures to protect personal data against unauthorised access, loss, destruction, or alteration:
Under the UK GDPR, organisations that process personal data do so as either a Controller or a Processor. Understanding these roles is important for compliance.
The Controller determines the purposes and means of processing personal data. In most circumstances involving our marketing services, our clients act as the Data Controller — they decide what information is collected from their customers and how it is used. Creative Marketing Group Ltd acts as the Data Controller for data collected directly through our own website, enquiry forms, and recruitment processes.
The Processor processes personal data on behalf of the Controller. When providing marketing services to our clients, Creative Marketing Group Ltd typically acts as a Data Processor. We process client data strictly in accordance with our clients' documented instructions and our Data Processing Agreements. We maintain a list of vetted sub-processors and conduct due diligence before engaging any new third-party service provider.
Following Brexit, the UK has established its own framework for international data transfers. Personal data may only be transferred outside the UK where adequate safeguards are in place.
Creative Marketing Group Ltd relies on the following mechanisms for lawful international transfers:
We conduct Transfer Risk Assessments for all international transfers to ensure that the level of protection guaranteed by the UK GDPR is not undermined. We monitor developments from the ICO and the UK Government regarding adequacy decisions and transfer mechanisms.
The following table summarises our key compliance measures against the UK GDPR requirements.
| Requirement | Reference | Actions Taken |
|---|---|---|
| Lawful Basis for Processing | UK GDPR Article 6 | We establish and document a lawful basis for all personal data processing activities. Where consent is the basis, it is obtained explicitly and recorded. |
| Data Protection by Design | UK GDPR Article 25 | We implement appropriate technical and organisational measures at the design stage of all systems and processes to ensure data minimisation and protection. |
| Data Protection Impact Assessments | UK GDPR Article 35 | We conduct DPIAs for processing activities likely to result in a high risk to individuals' rights and freedoms. |
| Encryption & Security | UK GDPR Article 32 | Personal data is encrypted in transit (TLS 1.3) and at rest (AES-256). We conduct regular security audits and penetration testing. |
| Records of Processing | UK GDPR Article 30 | We maintain comprehensive records of all processing activities, including purposes, data categories, recipients, and retention periods. |
| Data Breach Notification | UK GDPR Article 33/34 | We have procedures to detect, report, and investigate personal data breaches. Reportable breaches are notified to the ICO within 72 hours. |
| International Transfers | UK GDPR Article 46 | Where data is transferred outside the UK, we rely on UK adequacy regulations, International Data Transfer Agreements (IDTAs), or UK Addenda to EU SCCs. |
| Children's Data | UK GDPR Article 8 | We do not knowingly collect or process personal data from children under the age of 13. |
Non-compliance with the UK GDPR can result in significant financial penalties. The ICO has the power to issue fines of up to £17.5 million or 4% of annual global turnover, whichever is higher, for the most serious infringements.
Beyond financial penalties, non-compliance can lead to enforcement notices, audits, reputational damage, and loss of customer trust. Creative Marketing Group Ltd maintains a proactive approach to compliance to protect both our organisation and the individuals whose data we process.
If you have any questions about this policy, your personal data, or would like to exercise any of your rights under the UK GDPR, please contact us.
Registered Address
Creative Marketing Group Ltd
Moss Bridge House, Moss Bridge Road
Rochdale, Greater Manchester, OL16 5EA
Company Reg No. 15329031
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data protection rights have been violated.
