Privacy Policy

Who is responsible

Creative Spark Digital Ltd is the controller for the personal information described in this policy. The company is registered in England & Wales under company number 17059945. The registered office is 128 City Road, London, EC1V 2NX, United Kingdom.

I trade as Creative Spark Digital. There is no separate privacy team and no Data Protection Officer has been appointed. Privacy questions and data-rights requests go to cssdesignstudiouk@gmail.com. There is no automated rights portal on this website.

Information I collect

What I collect depends on what you use. The later sections describe each service.

• Contact and business details you type into a form, and the emails we then exchange.
• Project, discovery, health-check, plan, and launch information you choose to provide.
• Records created when a plan is accepted or a payment is taken.
• Limited technical information needed to run a page, keep a session, or limit abuse.

The public forms do not ask for special category information, such as health, religion, or biometric data. A free-text box could contain something you choose to write. I do not ask you to provide that.

A Website Health Check produces an automated, AI-assisted review of a public website. That review does not make a legal or similarly significant decision about you, and it does not decide whether you must buy a service.

Why I use it

I use personal information to:

• reply to enquiries
• prepare a quote or Website Plan
• book a Discovery Call
• provide a Website Health Check you have asked for
• carry out a Discovery questionnaire
• deliver a website or software project
• administer the client and project relationship
• provide Track Project and the client portal
• collect the launch and compliance details needed for a site
• provide Website Care where you have taken it
• take and record payments
• keep accounting, tax, and other business records
• protect the site, limit misuse, and control access
• understand how this website is used, where you have allowed analytics
• send promotional email where there is a valid marketing permission
• keep a record of a marketing objection so promotional email is not sent by mistake
• establish, exercise, or defend a contractual or legal claim where that is needed

Lawful basis

The basis depends on the activity. I do not treat every use as a legitimate interest, and I do not treat service delivery as consent.

• Contract, or steps you have asked for before a contract. This covers a reply to an enquiry, a requested quote or Website Plan, a Discovery Call, a Discovery questionnaire, a Website Health Check you request, project setup and delivery, Track and the client portal, launch details needed to build the site, Website Care you take, and payment for an agreed service.
• Legal obligation. This covers accounting and tax records, and other records the law requires me to keep.
• Consent. This covers optional promotional email, and analytics or performance tools that run only after you allow them. You can request a Health Check, and you can submit a Discovery questionnaire, without agreeing to marketing.
• Legitimate interests. This covers proportionate protection of the site and admin access, ordinary business administration that is not itself the service you asked for, keeping a marketing suppression so an objection is honoured, and approaching other businesses about professional services. It is not used for private consumer profiling.

More than one basis can apply to the same event. An invoice for agreed work is part of the contract, and the accounting copy may also have to be kept by law. You can object to processing based on legitimate interests. That right is explained below.

Website enquiries

The contact form asks for your name, email address, business name if you provide one, the service you are asking about, and your message. Sending it does not create a contact record in the website database. The enquiry is emailed to me, and you receive an acknowledgement email. Later email correspondence about that enquiry is kept in the email account.

If you have allowed analytics, the site can also record that the contact form was submitted. That event does not include the text of your message.

Project enquiries

Start Your Project uses the project enquiry form. It can store your name, email address, phone number, business information, website, project requirements, package and other preferences, and the rest of your answers. The submission records when you agreed to this policy and the Terms, the policy version, the browser user agent, and a draft or session identifier used while the form is open.

An unfinished draft is saved so you can continue. The editable access window is 30 days, and saving the draft again starts that window from the latest save. A copy of the draft identifier can be kept in your browser for that purpose. The answers themselves are stored on the server. Expiry of that access window is not the same as deletion. The retention section explains when an unused draft is then removed.

The form no longer accepts new file uploads. A file uploaded before that change can still be held with the enquiry until the enquiry itself is removed.

No payment is taken when you send the enquiry.

Discovery

Booking a Discovery Call is optional. If you book one, the form asks for your contact details, business and website if you provide them, what you want help with, a budget range, and the appointment you choose. The booking is stored and a confirmation email is sent. It can be linked to an existing enquiry, including a Website Health Check. Notes I make about the meeting can be stored with that booking.

A Discovery questionnaire, where I send you one, stores your answers, business and contact details, preferences, your legal acknowledgements, and your optional marketing choice. On submission it also stores the IP address, browser user agent, the time, and the privacy and terms versions you were shown. A secure session is used so the questionnaire page can recognise the browser after you open the link. That session is essential to the questionnaire. It is not a marketing cookie, and it is not a copy of your answers.

An unfinished questionnaire can be edited for 60 days, and saving it again starts that window from the latest save. Expiry of that editing window is not the same as deletion.

The questionnaire no longer accepts new file uploads. A file uploaded before that change can still be held with that questionnaire. An older browser copy of a questionnaire link is not how the questionnaire is accessed now, and the page does not rely on one.

Website Health Check

The Website Health Check asks for your name, email address, business name if you provide one, your website address, and a business type. It fetches the public pages at that address and prepares a report. The report, information taken from those public pages, and the scores and analysis, are stored with the lead. Older Health Check records may still contain a homepage image where one was stored before that capture was stopped. A copy of the report is emailed to you. The lead can also store whether that report was sent and whether a later promotional follow-up was sent or skipped.

To produce the written analysis, page content from the site you submit is sent to OpenAI. If that step fails, the check can still record that the scan did not complete. I do not send OpenAI a client's full project file for this check. I also do not control, and this policy does not state, how long OpenAI keeps that request or whether OpenAI uses it for training.

The written report is a service message about the check you requested. It is sent whether or not you agree to marketing. Later promotional emails are described in the marketing section. They are not part of the report.

The server may use your IP address briefly to limit repeated requests. That limit is kept in server memory. It is not saved as a customer record.

Marketing emails

Promotional email is optional. The marketing box on the Website Health Check, and the marketing box on the Discovery questionnaire, are unticked. You can request the Health Check, and you can submit the questionnaire, without ticking either box. Ticking a box is a choice to hear about website tips, offers, or other promotional information, as the wording on that form explains.

Promotional follow-ups about a Website Health Check, sent about two days and about seven days after the report, are sent only where there is a current record that you agreed to marketing. If there is no such record, those promotional emails are not sent. A record that you have unsubscribed also blocks them.

You can unsubscribe from promotional email using the link in a promotional message, or by emailing me. Unsubscribing creates or updates a short suppression record for that email address: that marketing should not be sent, when that choice was made, and that it came from an unsubscribe. I do not put the rest of your enquiry into that record.

I can keep that suppression after the original enquiry, Health Check, or questionnaire has been deleted. If I deleted the objection with the enquiry, a later form could be treated as a new contact. The suppression exists so the objection can still be honoured.

Stopping promotional email does not stop emails about a service you asked for, a project, or a payment. Those messages do not use the marketing unsubscribe.

Where I am relying on a marketing permission, I keep the record of that permission while I rely on it. I will review a permission where there has been no meaningful marketing engagement, and no renewed permission, for 24 months. That review is my own practice. UK law does not set 24 months as the required period. I do not promise to delete a suppression record after a fixed time. I keep the minimum needed to honour the objection and avoid contacting you again by mistake.

Plans, projects, and acceptance

A Website Plan can include your contact and business details, the scope, price, package, hosting or Website Care choices, and a PDF or snapshot of the plan. The plan page is reached with a link meant for you. It is not a public marketing page. Access to that page can be recorded, including a browser user agent where the page collects it.

If you accept a plan, I keep the acceptance as contract evidence. That can include the name, email address, and business name you enter, the time, the IP address, the browser user agent, the choices you confirm, a signature you type, the terms and privacy versions shown to you, and a snapshot of the commercial terms you accepted.

An acceptance keeps the privacy version recorded at that time. A later update to this page does not rewrite that record.

If we agree to work together, I also keep the contact, business, file, and message records needed to do the work and to administer the project.

Compliance and launch details

Website Compliance and Launch Details is a form used when a project needs the information to build or launch the site. It can include the legal, trading, and business identity, company number, business address, privacy and contact arrangements, how the business handles customer information, booking and payment choices, analytics choices, marketing and advertising choices, permissions for photos, content, and reviews, a declaration, the IP address, the browser user agent, the client email address, timestamps, and any clarification I ask for afterwards.

Those answers are kept with the related project or client record where they are still needed for that work. They are not a public marketing profile.

Track and the client portal

Track Project lets you look up an existing project with the email address on the project and a job reference, or with a link meant for you. The lookup checks those details against the project record. It does not create a new customer profile from the search itself. If the details do not match, the project is not shown.

Track and the client portal then show the project identifier, progress, and the updates that are meant for the client. After you are recognised, a secure session is used so you can continue without sending the lookup details on every request. That session is essential to those pages. It is not used for marketing.

Payments and Website Care

Deposits, final payments, and Website Care payments are taken through Stripe. You enter the card on Stripe. This website does not store the full card number or the CVC.

I do keep billing and finance records. Those can include the billing name, contact details, and address, amounts, whether an invoice, receipt, or payment succeeded, Stripe identifiers, and the invoice or receipt itself. The accounting copy is a business record. The website does not automatically delete it.

Website Care is optional and is separate from the one-off website project price. Taking a Care plan is not required in order to own the bespoke website after the agreed project payments. Where you take Care, I keep the agreement, the plan, the price, the time the agreement was made, the billing contact, and Stripe customer or subscription identifiers needed to run the billing. Hosting that is included in a Care plan is described in the Terms.

Cookies, sessions, and analytics

This website uses a small amount of browser storage. Essential storage covers security and the sessions described above, including the Discovery questionnaire session and the Track and client portal session. It also covers storage of your cookie choice, for about six months, and a draft identifier for an unfinished project enquiry. Optional analytics and performance tools run only after you allow them.

If you allow analytics, the site can record page views and button clicks, a short-lived session identifier, the referring page, and campaign parameters from the link you used. Vercel Web Analytics and Vercel Speed Insights run only after that choice. Microsoft Clarity is loaded only when it is configured and you have allowed analytics. It is used to understand how pages are used. It is not used for advertising. This site does not use Google Analytics, and it does not currently set marketing cookies.

Separately, when you complete a requested step, such as a Website Health Check, I can store an operational record of that step. It can include the page, a session identifier, the referring page, campaign parameters, and the consent state. That record is about the step you took. It is not an advertising profile. The Cookie Policy lists the cookies and similar storage in more detail.

Where a client website uses Creative Spark Digital's own measurement, and that measurement has been switched on for that site, the site can send page and event information here. That can include a page path, a visitor key, the referring page, campaign parameters, a broad device category, the browser, and a country value if the site sends one. The service is built to reject a message that includes an email address, name, phone number, or the text of a message. It is not a record of every visitor to every client website.

You can withdraw optional analytics consent in Cookie settings in the footer. Withdrawing it does not delete a business record that was already created because you submitted a form.

Business prospecting

I sometimes look for other businesses that may need a website. That work uses business and professional information, including company information from Companies House and notes about a business website. It is not a profile of private consumers.

Where I use OpenAI for that work, it is to help draft a professional approach from those business notes. I do not send OpenAI a client's full project record for this. An approach is prepared for me to send. It is not an automatic decision about a person. This policy does not state how long OpenAI keeps that request.

Who information is shared with

I do not sell personal information. Information is shared where it is needed to run the service:

• Vercel, to host this website and, if you allow analytics, to measure visits and performance.
• The provider that hosts the database for project, booking, lead, health-check, and related records. The details published on this website do not name that provider or a country for the database.
• Stripe, to take payments and provide payment, invoice, and subscription records.
• Resend, to send emails such as enquiry acknowledgements, booking confirmations, health check reports, and project messages.
• OpenAI, for the written Website Health Check analysis and, where used, a business outreach draft.
• Microsoft, only if Clarity is configured and you allow analytics.
• Companies House, when I search for company information as part of business research.
• An accountant or other adviser where I need help with tax, accounts, or a legal duty.
• A court, regulator, or other person where the law requires it, or where it is necessary to protect the site or the people using it.

I have not set out on this page a checked data-processing agreement, or a particular international transfer clause, for each provider. That review is still open.

International processing

Some of these providers may process information outside the United Kingdom. I do not state a country for each provider on this page, because that location is not recorded here.

Where UK rules require a safeguard for a transfer, I am required to use an appropriate lawful transfer mechanism. This page does not claim that a particular adequacy decision, contract clause, or hosting region has been verified for each provider. If you ask about a transfer, I will tell you what I can from the arrangement actually in place.

How long information is kept

Access to an unfinished form and deletion of the record are different. A draft can stop being editable before it is deleted. A live contract, proposal, or project can also keep a related record after the usual period for an unused enquiry.

• An unfinished project enquiry can be edited for 30 days from the latest save. If it is still unused, it is deleted 30 days after that access expires.
• A submitted project enquiry that does not progress is deleted after 12 months, unless it still needs to be kept because of a proposal, a project, or another relevant commercial relationship.
• An unfinished Discovery questionnaire can be edited for 60 days from the latest save. If it is still unused, it is deleted 30 days after that access expires.
• A submitted Discovery questionnaire that has not moved into a proposal or project is deleted after 12 months. One that is still being reviewed, or that is linked to a proposal or project, is not removed by that routine.
• A Discovery Call that stands on its own is deleted 12 months after the appointment, unless it is still needed for a related enquiry, Health Check, proposal, or project.
• A Website Health Check that stands on its own is deleted 12 months after the latest relevant activity on that check, such as the check itself, the report, a follow-up that was sent, a manual review request, or creation of the report file. It is not deleted by that routine if it is connected to a proposal, a project, or a relevant commercial relationship.
• Operational conversion records on this website are deleted after 12 months.
• Client, contract, and related project records may be kept for up to six years after the relevant relationship ends, where they are still needed for the contract, a legal obligation, or the business record. The website does not automatically delete those records after six years.
• Accounting and tax records are kept for the period required by law. For company records that period is generally at least six years where it applies. The website does not automatically delete those records.
• Compliance and launch details are kept with the associated project or client record where they are still required.
• Website Care agreements and billing evidence are kept for as long as the contract and the financial record require.
• A marketing permission is kept while I am relying on it, and is reviewed as described in the marketing section. A marketing suppression is kept for as long as it is needed to honour the objection. It is not given an automatic deletion date.
• Your cookie choice is stored for about six months. The Cookie Policy has the detail.

You can ask me to delete information. I will do that where the law and any live contract, accounting duty, or marketing objection allow it.

Security

I use reasonable technical and organisational measures appropriate to this business. They include encrypted connections to the website, limits on who can use admin tools, and providers used for hosting, email, and payments. Admin sign-in can create a security record. Where an IP address is stored for that purpose, it can be stored in a hashed form, together with the browser user agent. Those records are for protecting the admin area.

I do not hold a security certification for this website, and no online service can promise that information is completely secure.

Your rights

Under UK data protection law you may have the right to:

• ask for a copy of the personal information I hold about you
• ask me to correct information that is wrong
• ask me to delete information in some situations
• ask me to restrict how information is used in some situations
• object to processing based on legitimate interests, including business prospecting
• object to direct marketing, which I will stop
• ask for information you provided, in a portable format, where the basis is consent or a contract and the processing is automated
• withdraw consent where consent is the basis, including optional analytics and marketing email

These rights depend on the circumstances and on the lawful basis. They are not absolute. I may need to keep an invoice, or a marketing suppression, even if you ask for deletion. Withdrawing marketing consent, or objecting to promotional email, does not undo processing that was already carried out lawfully, and it does not stop a service, project, or payment email that is still required.

Email cssdesignstudiouk@gmail.com to make a request. I may need enough detail to find the right record. There is no automated form for this.

Children

These services are aimed at businesses and the adults who run them. I do not knowingly collect personal information from children through this website.

Changes to this policy

I will update this page when the way the website handles personal information changes in a way that matters. The date at the top is the date of the latest update. New enquiry, Discovery, and Website Plan records made after that date can store this version. A record already accepted keeps the version stored at that time. Continuing to use the site after an update does not by itself replace a consent you have already given.

Contact and complaints

Creative Spark Digital Ltd
128 City Road, London, EC1V 2NX, United Kingdom
cssdesignstudiouk@gmail.com

You can also use the contact form. The Terms explain the commercial relationship. The Cookie Policy explains cookies.

If you are unhappy with how your information has been handled, you can complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk. This website does not publish an ICO registration number, because one is not recorded in the company details used here.