Privacy Policy
ChrisXCreative — Chris Edwards, sole trader
Last updated: 21 October 2026
This statement explains what personal data ChrisXCreative collects, why we use it, how long we keep it, who we may share it with and your rights over it. It covers this website (including live chat and cookies), our client portal, and the way we work with enquirers, prospective clients and clients.
We handle personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025 (DUAA), and the Privacy and Electronic Communications Regulations (PECR), as applicable.
1. Who We Are
The data controller is Chris Edwards, trading as ChrisXCreative, a sole trader based in Kidderminster, Worcestershire.
Correspondence address: Unit 154231, PO Box 7169, Poole, BH15 9EL, United Kingdom
Email: hello@chrisxcreative.co.uk
Phone: 01562 341444
Questions about your personal data can be sent directly to Chris, who is responsible for data protection matters at ChrisXCreative.
2. What We Collect
- Enquiries: your name, email address, phone number and message when you use our contact form, live chat, “leave a message” form, email, phone or WhatsApp.
- Live chat: your messages, any files you share, your name, email address and phone number if you give them, the pages of our site you viewed during that visit and your device type (for example “Safari on iPhone”). We do not retain your IP address as part of our live-chat records. More detail is provided in section 11.
- Prospective clients: if we are discussing work with you, your contact details, notes about your requirements, proposals and quotes we prepare, and copies of relevant correspondence.
- Clients: name, organisation, billing address, contact details, project information, website and hosting details, proposals, quotes, invoices, credit notes, support tickets (including emails you send to our support address) and files shared through our client portal.
- Client portal accounts: your login email, a securely hashed password or your Microsoft account sign-in, one-time verification codes, and records of failed sign-in attempts used to help prevent unauthorised access.
- Payments: payment amounts, dates and status. Card payments are handled by Stripe and Direct Debits by GoCardless. We do not see or store your full card or bank account details.
- Emails we send: copies of relevant emails we send you, such as quotes, invoices, reminders and general correspondence, together with delivery information where available, so that we can maintain an accurate record of our communications.
- Address lookup: when you enter a postcode in one of our forms, the postcode is sent to our address lookup provider to find the relevant address.
- Website use: technical information such as browser type, device information and pages visited, collected through cookies and similar technologies where applicable. Non-essential cookies are used only where you have provided consent. See section 11 and our Cookie Policy.
- Drone work: aerial photographs and video may incidentally capture people, vehicles or property. We plan flights to minimise the unnecessary capture of identifiable individuals where reasonably possible and handle any personal data contained in such footage appropriately.
We do not intentionally collect special category data, such as health, racial or ethnic origin, religious or philosophical beliefs, political opinions or sexual orientation, unless you choose to provide such information to us. If you provide personal information that we do not need for the service you are requesting, we will handle it in accordance with applicable data protection law.
We never sell personal data.
3. Why We Use It and Our Lawful Basis
- Responding to enquiries, live chats and messages, and preparing proposals and quotes — taking steps at your request before entering into a contract, where applicable, and/or our legitimate interests in responding to enquiries and managing prospective business relationships.
- Delivering our services, invoicing, taking payments and providing support — performance of our contract with you.
- Keeping a record of relevant emails, chats and communications — our legitimate interests in maintaining an accurate history of communications, agreements, instructions and support provided.
- Keeping financial and tax records — compliance with our legal obligations.
- Keeping our website, client portal and hosting services secure, including preventing unauthorised access, limiting failed sign-in attempts and using verification codes — our legitimate interests in protecting our systems, business and customers.
- Improving our website and services — your consent where this involves non-essential cookies or similar technologies; otherwise, where appropriate, our legitimate interests in improving our services and website.
- Sending occasional information about our services — your consent where required by PECR, or where permitted by law for existing clients in relation to similar services. You can opt out of marketing communications at any time.
- Using non-essential cookies and similar technologies — your consent. You can change or withdraw your consent at any time using cookie settings.
- Keeping a record of your cookie choices — our legitimate interest in demonstrating and administering your consent choices and complying with applicable legal requirements.
Where we rely on legitimate interests, we consider the interests of ChrisXCreative against your interests, rights and freedoms before relying on that basis.
You have the right to object to processing based on legitimate interests. You also have an absolute right to object to the processing of your personal data for direct marketing purposes. See section 8 for information about exercising these rights.
We do not currently use automated decision-making or profiling that produces legal effects or similarly significant effects concerning you.
4. Who We Share It With
We only share personal data where there is a lawful basis for doing so and, where appropriate, with trusted providers that help us operate the business. Where a provider processes personal data on our behalf, we require appropriate contractual protections and security measures.
- Web hosting: our UK hosting provider, including UK data centres where applicable, which stores and supports this website, the client portal and related services.
- Email, sign-in and business software: Microsoft 365, which we use for business email and Microsoft account sign-in to the client portal.
- Payments: Stripe for card payments and GoCardless for Direct Debit payments.
- Address lookup: our postcode/address lookup provider, which receives the postcode you enter into a relevant form.
- Website features: services providing reviews, video, maps, analytics or other embedded website functionality, including providers such as Google and YouTube, where applicable and where the relevant non-essential technology has been permitted through our consent mechanism.
- Professional advisers and authorities: accountants, HMRC, regulators, law enforcement bodies or other authorities where disclosure is necessary or required by law.
Notifications of new chats and messages are sent only to Chris’s own devices and, where the relevant service supports it, are protected using end-to-end encryption. The technical services used to deliver such notifications may still process limited technical information necessary to deliver them.
International transfers
Some of our service providers may process or make personal data accessible outside the United Kingdom. Where a restricted international transfer applies, we will ensure that the transfer is covered by an applicable UK adequacy regulation, an appropriate safeguard such as the UK International Data Transfer Agreement (IDTA) or UK Addendum, or another lawful transfer mechanism available under UK data protection law.
Where required, we will carry out an appropriate assessment of the transfer and take any additional technical, contractual or organisational measures necessary to ensure that the standard of protection for personal data is not materially lower than in the UK.
Information about applicable international transfer arrangements may also be available in the relevant provider’s privacy information and contractual documentation.
5. Websites We Host or Maintain
If we host or maintain your website, personal data collected by your website — for example through contact forms, online shops, bookings or donations — is normally processed on your behalf and you remain the data controller for that information.
ChrisXCreative may act as your data processor where we process such personal data on your instructions. Our processing will be governed by the applicable contractual arrangements, including our Terms and Conditions and any applicable data processing agreement.
As a processor, we will process personal data only in accordance with your documented instructions, maintain appropriate confidentiality and security measures, and provide reasonable assistance with applicable UK GDPR obligations where required by our agreement and the law.
6. How Long We Keep It
- Enquiries and prospective clients that do not lead to work — normally up to 12 months after our last meaningful contact, then deleted or securely disposed of unless there is a legitimate reason or legal obligation to retain it for longer.
- Live chats — normally 12 months, or for as long as you are a client where the chat forms part of your client record.
- Browsing data from visitors who do not start a chat — normally 30 days where such information is collected.
- Copies of emails we send — normally 90 days where they are not part of a client or business record. Relevant correspondence with clients is retained as part of the applicable client record.
- Client records, proposals, quotes and invoices — normally up to 6 years after the end of the tax year to which the relevant records relate, or longer where a legal, contractual or legitimate business reason requires this.
- Client portal accounts — for as long as you are a client. Accounts may then be closed following the end of the client relationship or after a period of inactivity, subject to retaining information that we are legally required or otherwise entitled to retain.
- Failed sign-in records — automatically removed after 15 minutes unless a longer period is necessary to investigate an actual or suspected security incident.
- Records of cookie choices — normally retained for up to 2 years, or for the period specified by the consent-management system, so that we can remember and demonstrate your choices.
- Website backups — rolling backups are overwritten automatically on a regular cycle. Information contained in backups may therefore remain for a limited period after it has been deleted from live systems.
Retention periods may vary where we need to retain information to comply with a legal obligation, establish, exercise or defend legal claims, prevent fraud or abuse, investigate security incidents, or otherwise comply with applicable law.
7. How We Protect It
We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, destruction, alteration or disclosure. These measures include SSL/TLS encryption, secure hosting, access controls, two-step verification where supported, limits on failed sign-in attempts, protected storage for files shared with us, secure signed links where applicable, and regular backups.
Access to personal data is limited to what is reasonably necessary for the relevant business purpose.
No internet or electronic storage system can be guaranteed to be completely secure. If we become aware of a personal data breach, we will assess it promptly and take appropriate action. Where required by UK GDPR or other applicable law, we will notify the Information Commissioner’s Office and/or affected individuals.
8. Your Rights
Under UK data protection law, you may have the right to:
- Access — obtain a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate or incomplete personal data.
- Erasure — ask us to delete your personal data where there is no lawful reason for us to continue processing or retaining it.
- Restriction — ask us to restrict processing in certain circumstances.
- Data portability — receive certain personal data in a structured, commonly used and machine-readable format, and ask us to transmit it to another controller where the legal requirements are met.
- Withdraw consent — withdraw consent at any time where we rely on consent as our lawful basis. This includes changing your non-essential cookie choices using cookie settings.
Right to object
You have the right to object to processing of your personal data where we rely on legitimate interests as our lawful basis. In some circumstances we may be able to demonstrate compelling legitimate grounds for continuing the processing.
You have an absolute right to object to the processing of your personal data for direct marketing. You can exercise this right at any time, including by using an unsubscribe facility included in a marketing communication or by contacting us.
To exercise any of these rights, contact hello@chrisxcreative.co.uk.
We may need to verify your identity before responding to a request. We normally respond to valid rights requests within one month. Where permitted by law, this period may be extended by up to a further two months where a request is complex or multiple requests have been made. We will tell you if an extension is necessary.
We normally provide rights information free of charge, although applicable law allows us to charge a reasonable fee or refuse a request where it is manifestly unfounded or excessive.
9. Data Protection Complaints
If you are unhappy or concerned about how ChrisXCreative has handled your personal data, you can make a data protection complaint by contacting us at hello@chrisxcreative.co.uk.
We will provide a clear route for raising data protection complaints and will acknowledge receipt of a complaint within 30 days of receiving it.
We will take appropriate steps to investigate the complaint without undue delay, consider the information and circumstances relevant to the complaint, and keep you informed of progress where appropriate. We will communicate the outcome of the complaint to you without undue delay once our investigation has been completed.
If you remain dissatisfied after we have considered your complaint, you have the right to complain to the Information Commissioner’s Office (ICO).
You can contact the ICO through ico.org.uk/make-a-complaint or by telephone on 0303 123 1113.
10. Changes to This Statement
We may update this statement from time to time to reflect changes to our services, technology, legal requirements or how we process personal data.
The latest version will always be available on this page and will show the date it was last updated.
Section 11 may be updated when the cookies, consent mechanisms or third-party services used on our website change. Where we make significant changes that materially affect how we use personal data, we will take appropriate steps to bring those changes to your attention and, where appropriate, notify affected clients directly.
11. Cookies, Live Chat and Consent Records
This section is maintained in accordance with the cookies, live-chat services and consent-management technology currently used on this website.
Non-essential cookies and similar technologies are not used unless you have provided the required consent. You can change or withdraw your cookie choices at any time using cookie settings.
Our Cookie Policy provides further information about the cookies and similar technologies used on this website, their purposes and applicable retention periods.
Where you interact with live chat, the chat provider may process information necessary to provide the service, including your messages, technical information and information you voluntarily provide. Live chat is not used to collect special category data intentionally.
When you make a cookie choice, our consent-management system may create and retain a record of that choice. This may include a pseudonymised value derived from technical information, such as your IP address, where necessary to help prevent duplicate consent records or demonstrate the choice that was made. We do not use this information to identify you for unrelated purposes.
12. Contact Us
If you have any questions about this Privacy Statement, how we use your personal data, your rights, or a data protection complaint, contact:
ChrisXCreative — Chris Edwards
Email: hello@chrisxcreative.co.uk
Phone: 01562 341444
Correspondence address: Unit 154231, PO Box 7169, Poole, BH15 9EL, United Kingdom