Privacy Policy

Last updated: 22 June 2026

This privacy policy explains how Five To Nine Creative Ltd ("we", "us", "our") collects, uses and protects your personal data when you visit www.fivetoninecreative.com (the "website") or otherwise interact with us. It also sets out your rights and how to exercise them.

We are committed to protecting your privacy and handling your data openly and lawfully, in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

Who we are

Five To Nine Creative Ltd is the data controller responsible for your personal data. This means we decide how and why your data is processed.

We are registered with the Information Commissioner's Office (ICO), the UK's data protection regulator, under registration reference ZC062638.

If you have any questions about this policy or how we handle your data, contact us at admin@fivetoninecreative.com.

The personal data we collect

Depending on how you interact with us, we may collect the following:

Information you give us directly

  • Your name and email address when you subscribe to our newsletter or mailing list.

  • Your name, email address and any details you provide when you book a call or meeting through our scheduling tool.

  • Any information you include when you contact us by email or through the website.

  • Where you become a client, the contact and billing details needed to deliver our services and issue invoices.

Information we collect automatically

  • Usage and device data when you browse the website, such as your IP address, browser type, pages visited, time spent on pages and referring website. This is collected through analytics cookies, and only where you have given consent.

We do not collect special category data (such as health, ethnicity or political opinions) through the website, and we ask that you do not send us such information unless it is genuinely necessary for work we are doing together.

How and why we use your data

We only use your personal data where we have a lawful basis to do so under UK GDPR. The table below sets out what we do and why.

What we do Why Lawful basis Send you our newsletter and marketing emails To share content and updates you have asked to receive Consent. You can withdraw it at any time by unsubscribing. Manage call and meeting bookings To arrange and confirm appointments you request Performance of a contract, or taking steps at your request before entering one Respond to your enquiries To answer questions and provide information you ask for Legitimate interests (responding to people who contact us) Deliver services to clients and issue invoices To carry out the work we are engaged to do and get paid Performance of a contract Analyse website usage To understand how the site is used and improve it Consent (via analytics cookies) Keep financial and tax records To comply with our legal obligations Legal obligation

We will not use your data for any new purpose that is incompatible with the above without telling you first.

Marketing emails

If you subscribe to our mailing list, we will send you emails based on your consent. Every marketing email includes an unsubscribe link, and you can opt out at any time. Withdrawing consent does not affect the lawfulness of anything we did before you withdrew it.

Cookies

Cookies are small text files placed on your device when you visit a website. We use:

  • Strictly necessary cookies, which are required for the website to function. These do not need your consent.

  • Analytics cookies (Google Analytics), which help us understand how visitors use the site. These are only set where you have given consent.

When you first visit the website, you will be shown a cookie banner allowing you to accept or reject non-essential cookies. You can change your preferences at any time through the banner or your browser settings. Most browsers also let you block or delete cookies; doing so may affect how the website works.

Our embedded booking tool may also set cookies needed for it to function when you use it.

Who we share your data with

We do not sell your personal data. We share it only with trusted third parties who help us run our business, and only as far as needed. These act as our data processors and are bound to keep your data secure and use it only on our instructions.

Provider Purpose

Flodesk Email marketing and managing our mailing list

Google Workspace Email, file storage and general business operations

Google Analytics Website usage analytics

Cal.com Scheduling and managing bookings

Stripe Processing client payments and issuing invoices

Canva Creating and managing design and content assets

We may also disclose your data where we are legally required to, for example to comply with a court order, tax authority or regulator.

International data transfers

Some of our providers are based outside the UK, including in the United States. Where your personal data is transferred outside the UK, we make sure it is protected by appropriate safeguards recognised under UK data protection law. These include the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it.

How long we keep your data

We keep personal data only for as long as we need it for the purposes set out in this policy, or for as long as the law requires.

  • Mailing list data is kept until you unsubscribe or ask us to delete it.

  • Booking and enquiry data is kept for as long as needed to deal with your request and for a reasonable period afterwards.

  • Client and financial records are kept for at least six years to meet our legal and tax obligations.

When we no longer need your data, we securely delete or anonymise it.

How we protect your data

We use appropriate technical and organisational measures to keep your data secure, including access controls and reputable service providers who maintain their own security standards. No method of transmission over the internet is completely secure, but we take reasonable steps to protect your information.

Your rights

Under UK data protection law, you have the right to:

  • Access the personal data we hold about you.

  • Rectification of inaccurate or incomplete data.

  • Erasure of your data in certain circumstances.

  • Restrict or object to our processing in certain circumstances.

  • Data portability, to receive your data in a usable format.

  • Withdraw consent at any time where we rely on it.

To exercise any of these rights, email us at admin@fivetoninecreative.com. We will respond within one month. There is normally no charge.

Complaints

If you are unhappy with how we have handled your data, please contact us first so we can try to put things right. You also have the right to complain to the ICO:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Telephone: 0303 123 1113 Website: ico.org.uk

Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page with a revised "last updated" date. Please check back periodically.