Privacy Policy

1. Who We Are

This Privacy Policy explains how Creative Retail (Developments) Ltd (“we”, “us”, “our”), part of the Creative Retail Group, collects and uses personal data. We are registered in England & Wales under Company Number: 13739174, with our registered address at:

We act as an independent Data Controller for the consultancy services we provide.

2. Personal Data We Collect

We collect and process personal data for the purpose of providing end-to-end consultancy services for commercial developments.

2.1 Data you provide directly

• Name
• Email address
• Phone number
• Company or organisation
• Project or enquiry details
• Any documents you voluntarily share
• Billing or invoicing details (if applicable)

2.2 Data we collect automatically

When you visit our website, we use Google Analytics to collect:

• IP address
• Device information
• Browser type
• Pages visited and time spent on the site
• Geographic region (approximate)

This helps us understand how our website is used and improve our services.

2.3 Data from third-party sources

We may receive additional information from:

• Project partners
• Planning consultants
• Cloud systems used during consultancy work

3. Our Legal Bases for Processing

Under the UK GDPR, we process personal data under the following lawful bases:

• Contract – to respond to enquiries, provide consultancy services, and manage active projects
• Legitimate Interests – to improve our website and service offerings, ensure security, and maintain business records
• Legal Obligation – to comply with tax, accounting, and corporate laws
• Consent – only where you explicitly consent, such as optional analytics cookies (if ever added in future)

4. How We Use Your Personal Data

We use your information to:

• Provide commercial development consultancy services
• Communicate regarding enquiries, proposals, and active projects
• Coordinate planners, site acquisition processes, or partners
• Improve our website and understand visitor behaviour
• Maintain administrative and financial records
• Meet legal and contractual requirements

We do not sell personal data, and we do not use it for unsolicited marketing.

5. Data Sharing and Third Parties

We may share personal data with trusted third-party providers essential to our operations, including:

• Google Cloud (hosting and storage services)
• Email communication services
• Professional advisers (legal, accounting, planning consultants)
• IT and security service providers

These providers only process personal data under our instruction and always in compliance with the UK GDPR. We do not share your information with advertisers or social media platforms.

6. International Data Transfers

Because we use Google Cloud, your data may be stored or processed outside the UK.

Where this occurs, we rely on:

• UK GDPR-approved Standard Contractual Clauses (SCCs)
• Google’s security and compliance framework
• Additional contractual and organisational safeguards

These ensure your personal data remains protected.

7. Data Retention

We retain personal data only for as long as necessary.

• Enquiries and project-related data: 2 years
• Financial and accounting records: 6 years (legal requirement)
• Any other data: retained only as long as needed to fulfil its purpose or comply with law

After these periods, data is securely deleted or anonymised.

8. Your Rights Under UK GDPR

You have the right to:

• Access your personal data
• Request correction of inaccurate information
• Request deletion of your data
• Object to processing based on legitimate interests
• Request restriction of processing
• Request data portability
• Withdraw consent (where applicable)

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

9. Cookies and Tracking

Our website uses Google Analytics, which collects anonymous usage data such as:

• Page views
• Visitor behaviour
• Device and browser type

We do not use:

• Marketing cookies
• Tracking pixels
• Newsletter or advertising cookies

You can disable analytics cookies via your browser settings. A full Cookie Policy can be provided if required.

10. Security

We take data security seriously and implement appropriate measures, including:

• Secure cloud hosting environments
• Access controls and authentication
• Encryption (where applicable)
• Firewall and malware protection
• Regular system updates and monitoring

While no system is 100% secure, we maintain strong technical and organisational safeguards.

11. Changes to This Policy

We may update this Privacy Policy periodically. Any changes will be posted on our website with the updated date shown at the top.