Legal / Data protection

Privacy &
data protection.

Install Creative Ltd, trading as Etch Creative

Last updated 27 October 2026

01 / Introduction

Our commitment

Install Creative Ltd (“the Company”), trading as Etch Creative, is committed to protecting the privacy and security of personal data. This policy outlines our obligations and practices regarding the collection, processing, storage and disposal of personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy applies to all employees, contractors, consultants and any other individuals or organisations processing personal data on behalf of the Company.

02 / Principles of data protection

How we handle data

Lawfulness, fairness and transparencyPersonal data will be processed lawfully, fairly and in a transparent manner.
Purpose limitationPersonal data will be collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes.
Data minimisationPersonal data will be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed.
AccuracyPersonal data will be accurate and, where necessary, kept up to date.
Storage limitationPersonal data will be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which it is processed.
Integrity and confidentialityPersonal data will be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.
AccountabilityThe Company is responsible for and able to demonstrate compliance with these principles.

03 / Scope

What this covers

This policy applies to all personal data processed by the Company, including employee, customer, supplier, website user and marketing data.

04 / Roles and responsibilities

Who is responsible

Data controllerInstall Creative Ltd is the data controller, responsible for determining the purposes and means of processing personal data.
Data protection responsibilityThe Company will designate an appropriate senior person to oversee data protection compliance. A formal Data Protection Officer will be appointed where required by law.
All employeesAll employees are responsible for adhering to this policy and ensuring the security and confidentiality of personal data.
Line managersLine managers are responsible for ensuring their teams comply with this policy and for providing training and guidance.

05 / Lawful basis for processing

Why we process data

The Company will only process personal data when it has a lawful basis for doing so.

ConsentThe data subject has given clear consent to process their personal data for a specific purpose.
ContractProcessing is necessary for the performance of a contract with the data subject or to take steps at their request before entering into a contract.
Legal obligationProcessing is necessary for compliance with a legal obligation.
Vital interestsProcessing is necessary to protect the vital interests of the data subject or another person.
Public interestProcessing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
Legitimate interestsProcessing is necessary for the legitimate interests of the Company or a third party, unless those interests are overridden by the data subject’s rights and freedoms.

06 / Data subject rights

Your rights

Right to be informedThe right to be informed about the collection and use of personal data.
Right of accessThe right to access personal data held by the Company.
Right to rectificationThe right to rectify inaccurate or incomplete personal data.
Right to erasureThe right to request the erasure of personal data, where applicable.
Right to restriction of processingThe right to restrict the processing of personal data, where applicable.
Right to data portabilityThe right to receive personal data in a structured, commonly used and machine-readable format and to transmit that data to another controller, where applicable.
Right to objectThe right to object to the processing of personal data, where applicable.
Automated decision-making and profilingThe right not to be subject to a decision based solely on automated processing, including profiling, where applicable.

07 / Data security

How we protect data

The Company implements appropriate technical and organisational measures to help secure personal data.

Access controlsRestricting access to personal data to authorised personnel only.
EncryptionEncrypting personal data where appropriate.
Regular backupsRegularly backing up personal data to prevent loss or corruption.
Security auditsConducting regular security audits to identify and address vulnerabilities.
Staff trainingProviding regular data protection training to employees.
Incident responseMaintaining an incident response plan to address data breaches.
Secure premisesSecuring offices and limiting access to authorised personnel.

08 / Data retention

How long we keep data

The Company will retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. The proposed retention periods for specific types of data are set out in the schedule below.

09 / Data transfers

International transfers

The Company will not transfer personal data outside the UK or the European Economic Area unless appropriate safeguards are in place.

10 / Data breaches

If something goes wrong

In the event of a personal data breach, the Company will notify the Information Commissioner’s Office and affected data subjects where required by law.

11 / Review and updates

Keeping this policy current

This policy will be reviewed at least annually and whenever a material change to the Company’s processing activities or legal obligations makes a review necessary.

12 / Contact information

Questions or requests?

For questions about this policy or to make a data protection request, contact info@etchcreative.co.uk.

Appendix / Data retention schedule

What we keep.
And for how long.

Install Creative Ltd, trading as Etch Creative, will retain personal data only for as long as necessary to fulfil the purposes for which it was collected, taking into account applicable legal obligations, contractual requirements, legitimate business needs and the rights of individuals.

Category of personal data	Proposed retention period	Disposal or review
Client and project records, including business contact details and project correspondence	For the duration of the client relationship and up to 6 years after the end of the relevant contract or project, where necessary for contractual, legal or business purposes.	Review at the end of the retention period and securely delete or anonymise personal data that is no longer required.
Prospective client and business enquiry records	Up to 24 months after the last meaningful interaction, unless the enquiry progresses into a client relationship or a longer period is justified.	Review periodically and delete or anonymise records that are no longer required.
Marketing contacts and mailing lists	Until an individual unsubscribes, objects or withdraws consent where applicable, or the contact is no longer reasonably required for the relevant marketing purpose. Inactive contacts are reviewed at least every 24 months.	Remove contacts from active marketing lists when required. Retain only the minimum suppression information necessary to respect opt-outs.
Website enquiry forms and contact submissions	Up to 24 months after the last meaningful interaction, unless the enquiry becomes a client matter or another retention requirement applies.	Review and securely delete or anonymise information that is no longer required.
Website analytics and cookie-related data	In accordance with configured retention settings, the purpose of collection and applicable cookie and data protection requirements.	Review settings periodically and delete or anonymise data when the retention period expires, where applicable.
Supplier and contractor contact records	For the duration of the relationship and up to 6 years afterwards where necessary for contractual, legal or business purposes.	Review and securely delete personal data that is no longer required.
Employee and former employee records	In accordance with the Company’s employment records retention schedule, taking account of employment, tax, pension and legal requirements.	Review each record category separately and securely dispose of data when no longer required.
Recruitment and unsuccessful applicant records	Normally up to 6 months after the recruitment process concludes, unless a longer period is justified, disclosed where appropriate and lawful, or required for a legal claim.	Securely delete or anonymise records at the end of the applicable period.
Accounting, invoicing and financial records containing personal data	For the period required by applicable tax, accounting and other legal obligations, commonly at least 6 years for relevant company accounting records, subject to the record type and applicable rules.	Securely dispose of records after all applicable retention requirements have been satisfied.
Complaints, disputes and legal claims	For the duration of the matter and for any additional period reasonably necessary to manage legal obligations, potential claims or enforcement.	Review when the matter concludes and retain only for a documented, justified period.
Personal data breach and security incident records	For as long as necessary to document compliance, manage remediation and satisfy applicable legal or regulatory requirements.	Review periodically and securely dispose of records when no longer required.
Data protection requests and consent records	For as long as necessary to demonstrate compliance, honour individuals’ choices and manage any related legal requirements.	Review periodically and delete unnecessary information while retaining appropriate evidence where justified.
CCTV or access-control records, if used	For the shortest period reasonably necessary for the stated security purpose, unless footage must be preserved for an incident or investigation.	Automatically overwrite or securely delete footage when the applicable retention period expires, where possible.

Retention and disposal procedures

The Company will maintain an appropriate record of retention periods and review them periodically.
Where a record contains several categories of personal data, the Company will consider the applicable retention requirements for each category.
Personal data will be securely deleted, destroyed or anonymised when it is no longer required, subject to any applicable legal hold or other lawful retention requirement.
Where personal data is held by third-party service providers, the Company will take reasonable steps to ensure deletion and retention arrangements are addressed in the relevant contractual terms.
Where data must be retained beyond the standard period, the reason and expected review date should be documented.
Retention periods will be amended where necessary to reflect changes in legislation, contractual requirements, business practices or the risks associated with processing personal data.

Policy owner: The person designated by the Company as responsible for data protection.

Review frequency: At least annually and whenever a material change to the Company’s processing activities or legal obligations makes a review necessary.

Need to talk to us about your data?

info@etchcreative.co.uk

Privacy &data protection.