Privacy Policy

Crello Agency (“Crello”, “we”, “us”) is a UK web design agency. For the personal data described in this policy, we are the controller, which means we decide why and how it is used.

You can contact us about anything in this policy by emailing support@crello.co.uk, or by using the Client Portal at portal.crello.co.uk.

We are a small team and have not appointed a data protection officer. Privacy questions go to the email address above and are dealt with by the people who run the business.

This policy covers personal data we collect when you visit crello.co.uk, contact us, ask for a quote, start a project, become a client, use the Client Portal, or deal with us by email, phone or WhatsApp.

It does not cover the websites we build for clients. Each client is responsible for its own website and its own privacy notice. Where we handle personal data on a client’s behalf, see clause 15.

Enquiries and quote requests. When you use our contact form, the Get Started form or the quote basket, or message us, we collect:

• your name, email address and phone number;
• your business name and website address;
• the topic of your enquiry, the services or plans you are interested in, the items in your quote basket, and the message you write;
• any other details you choose to include.

Clients. If you become a client we also collect:

• billing contact details, invoices, payment records and the history of your orders (we do not store full card numbers; card payments are handled by payment providers);
• information about your business, services, service areas, opening hours and branding;
• files, images, photographs, testimonials and documents you upload or send us, which may include personal data about your staff or customers;
• details of the domain, email, hosting and Google Business Profile accounts you give us access to, and your related instructions;
• emails, WhatsApp messages, call notes and other communications between us.

Client Portal. If you have a Client Portal account we hold your name, email address, login details (stored securely), the messages and files you share through the portal, your order and invoice history and your support requests.

When anyone signs in to the Client Portal, or tries to, we also keep a security record: the time, the type of device and browser, the approximate place the connection came from (usually the town or city) and the network (IP) address. We keep a record of failed attempts too, including the email address that was tried, but never the password. We use this to keep accounts safe, to spot people trying to break in, and so that you can check your own recent sign ins in the portal. The same applies to our own team signing in to our internal systems.

Technical data. When you visit our website, our hosting provider processes technical information needed to deliver the pages and keep them secure, such as your IP address, browser type, device type, the pages requested and the time of the request. Our forms also include a hidden spam check field that real visitors never see or fill in.

Information stored in your browser. The site stores a small number of items in your browser to remember your cookie choice, your quote basket and your progress through a form. Our Cookie Policy lists exactly what they are.

Our website does not currently use analytics, advertising or tracking cookies. If that changes, we will update this policy and, where the law requires it, ask for your consent first.

Our pages load fonts from Google Fonts. When that happens, Google receives your IP address and basic browser information so it can send the font files.

We do not ask for special category data (such as health information, or information about race, religion or politics) and we ask you not to send it to us. We do not ask for criminal offence data.

Referral partners. If you join our partner programme we collect your name, email address, phone number, business name, the way you describe yourself, your bank details for payouts, the leads you register, your call notes and your earnings, and the same security record of sign ins described in 3.3. If a partner passes us your details as a possible customer, we hold what they give us (usually your name, business, phone number or email, and how they know you), and we tell you where it came from when we first contact you. If you arrive through a partner's link we also store that partner's code in your browser for 90 days (see our Cookie Policy). We use this to credit and pay the partner, to check a referral is genuine and not already known to us, and to keep the programme honest. You can ask us to delete your data in the same way as in section 11, but we may need to keep payment records for tax purposes.

Mostly from you, when you fill in a form, upload files, message us or talk to us.

From your own use of our website and the Client Portal.

From public sources, such as your existing website or Google Business Profile, when you ask us to improve or work on them.

From people you ask us to deal with on your behalf, such as your domain or email provider.

Under UK GDPR we must have a lawful basis for each use of your data. These are ours:

• Replying to enquiries and preparing quotes. Lawful basis: taking steps at your request before entering into a contract, and our legitimate interests in running a business and answering people who contact us.
• Providing our services, including building and looking after websites, Google Business Profiles, SEO, branding, email and phone services, and running the Client Portal. Lawful basis: performing our contract with you.
• Invoicing, taking payment, keeping accounts and meeting tax and legal duties. Lawful basis: performing our contract with you and complying with legal obligations.
• Keeping our website, systems and Client Portal secure, preventing spam and fraud, and fixing faults. Lawful basis: our legitimate interests in protecting our business and our clients.
• Handling complaints, protecting our legal rights and keeping records in case of disputes. Lawful basis: our legitimate interests, and legal obligations where they apply.
• Improving our services and keeping in touch with clients about their services. Lawful basis: our legitimate interests in running and improving the business.
• Remembering your cookie choice and the items in your quote basket. These are needed to give you what you asked for, and are covered in our Cookie Policy.
• Sending marketing emails. Lawful basis: your consent, or our legitimate interests where the law allows us to email a business contact. See clause 6.

Where we rely on legitimate interests, we have balanced them against your rights and we do not use your data in ways you would not reasonably expect. You can ask us for more detail about that balancing.

We do not make decisions about you using solely automated means that have a legal or similarly significant effect.

We send marketing emails only to people who have asked to receive them or, for business contacts, where the law allows it. Every marketing message tells you how to opt out, and you can also opt out at any time by emailing us.

We do not sell your data and we do not share it with other businesses for their own marketing.

Messages about the services you have bought, such as invoices, edit confirmations and security notices, are not marketing and are sent as part of providing the service.

We share personal data only where it is needed, with:

• Formspree, which processes the submissions made through our website forms and passes them to us by email;
• Cloudflare, which provides hosting, delivery and security for our website, and on which our own lead and Client Portal systems run;
• our email, messaging and office software providers, who store and deliver the emails and messages we exchange with you;
• our payment providers, such as Stripe or Square, when you pay us through them, and our bank;
• domain, hosting, email and platform providers that we work with on your behalf, such as your domain registrar, Titan Mail, Google (for your Google Business Profile) and the website building tools we use;
• specialists and subcontractors who help us deliver a project, who are bound to keep your data confidential;
• AI assisted tools that we use for drafting and research. We do not put your personal data into them unless it is needed for the task, and we do not put sensitive information into them;
• our professional advisers, such as accountants and insurers;
• the police, courts, HMRC, regulators or other authorities, where the law requires us to; and
• a person who takes over our business, if it is ever sold, and who would then be bound by this policy.

Where a provider handles your data only on our instructions, it is our processor and must protect your data under a written contract. Where a provider decides for itself how to use your data, such as Google for a Google Business Profile, its own privacy notice also applies.

Some of our providers store or process data outside the UK, including in the United States. When that happens we make sure the transfer is protected, by relying on UK adequacy regulations (including the UK Extension to the EU US Data Privacy Framework for certified providers) or on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

You can ask us for more information about the safeguards for a particular transfer by emailing support@crello.co.uk.

We keep personal data only for as long as we need it for the reasons we collected it. Our usual periods are:

• Enquiries that do not become a project: up to 12 months after our last contact with you.
• Client records, contracts, invoices and payment records: 6 years after the end of our relationship, which covers tax, accounting and legal claim periods.
• Client Portal accounts, files and messages: for as long as you use our services, then up to 12 months after they end so that we can hand things over, after which we delete or return them.
• Sign in and security records: up to 6 months.
• Referral partner accounts, leads and earnings: for as long as the partner uses the programme, then up to 6 years for payment and tax records. Leads that were passed to us and never became customers: up to 12 months.
• Website visitor counts we provide to clients: up to 14 months, and they do not include names or network addresses.
• Support emails and messages: for the length of the relationship and then up to 6 years.
• Marketing contact details: until you opt out or ask us to stop.
• Technical logs and form submissions held by Cloudflare and Formspree: for the periods set by those providers, which are generally short.

When the time is up, we delete the data or anonymise it so that it can no longer be linked to you.

We use measures that fit the size of our business and the sensitivity of the data. These include encrypted connections (HTTPS) on our website, password protected accounts, limiting access to the people who need it, using reputable providers and keeping software up to date.

No online service is completely secure. If a personal data breach puts your rights at risk, we will tell you and the Information Commissioner’s Office (ICO) where the law requires it.

Please keep your Client Portal password private and tell us straight away if you think it has been misused.

Under UK data protection law you have the right to:

• be told how your data is used (this policy does that);
• ask for a copy of the personal data we hold about you;
• ask us to correct data that is wrong or incomplete;
• ask us to delete your data, in some situations;
• ask us to restrict how we use your data, in some situations;
• ask to receive your data in a portable format, where we use it under a contract or with your consent;
• object to us using your data for our legitimate interests or for direct marketing; and
• withdraw your consent at any time, where we rely on consent.

To use any of these rights, email support@crello.co.uk. We may need to check your identity first. We will reply within one month. If your request is complex or you have made several, we may take up to two further months, and we will tell you why.

There is no charge for making a request, unless it is clearly unfounded or excessive, in which case we may charge a reasonable fee or decline it, and we will explain why.

Some rights have exceptions. For example, we cannot delete invoices we must keep for tax purposes.

We would like the chance to put things right first, so please contact us if you have a concern.

You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator. Its website is ico.org.uk and its helpline is 0303 123 1113.

Our services are for businesses and the people who run them. We do not knowingly collect personal data from children. If you think a child has given us personal data, email us and we will delete it.

Our Cookie Policy explains what our website stores in your browser, why, and how to change your choice.

When we build or look after a client’s website, we may handle personal data on that client’s behalf, such as enquiries sent through the contact form on their site, or customer names in testimonials. In that case the client is the controller and we are its processor.

If a client uses the website enquiry and visitor tools in their Client Portal, we store the messages sent through their website forms for them, together with the time, the page it was sent from, the device and approximate place it was sent from and the network address, which helps the client spot spam and abuse. We also count visits to their website without cookies: each visit is turned into a one way code from the network address and browser, which changes every day and cannot be used to follow anyone from one day to the next. We keep the pages visited, the website that referred the visitor, the country, and the type of device and browser, but not the network address.

We handle that data only on the client’s instructions, keep it secure, and delete or return it when the service ends. This is also set out in our Terms and Conditions. If you are a customer of one of our clients and want to use your rights, please contact that business, although you are welcome to tell us and we will pass your request on.

Our website links to other sites, including WhatsApp, social media services and the websites of our clients and partners. We do not control them and are not responsible for their privacy practices. Please read their policies.

We may update this policy from time to time. The date at the top of the page shows when it was last updated. If we make an important change, we will tell clients by email or in the Client Portal.