Privacy policy.

This policy explains what personal data Focal Creative collects when you use this website or get in touch, why it's collected, how it's used, and what rights you have over it.

Who we are

Focal Creative is the trading name of James Curd, a sole trader based in the United Kingdom. For the purposes of UK data protection law, James Curd is the "data controller" responsible for your personal data.

Address for service: CityCoast Centre, North Street, Portslade, East Sussex BN41 1DG.

Contact: james@focalcreative.uk

Focal Creative is registered with the Information Commissioner's Office (ICO), registration number ZC220850.

What data we collect

We collect personal data in the following ways:

• When you fill in the "Start a project" form — name, email address, phone number (if provided), business name, and any project details or notes you choose to share. When you submit it, we send an automatic confirmation email to the address you gave, so you know it arrived.
• When you request a free website review — your website address, email address, and phone number (if provided).
• Bot protection on both forms — the forms run Cloudflare Turnstile, which processes technical information about your device and browser to verify you're human and prevent spam.
• How you found the site — when you first arrive, the site notes the page you landed on, the website that referred you (if any), and any campaign tags in the link you followed (for example utm_source, as used in advertising links). This is held in your browser for that visit only, and is sent to us only if you submit one of the forms, so we know which of our marketing brought the enquiry in.
• When you book a call — the page shown after you submit the project form includes a booking calendar provided by Google Calendar. It is loaded from Google's servers, so Google receives your IP address and browser information when that page opens, and any details you enter to book a slot (such as your name and email address) go to Google to create the booking.
• When you email us directly — your email address, name (if given), and the contents of your message.
• Automatically, via Umami analytics — aggregated information about how the site is used, such as which pages are viewed, which site referred you, and rough device and browser type. Umami is a privacy-focused analytics tool: it sets no cookies, does not track you across other websites, and does not store your IP address or build any profile that could identify you.
• Session recordings, via Umami — Umami can record how pages are used during a visit (mouse movement, scrolling, clicks, page changes and what was on screen at the time) so we can see where the site is confusing or broken. Recordings are used only to improve the site and are never used for advertising.

The site's fonts are hosted on our own server, so loading them doesn't involve any third party.

We do not knowingly collect payment card details, government ID numbers, or other special category data through this website.

How we use your data

We use the data collected for the following purposes:

• To respond to your enquiry and discuss your project.
• To prepare quotes, proposals and, where a project goes ahead, to deliver the agreed work.
• To keep basic records of enquiries and client correspondence.
• To understand how visitors use the site in aggregate, so we can improve it.
• To meet our own legal, accounting and tax obligations.

Our legal basis for processing

Under UK GDPR, we rely on the following legal bases:

• Legitimate interests — for responding to enquiries, keeping business records, and understanding site usage via analytics, where this doesn't override your rights and interests.
• Contract — where processing is necessary to prepare for or perform a contract with you (e.g. delivering a website build).
• Consent — where we ask for it explicitly, and you're free to withdraw it at any time. We don't currently rely on consent for anything on this website: we set no cookies, and nothing the site stores in your browser is used for advertising or to track you across other websites.
• Legal obligation — for record-keeping required by UK tax and accounting law.

Cookies and similar technologies

This site does not set any cookies. Our analytics tool, Umami, measures site usage without cookies and without storing personal data, so there is no cookie banner to click through.

The site does keep a few small items in your browser's own storage. They stay on your device and are only sent to us where described below:

• Your light/dark theme choice — remembered so the site looks the way you left it. Kept until you clear your browser data.
• How you found the site — the landing page, referring website and campaign tags described above. Kept for your current visit only, and sent to us only if you submit a form.
• A draft of the "Start a project" form — if you fill in part of the form and leave, your answers (which can include your name, email address and phone number, along with how you found the site) are saved on your device so you can pick up where you left off. The draft is deleted when you submit the form or choose to discard it, and is ignored after 7 days. If you use a shared computer, discard the draft or clear your browser data when you're done.
• Whether you've seen our "before you go" message — so it isn't shown to you twice in one visit. Kept for your current visit only.

Google Calendar. The booking calendar on the page shown after you submit the project form is provided by Google, and Google may set its own cookies when it loads, under Google's privacy policy. We don't control or have access to those cookies.

To reduce spam, our forms include a hidden field that automated bots tend to fill in and people never see. This checks nothing about you and processes no personal data — it simply lets us discard obvious bot submissions.

Who we share your data with

We don't sell your personal data. We may share it with:

• Service providers who help us run this site and our business — our hosting provider, our email provider (Brevo, used to deliver enquiry notifications and form confirmation emails), our business email provider (Google Workspace), Umami for analytics, Google Calendar for booking calls, and Cloudflare Turnstile for bot protection on our forms. These providers only process data on our instructions and for the purposes described here. For more details on how Cloudflare Turnstile processes your data, see the Turnstile Privacy Addendum.
• Professional advisers such as an accountant, where necessary for our legal and tax obligations.
• Authorities where we're required to by law, such as to comply with a legal obligation or protect our legal rights.

International transfers

Some of the third parties we use (such as Google, for email and call booking, and Cloudflare, for bot protection) may process data outside the UK, including in the United States. Where this happens, we rely on safeguards recognised under UK GDPR, such as the UK's international data transfer addendum or the provider's own standard contractual clauses, to ensure your data stays protected.

How long we keep your data

We keep enquiry and client data for as long as necessary to deal with your enquiry, deliver any agreed project, and meet our legal obligations — UK tax law generally requires business records to be kept for 6 years. Enquiry records older than that are deleted on a routine basis. Analytics data is aggregated and contains nothing that identifies you. Items kept in your browser's storage are kept for the periods set out under "Cookies and similar technologies" above.

Your rights

Under UK GDPR, you have the right to:

• Ask what personal data we hold about you, and get a copy of it (right of access).
• Ask us to correct inaccurate or incomplete data (right to rectification).
• Ask us to delete your data, where there's no good reason for us to keep it (right to erasure).
• Ask us to restrict or object to certain processing.
• Ask for your data in a portable format, where technically feasible.
• Withdraw consent at any time, where we're relying on consent (this won't affect processing carried out before you withdrew it).

To exercise any of these rights, email james@focalcreative.uk. We'll respond within one month, as required by law.

If you're unhappy with how we've handled your data, you also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), though we'd appreciate the chance to put things right first.

Keeping your data secure

We take reasonable technical and organisational steps to protect your personal data against unauthorised access, loss or misuse, including restricting who can access enquiry records and using reputable, secure third-party providers for hosting and email.

Children's privacy

This site and our services are intended for business use by adults. We don't knowingly collect personal data from children.

Changes to this policy

We may update this policy from time to time, for example if we start using a new tool or service that processes personal data. The "last updated" date at the top of this page will always reflect the most recent version. We'd encourage you to check back occasionally.

Contact us

If you have any questions about this policy or how your data is handled, email james@focalcreative.uk.