Privacy Policy

Crestwick Digital Ltd ("Crestwick", "we", "us", "our") looks after personal data belonging to people who visit this website, enquire about our services, work with us as clients, creators, talent, models or suppliers, and people who apply to join the studio. This policy explains what we hold, why, for how long and what you can ask us to do about it.

For the purposes of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, Crestwick Digital Ltd is the data controller for the processing described here.

1. Who we are

Crestwick Digital Ltd is registered in England and Wales, company number 00000000, registered office Studio 6, 74 Deansgate, Manchester, M3 2BW, United Kingdom.

We are a social-first creative studio. When we manage a client's social channels or advertising accounts, we act as that client's data processor in respect of data held in those systems: the client is the controller, its own privacy notice applies, and we operate under a written data processing agreement meeting Article 28 of the UK GDPR. Everything else in this policy describes processing we carry out as controller.

2. Data we collect

2.1 Data you give us

• Enquiry data — name, brand, email, telephone, indicative budget, channel links and the content of your message.
• Client records — contact details for your team, contracts, briefs, approvals and billing information.
• Creator, talent and supplier records — contact details, agency representation, rates, bank details for payment, invoices, contracts and releases.
• Recruitment data — CV, portfolio, showreel, work history, interview notes and references.
• Studio visitor records — name, organisation and time of visit, kept for building security.

2.2 Data collected automatically on this website

• Technical data — IP address, browser and device type, operating system and approximate region.
• Usage data — pages viewed, referrer, links clicked and time on page.

Beyond strictly necessary cookies, this happens only with your consent. See our Cookie Policy.

2.3 Data from other sources

We receive creator and talent data from agents and management companies, from creator marketplace platforms, and from publicly available social profiles. We receive business contact details from professional networks and referrals.

3. Creators, talent and people who appear in content

Where you appear in content we produce, we rely on a written release or collaboration agreement that states which images, footage or audio are covered; the territories, media and formats in which they may be used; the duration of the licence; whether paid amplification is included; and the fee. We do not use likeness or content outside the scope of that agreement.

We hold your contact and payment details to engage and pay you, on the basis of performance of a contract and, for payment records, legal obligation. We keep a rights register recording what has been licensed and until when, so that assets are withdrawn from circulation when a licence expires.

You may withdraw from future collaborations at any time. Where a licence has already been granted and content is in market, we will remove it from channels we control as soon as reasonably practicable on request, but we cannot always recall material that third parties have downloaded or reposted, and we will be honest with you about that limitation.

We do not use content featuring you to train machine learning or generative AI models, and we do not licence it to third parties for that purpose. Where a client requires AI-generated derivatives of a person's likeness, we require separate, specific, written consent and a distinct fee.

4. Purposes and lawful bases

5. Who we share data with

We do not sell personal data. We share it with: technology providers hosting our website, email, project management, file storage and finance systems, under written contract; social and advertising platforms, where required to run activity or where you have consented to cookies; creator agencies and management companies, where they represent you; our accountants, auditors, insurers and legal advisers; payment providers and banks; regulators including the Advertising Standards Authority where a complaint requires disclosure; and a successor entity in the event of a sale or reorganisation, under confidentiality undertakings.

6. International transfers

Some providers process data outside the United Kingdom, principally in the European Economic Area and the United States. Where that happens we rely on a UK adequacy regulation (including the UK Extension to the EU–US Data Privacy Framework), the International Data Transfer Agreement, or the UK Addendum to the European Commission's Standard Contractual Clauses, supported by a transfer risk assessment.

7. How long we keep it

8. Security

We use TLS in transit and encryption at rest, single sign-on with enforced multi-factor authentication, role-based access reviewed quarterly, encrypted laptops and camera media, separate storage for client footage with per-project access, offsite backup of active projects, and annual security training for all staff. Payment details for creators are held in our finance system only and are never sent by email. We operate an incident response procedure and will report a notifiable personal data breach to the Information Commissioner's Office within 72 hours of becoming aware of it, notifying affected individuals where the risk to them is high.

9. Your rights

You have the rights to be informed, of access, to rectification, to erasure, to restriction, to portability, to object to processing based on legitimate interests, to object to direct marketing at any time, and to withdraw consent where consent is our basis. We do not carry out solely automated decision-making with legal or similarly significant effects.

Please raise concerns with us first. You may also complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF — 0303 123 1113, ico.org.uk.

10. Cookies

Non-essential cookies are set only with your consent. Full detail is in our Cookie Policy.

11. Marketing

We send a studio newsletter to people who asked for it, and to existing business contacts under the soft opt-in permitted by the Privacy and Electronic Communications Regulations 2003. Every email has a working one-click unsubscribe link that we honour immediately. We never share our list.

12. Children and young people

This website is not directed at children and we do not knowingly collect data about anyone under 18 through it. Where a client campaign involves creators or performers under 18, we require the written consent of a parent or guardian, comply with child performance licensing requirements where they apply, and follow the CAP Code rules on advertising to children. We will decline work that we do not believe can be delivered safely.

13. Changes and contact

We review this policy annually and whenever our processing changes materially. The date at the top of the page shows the current version.