We are the data controller of the personal data described in this policy. We process it in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where it applies, the EU General Data Protection Regulation (EU GDPR).

1. Who we are

• Company: Wairo Creative Ltd

• Company number: 17475779 (registered in England and Wales)

• Registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

• Email: wairo@marketing.com.mt

This policy covers personal data we collect through the Site and our marketing. When we process personal data on behalf of our clients (for example on websites or systems we build or manage for them), we act as a data processor under our agreement with that client, and the client's own privacy policy applies.

2. Information we collect

2.1 Information you give us

When you contact us, request a quote, book a call, subscribe to updates or work with us, we may collect:

• Name and job title

• Email address and phone number

• Company name and company details

• The content of your messages and any information you choose to share with us

• Billing and payment details, if you become a client

2.2 Information we collect automatically

When you visit the Site, we may automatically collect:

• IP address and approximate location (country or city)

• Browser type and version, device type and operating system

• Referring website and the pages you visit, and how long you spend on them

• Information collected through cookies and similar technologies (see section 6)

We do not knowingly collect special category (sensitive) data, and the Site is not intended for children under 16.

3. How and why we use your information

We only use personal data where we have a lawful basis to do so:

• To respond to your enquiries and provide quotes: to take steps at your request before entering into a contract, or our legitimate interests in responding to business enquiries.

• To provide our services and manage our relationship with clients, including invoicing and payments: performance of a contract.

• To operate, maintain, secure and improve the Site: our legitimate interests in running a secure and effective website.

• To measure Site performance and run analytics and advertising cookies: your consent, which you can withdraw at any time.

• To send marketing about our services: your consent, or, for existing business contacts, our legitimate interests. Every marketing email includes an unsubscribe link.

• To comply with legal, tax and accounting obligations, and to establish or defend legal claims: legal obligation and our legitimate interests.

4. How we share your information

We do not sell your personal data. We only share it where necessary:

• Service providers who help us run our business, such as website hosting (Framer), consent management (Cookiebot), email, cloud storage, analytics, customer communication, accounting and payment providers. They may only use your data on our instructions and must keep it secure.

• Our team and professional contractors who need access to deliver our services, under confidentiality obligations.

• Professional advisers, such as accountants, lawyers and insurers, where necessary.

• Legal and regulatory authorities, where required by law or to protect our rights.

• Business transfers: if we are involved in a merger, acquisition or sale of assets, your data may be transferred to the new owner, who will be bound by this policy.

5. International transfers

Our team works from the United Kingdom, the European Union (Malta) and Türkiye, and some of our service providers are based outside the UK. This means your personal data may be transferred to or accessed from countries outside the UK.

Where we transfer personal data outside the UK, we make sure it is protected by one of the following safeguards: the country is covered by UK adequacy regulations (this includes EU and EEA countries such as Malta); or we use the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; or another safeguard permitted by UK data protection law. You can contact us for more information about the safeguards we use.

6. Cookies and tracking technologies

We use strictly necessary cookies to make the Site work, including those set by our consent management tool, Cookiebot, to remember your cookie choices. With your consent, we also use:

• Analytics: Google Analytics, Microsoft Clarity and Metricool, to understand how visitors use the Site and improve it.

• Marketing and advertising: Google Ads (including DoubleClick) and Meta Pixel (Facebook and Instagram), to measure our advertising and show relevant ads.

The Site is built and hosted on Framer, which may set cookies needed for the Site to function.

Non-essential cookies are only set after you accept them in our cookie banner. You can change your choice at any time through the cookie settings on the Site or in your browser settings. Disabling some cookies may affect how parts of the Site work. For more details, please see our Cookie Policy.

7. How long we keep your information

We keep personal data only for as long as necessary for the purposes in this policy:

• Enquiries that do not lead to a contract: up to 2 years after our last contact.

• Client, contract and invoice records: 6 years after the end of the relevant financial year, to meet UK legal and tax requirements.

• Marketing data: until you unsubscribe or withdraw consent.

• Analytics data: in line with the retention settings of the relevant tool, normally no longer than 14 months.

8. How we protect your information

We use appropriate technical and organisational measures to protect personal data, including access controls, encrypted connections (HTTPS), secure password management and regular updates. Access is limited to people who need it for business purposes and who are bound by confidentiality.

No method of transmission over the internet is completely secure, but we work to protect your data and will notify you and the Information Commissioner's Office (ICO) of a data breach where the law requires it.

9. Third-party links

The Site may contain links to third-party websites. We are not responsible for their privacy practices, so please review their privacy policies before providing any personal data.

10. Your rights

Under UK data protection law, you have the right to:

• Access the personal data we hold about you

• Ask us to correct inaccurate or incomplete data

• Ask us to delete your data in certain circumstances

• Ask us to restrict the processing of your data in certain circumstances

• Receive your data in a portable format, or ask us to transfer it to another organisation

• Object to processing based on our legitimate interests, and to direct marketing at any time

• Withdraw your consent at any time, where we rely on consent

To exercise any of these rights, email us at wairo@marketing.com.mt. There is normally no fee. We may need to verify your identity, and we will respond within one month. If your request is complex, we may extend this by up to two further months and will let you know.

11. Complaints

If you have a concern about how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. If you are in the EU, you may also contact your local data protection authority.

12. Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with a new "Last updated" date. Where changes are significant, we will let you know by appropriate means.

13. Contact us

If you have any questions about this Privacy Policy or how we use your personal data, please contact us:

• Wairo Creative Ltd (trading as Wairo Studio)

• 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

• Email: wairo@marketing.com.mt