Privacy Policy
Last updated: 4 May 2026
This privacy policy explains how Blackoak Creative collects and uses personal information when you visit this website, contact us, become a client, use the client portal, or otherwise deal with us.
Who We Are
Blackoak Creative is a web design, branding, SEO, marketing, and automation studio based in Blaenau Gwent, South Wales.
Registered office: 201 Marine Street, Cwm, Blaenau Gwent, NP23 7SY, United Kingdom.
Email: [email protected]
Phone: 07732215322
For the purposes of UK data protection law, Blackoak Creative is the controller for the personal information described in this policy.
Information We Collect
We may collect and process the following categories of personal information:
- Contact details, including name, email address, phone number, and business name.
- Enquiry details, including your message, project requirements, budget context, and service interests.
- Client records, including proposals, project notes, documents, deliverables, invoices, and support messages.
- Client portal content, including messages, document records, uploaded files, image links, and attachment metadata.
- Administrative account data for authorised users, including login details managed through our authentication provider.
- Outbound lead information, including publicly available business contact details and notes about business development activity.
- Website analytics data if you consent to analytics cookies and similar technologies.
- Technical information such as device, browser, and security logs where needed to run and protect the website.
How We Collect Information
We collect information when you:
- submit the contact form;
- email, phone, or message us;
- become a client or request a quote;
- use the client portal or upload files;
- interact with our website, if you have allowed analytics; or
- when we collect business contact information from public business directories, websites, social profiles, or other lawful business sources.
Why We Use Information And Our Lawful Bases
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and sending requested information. | Legitimate interests, or steps before entering into a contract. |
| Preparing quotes, proposals, and project plans. | Steps before entering into a contract and legitimate interests. |
| Delivering services and managing client work. | Contract. |
| Maintaining invoices, tax records, and accounting records. | Legal obligation. |
| Running the website, client portal, admin systems, and security controls. | Legitimate interests and, where required, legal obligation. |
| Measuring website performance with Google Analytics. | Consent. |
| Business-to-business marketing and follow-up. | Legitimate interests, subject to your right to object and applicable marketing rules. |
Cookies And Analytics
We use a cookie preference tool to remember your cookie choices. This is essential for the website to respect your preference.
Google Analytics is only loaded if you allow analytics. If you reject analytics, the site should not load the Google Analytics tag or send page view events. You can change your choice at any time using the cookie settings link in the footer.
More detail is available in our Cookie Policy.
Who We Share Information With
We use trusted service providers to operate the website and deliver our services. These may include hosting, database, authentication, storage, email delivery, analytics, accounting, payment, and project delivery providers.
Current key providers include Supabase for database, storage, authentication, and serverless functions; Resend for transactional email; Google for analytics and search/business profile tools where enabled; and hosting/CDN providers used to publish the website.
We may also share information if required by law, to protect our rights, to enforce agreements, or as part of professional advice such as accounting or legal support.
International Transfers
Some providers may process information outside the UK. Where this happens, we rely on appropriate safeguards such as adequacy regulations, standard contractual clauses, or the provider's published data transfer protections.
How Long We Keep Information
We keep information only for as long as needed for the relevant purpose:
- Enquiries that do not become client work: usually up to 24 months.
- Client project records: for the length of the project and usually up to 6 years afterwards.
- Invoices, payment, and tax records: usually 6 years or longer if required by law.
- Client portal messages and documents: for the project lifecycle and then as needed for support, legal, and business records.
- Outbound lead records: reviewed periodically and deleted when no longer relevant.
- Cookie consent preferences: usually up to 6 months unless you update them sooner.
- Analytics data: handled according to the settings in our analytics provider and only collected where consent is granted.
Your Rights
Depending on the circumstances, you may have the right to ask us to access, correct, delete, restrict, or transfer your personal information. You may also object to processing based on legitimate interests, including direct marketing. Where we rely on consent, you can withdraw that consent at any time.
To exercise your rights, contact [email protected]. We may need to confirm your identity before acting on a request.
Security
We use technical and organisational measures intended to protect personal information, including access controls, authentication, role-based admin access, HTTPS, managed hosting infrastructure, and database security controls. No online system is completely risk-free, so we also limit access to personal information to what is needed.
Complaints
Please contact us first if you have concerns. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection. Website: ico.org.uk.
Changes To This Policy
We review this policy when our services, suppliers, or legal obligations change. The latest version will be published on this page.