privacy policy
Last updated: 21 August 2026
This policy explains how Norso Creative collects, uses, and protects your personal data when you visit our website or work with us. We keep it plain and honest. If anything here is unclear, contact us using the details below and we will explain.
who we are
Norso Creative ("we", "us", "our") is the data controller responsible for your personal data.
Company name: Norso Creative Ltd
Registered address: Suite 20 Pluto Accountancy New Mead Barn, Wickham Hall, Bishop's Stortford, Hertfordshire, United Kingdom, CM23 1JG
Company number: 15394456
ICO registration: ZC228786
Contact email: dominic@norsocreative.com
We are not required to appoint a Data Protection Officer. If you have any questions about this policy or how we handle your data, email us at the address above.
what data we collect
We only collect what we need to run our business and respond to you. Depending on how you interact with us, this may include:
Contact details you give us: name, email address, phone number, company name, and job title.
Enquiry content: anything you write in a contact form, email, or brief.
Project data: information shared with us while we work together, which may include footage, images, and details about people who appear in a video.
Website usage data: how you use our site, collected through analytics and cookies. See the Cookies section below.
Technical data: browser type and device information, collected automatically when you visit.
We do not intentionally collect special category data (such as health, religion, or political views) through our website. Please do not send it to us unless we have agreed it is needed for a project.
how we collect it
Directly from you when you fill in a form, email us, or work with us on a project.
Automatically when you browse our website, through cookies and similar technologies.
From third parties such as referrals, or public sources like LinkedIn, where relevant to a potential project.
why we use your data and our lawful basis
Under UK GDPR we must have a lawful basis for using your data. Our bases are:
| What we do | Why | Lawful basis |
|---|---|---|
| Respond to your enquiry | To answer your question or prepare a proposal | Legitimate interests, or steps prior to a contract |
| Deliver a project | To do the work we have agreed | Performance of a contract |
| Send invoices and keep records | To run the business and meet legal duties | Legal obligation and legitimate interests |
| Improve our website | To understand how the site is used | Consent (for non-essential cookies) |
| Send occasional updates or marketing | To stay in touch about our work | Consent, or legitimate interests where you are an existing client |
Where we rely on consent, you can withdraw it at any time. Where we rely on legitimate interests, we have weighed our interest in running the business against your rights, and you can object at any time.
who we share it with
We do not sell your data. We share it only where necessary, with:
Service providers who help us operate. These act as our processors and may only use your data on our instructions:
Squarespace, which hosts our website and handles website forms and analytics.
Google (Gmail and Google Drive), which we use for email and to store project files.
FreeAgent, which we use for invoicing and accounts.
Professional advisers such as accountants, where needed.
Authorities or regulators where we are legally required to.
We put agreements in place with our processors to keep your data protected.
international transfers
Some of the providers we use store or process data outside the UK. Where they do, they are contractually committed to protecting it using safeguards recognised under UK data protection law, such as Standard Contractual Clauses with the UK Addendum, or an adequacy decision. We can point you to the relevant provider's terms on request.
how long we keep it
We keep your data only as long as we need it:
Enquiries that do not become projects: up to 24 months, then deleted.
Client and project records: for the length of our work together and afterwards as needed for our records.
Financial records: at least 6 years, to meet HMRC requirements.
When we no longer need your data, we delete it or make it anonymous.
your rights
Under UK GDPR, you have the right to:
Access the personal data we hold about you.
Rectification of data that is wrong or incomplete.
Erasure of your data in certain circumstances.
Restriction of how we use your data in certain circumstances.
Object to processing based on our legitimate interests, and to direct marketing at any time.
Data portability, to receive your data in a portable format.
Withdraw consent at any time, where we rely on it.
You can object to processing we base on legitimate interests, and you can object to direct marketing at any time. If you object to direct marketing, we will stop.
To exercise any of these, email . We will respond within one month. There is normally no charge.
automated decision-making
We do not make decisions about you using automated processing alone, and we do not profile you. Any decision that affects you is made by a person.
cookies
Our website uses cookies to function and, where you agree, to understand how the site is used.
Essential cookies are needed for the site to work and do not require consent.
Analytics and other non-essential cookies are only set with your consent, which you give through our cookie banner.
You can change or withdraw your cookie choices at any time through our Cookie Policy, and you can block cookies in your browser settings. Blocking essential cookies may affect how the site works.
Our website is hosted on Squarespace, which sets cookies to run the site and, where you agree, to measure how it is used. You can read more in Squarespace's cookie information.
how we protect your data
We take reasonable technical and organisational measures to keep your data secure, including access controls and secure storage. No system is completely secure, but we work to protect your data and to respond quickly if something goes wrong.
complaints
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO):
Website: ico.org.uk
Helpline: 0303 123 1113
changes to this policy
We may update this policy from time to time. When we do, we will change the date at the top. Significant changes will be made clear on this page.
contact us
For anything to do with this policy or your personal data:
Norso Creative Email: