PRIVACY POLICY

Version: 1.0
Effective Date: 9 August 2026

1. Introduction

Create Links Ltd ("Create Links", "we", "our", "us") is committed to protecting your privacy and handling your personal data fairly, lawfully and transparently.

This Privacy Policy explains how we collect, use, store, share and protect personal data when you use our website, purchase our services, communicate with us or otherwise interact with Create Links.

Create Links complies with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and other applicable data protection laws.

2. Who We Are

Create Links Ltd is the controller of personal data processed for the operation of our business, including our website, subscriptions, customer support, recruitment of independent contractors and marketing activities.

When we process personal data on behalf of our Clients as part of delivering our Services, we may act as a processor in accordance with our Data Processing Agreement.

3. Personal Data We Collect

Depending on how you interact with us, we may collect:

Identity Information

• name
• company name
• job title

Contact Information

• email address
• telephone number
• billing address

Account Information

• account credentials
• subscription details
• service preferences

Payment Information

Payment card information is processed securely by our payment providers.

We do not store full payment card details.

Communications

• emails
• support tickets
• meeting notes
• messages
• project discussions

Project Information

Information you choose to provide to enable us to deliver the Services, including files, creative briefs, marketing materials, documents and other business information.

Technical Information

• IP address
• browser type
• operating system
• device identifiers
• cookies
• website usage information

4. How We Use Your Personal Data

We process personal data to:

• provide our Services;
• allocate work to suitable independent contractors;
• manage subscriptions;
• provide customer support;
• communicate with Clients;
• improve our platform;
• maintain security;
• comply with legal obligations;
• protect our legitimate business interests;
• prevent fraud and misuse.

5. Our Independent Contractors

To deliver our Services, Create Links engages a network of carefully selected independent contractors ("Links").

Where necessary to perform an assignment, we may provide a Link with access to personal data and confidential business information relevant to that assignment.

Each Link is contractually required to:

• process personal data only on our documented instructions;
• maintain strict confidentiality;
• implement appropriate technical and organisational security measures;
• comply with applicable data protection obligations;
• report security incidents without undue delay;
• securely delete or return personal data when no longer required.

Links are only given access to the information reasonably necessary to perform the Services allocated to them.

6. International Transfers

Some of our independent contractors and service providers may be located outside the United Kingdom.

Where this results in the transfer of personal data outside the United Kingdom or another jurisdiction with an applicable adequacy decision, Create Links implements appropriate safeguards in accordance with applicable data protection laws.

Depending on the circumstances, these safeguards may include:

• the UK International Data Transfer Agreement (IDTA);
• the UK Addendum to the European Commission Standard Contractual Clauses;
• other legally recognised international transfer mechanisms.

We take reasonable and proportionate technical and organisational measures designed to protect personal data, taking into account the nature of the information we process and the risks involved. These measures may include, where appropriate and reasonably practicable, access controls, confidentiality obligations, data minimisation and information security practices.

We review our approach to data protection and security periodically and may update our measures as our systems, operations and risks evolve.

7. Lawful Bases for Processing

Depending on the circumstances, we rely on one or more of the following lawful bases:

• performance of a contract;
• legitimate interests;
• legal obligations;
• consent where required by law.

8. Sharing Personal Data

We may share personal data with:

• independent contractors engaged to provide the Services;
• cloud hosting providers;
• payment providers;
• IT service providers;
• communication platforms;
• analytics providers;
• professional advisers;
• regulators and public authorities where required by law.

We do not sell personal data.

9. Artificial Intelligence

Create Links may use artificial intelligence and automation technologies to assist in delivering certain Services.

Where AI tools are used:

• they are subject to appropriate security and governance measures;
• they are used to support, rather than replace, human review where appropriate;
• personal data will only be processed through approved AI systems where permitted by law and our contractual obligations.

Our independent contractors are required to comply with our AI & Technology Acceptable Use Standards when using AI-assisted tools.

10. Data Security

We implement reasonable technical and organisational measures appropriate to the nature of the personal data we process and the risks presented by that processing.

Depending on the nature of the services provided, these measures may include:

• encryption where appropriate;
• multi-factor authentication;
• role-based access controls;
• secure cloud platforms;
• device security requirements;
• contractor confidentiality obligations;
• regular security reviews.

11. Retention

We retain personal data only for as long as reasonably necessary to:

• provide the Services;
• comply with legal obligations;
• resolve disputes;
• enforce our contractual rights.

When personal data is no longer required, it is securely deleted or anonymised where appropriate.

12. Your Rights

Subject to applicable law, you may have the right to:

• access your personal data;
• request correction of inaccurate information;
• request deletion of personal data;
• restrict processing;
• object to processing;
• request data portability;
• withdraw consent where processing relies upon consent.

Requests should be sent to hello@createlinksmedia.com.

13. Cookies

Our use of cookies is explained in our Cookie Policy.

14. Third-Party Websites

Our website may contain links to third-party websites.

We are not responsible for their privacy practices and encourage you to review their privacy policies.

15. Changes to this Policy

We may update this Privacy Policy from time to time.

The latest version will always be published on our website.

Where required by law, we will notify you of material changes.

16. Contact Us

If you have any questions about this Privacy Policy or our processing of personal data, please contact:

Create Links Ltd

Email: hello@createlinksmedia.com

If you are not satisfied with our response, you may have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).