Executive Summary: Oxford Creative Group Ltd. is committed to protecting user privacy, enforcing data minimization, and ensuring full compliance with the UK General Data Protection Regulation (UK GDPR), EU GDPR, and global data protection standards.
1. Identification of Data Controller
This Privacy Policy applies to all services, content, and interactive features offered on oxfordcreattivegroup.org, operated by Oxford Creative Group Ltd. (referred to herein as "Company", "We", "Us", or "Our").
Registered Office Address: Oxford Business Park, John Smith Drive, Oxford OX4 2JY,
United Kingdom.
Data Protection Office Email: legal@oxfordcreattivegroup.org
2. Categories of Information Collected
When you navigate our website, interact with evaluation tools, or submit contact forms, we may collect the following categories of data:
- Direct Voluntarily Provided Data: Name, work email address, organization name, and inquiry text submitted via our contact forms or lead evaluation interface.
- Automated Telemetry & Technical Data: Anonymized IP addresses, browser specifications, operating system versions, referring URL parameters, timestamp records, and device screen dimensions.
- Preference & Consent Records: Language selection preferences, cookie consent status choices, and age verification confirmations.
3. Legal Bases & Purposes for Data Processing
We process personal data only when a valid legal basis exists under applicable data protection legislation:
- Legitimate Interests (Art. 6(1)(f) UK GDPR): To analyze site traffic trends, ensure network security, evaluate conversational AI services, and optimize user experience.
- Consent (Art. 6(1)(a) UK GDPR): For processing marketing communications, optional analytics cookies, and voluntary contact submissions. You maintain the right to revoke consent at any time.
- Legal Compliance (Art. 6(1)(c) UK GDPR): To satisfy statutory record-keeping requirements, age verification restrictions (18+ enforcement), and legal disclosures requested by competent authorities.
4. Data Minimization & Retention Schedules
We implement strict data minimization principles. Personal data collected via contact forms is retained only as long as necessary to address your specific inquiry or maintain audit records for up to 24 months, after which it is securely deleted or anonymized.
5. Sub-Processors & Data Transfer Standards
We do not sell, rent, or trade your personal information to third-party data brokers. Technical telemetry may be processed by contractually bound sub-processors delivering hosting, DDoS mitigation, and analytical security services under strict Data Processing Agreements (DPAs).
If data transfers occur outside the United Kingdom or European Economic Area (EEA), we enforce recognized transfer mechanisms such as the UK International Data Transfer Agreement (IDTA) or standard contractual clauses (SCCs).
6. Individual Rights Under UK GDPR
As a data subject, you possess enforceable rights regarding your personal information:
- Right of Access: Request copy confirmation of personal data currently retained by us.
- Right to Rectification: Request immediate correction of inaccurate or incomplete records.
- Right to Erasure ("Right to be Forgotten"): Request full deletion of personal data where legal grounds persist.
- Right to Restriction & Objection: Object to processing based on legitimate interest or request processing pauses.
- Right to Data Portability: Obtain structured, machine-readable copies of personal data provided under consent.
To exercise any of these rights, contact our Data Protection Officer at legal@oxfordcreattivegroup.org.
7. Security Measures & Revisions
We enforce technical safeguards including 256-bit TLS encryption, strict access permission scoping, and regular infrastructure security reviews. This Privacy Policy is subject to periodic updates to reflect regulatory or technical changes.