This policy explains what personal data CREATE Displays collects, why we collect it, how we use it, and the rights you have over it. CREATE Displays is operated by CREATE, a trading name based in the United Kingdom. We are the data controller for the data described below.
The Service is sold business-to-business. The personal data we hold is mostly business contact data (the people who run the businesses that subscribe).
| Purpose | Legal basis |
|---|---|
| Run your account, deliver the Service, host your content, send invoices and receipts | Performance of contract (Article 6(1)(b) UK GDPR) |
| Reply to enquiries from the contact form, demo requests, and support emails | Legitimate interest in answering you / steps prior to a contract |
| Server logs, spam filtering, rate limiting, and security monitoring | Legitimate interest in protecting the Service |
| Email you about service-affecting changes, security issues, or material updates to these policies | Legitimate interest in keeping you informed about a service you pay for |
| Analytics cookies (Google Analytics) | Your consent — given through the cookie banner |
| Comply with tax, accounting, and legal obligations | Legal obligation |
We do not sign customers up to a marketing newsletter by default. If we ever launch one, joining it will be opt-in and unsubscribing will be one click. We will not sell your details to anyone.
We use a small number of third-party processors to run the Service. They process data on our instructions only, under data-processing agreements that meet UK GDPR requirements:
We will share your data with law enforcement, courts, regulators, or our legal advisors if we are required to by law, or if we reasonably believe it is necessary to protect our or your rights, safety, or property.
We do not sell your data, ever.
Most of our processors are in the UK, the EEA, or the United States. Where data is transferred outside the UK, we rely on either an adequacy decision (e.g. for the EEA) or on standard contractual clauses approved by the UK Information Commissioner.
Under UK GDPR you have the right to:
To exercise any of these, contact us through the contact form. We will respond within one calendar month.
We use HTTPS across the whole site, store passwords/passcodes hashed where applicable, restrict admin access by passcode, rate-limit form submissions and admin endpoints, and rely on UK-based hosting with regular security patching. No service is 100% secure; if we ever discover a breach affecting your data, we will notify you and the ICO without undue delay as required by law.
The Service is sold to businesses. It is not directed at children, and we do not knowingly collect data about children.
We may update this policy. The most recent version is always at this URL with the “Last updated” date at the top. Material changes will be notified by email to your account contact.
Privacy questions or requests? Use the contact form and we’ll get back to you within five working days.