Privacy Policy
Exxya Creative Ltd.
Last updated: 04 June 2026
1. Who we are
Exxya Creative Ltd. is a company registered in the United Kingdom that provides AI creative services to clients in the UK and internationally.
For UK data protection law, Exxya Creative Ltd. is the data controller responsible for your personal data.
Contact email: ask@exxyacreative.com
Registered office: 17 Tudor Court, Moss Lane, SK7 1BE, Bramhall, United Kingdom.
2. What this policy covers
This Privacy Policy explains how we collect, use, store, and protect personal data when you:
visit our website;
contact us by email or form;
enquire about our services;
work with us as a client, supplier, or collaborator; or
interact with our website, content, and marketing.
We process personal data in line with the UK GDPR, the Data Protection Act 2018, and other applicable privacy laws where relevant.
3. Personal data we collect
We may collect and process the following types of personal data:
Name.
Company name.
Job title.
Email address.
Telephone number.
Billing and payment details.
Project and briefing information.
Messages and correspondence.
Technical data, including IP address, browser type, device type, and usage data.
Marketing preferences.
We only collect data that is relevant to the purpose for which it is provided.
4. How we use your data
We use personal data to:
respond to enquiries;
provide quotes and proposals;
deliver AI creative services;
manage client relationships;
send invoices and process payments;
improve our website and services;
maintain security and prevent misuse; and
send marketing communications where legally permitted.
5. Legal basis for processing
We process personal data on one or more of the following legal bases:
Consent, where you have given us permission.
Contract, where processing is needed to provide our services or take steps before entering into a contract.
Legal obligation, where we must process data to comply with the law.
Legitimate interests, where processing is necessary for our business and does not override your rights.
Where we rely on consent, you can withdraw it at any time.
6. AI creative services
As an AI creative studio, we may process project briefs, reference materials, brand assets, campaign information, and related communications provided by clients.
We may use third-party tools and service providers to support the delivery of our services. Where those tools involve personal data, we take reasonable steps to ensure appropriate data protection arrangements are in place.
Please do not send us sensitive personal data unless it is necessary and we have agreed to process it.
7. Sharing your data
We may share personal data with:
website hosting providers;
email and productivity providers;
analytics and cookie management tools;
payment and accounting providers;
legal, tax, or professional advisers; and
authorities where required by law.
Where third parties process personal data on our behalf, they do so under appropriate contracts and safeguards.
8. International transfers
Because Exxya Creative Ltd. works with clients and service providers around the world, your personal data may be transferred to, stored in, or accessed from countries outside the UK.
Where this happens, we use appropriate safeguards permitted under UK data protection law, such as adequacy regulations, the UK International Data Transfer Agreement, or other lawful transfer mechanisms.
9. Data retention
We keep personal data only for as long as necessary for the purpose for which it was collected, including legal, accounting, and reporting obligations.
When data is no longer needed, we will delete it securely or anonymise it.
10. Your rights
Depending on the circumstances, you may have the right to:
access your personal data;
correct inaccurate data;
request deletion of your data;
restrict or object to processing;
request transfer of your data;
withdraw consent where processing is based on consent; and
lodge a complaint with the Information Commissioner’s Office (ICO).
11. Cookies
Our website uses cookies and similar technologies to make the site work properly, improve performance, and understand how visitors use it.
We may use:
Strictly necessary cookies for core website functionality.
Analytics cookies to measure and improve website performance.
Preference cookies to remember settings such as language or display choices.
For any cookies that are not strictly necessary, we will ask for your consent through our cookie banner before placing them on your device, in line with UK cookie rules.
You can control cookies through your browser settings and may delete or block them at any time, although some website features may not work properly if you do so.
12. Contact forms and email
If you contact us through a form or by email, we will process the information you provide to respond to your enquiry and manage any related follow-up.
We do not sell your enquiry data or use it for unrelated purposes without a lawful basis.
13. Marketing
If you subscribe to our mailing list or agree to receive updates, we may send you occasional marketing communications about our services, news, or projects.
You can opt out at any time by using the unsubscribe link in our emails or by contacting us directly.
14. Security
We use appropriate technical and organisational measures to protect personal data from loss, unauthorised access, misuse, or disclosure.
However, no method of transmission over the internet or method of electronic storage is completely secure.
15. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our services, technology, or legal obligations. The latest version will always be posted on our website.
Data Processing Agreement
Where Exxya Creative Ltd. processes personal data on behalf of the Client in connection with the provision of services, the parties agree that Exxya Creative Ltd. shall act as a processor and the Client shall act as controller for the purposes of UK data protection law.
Exxya Creative Ltd. shall:
process personal data only on the Client’s documented instructions, unless required to do otherwise by law;
ensure that persons authorised to process the personal data are subject to appropriate confidentiality obligations;
implement appropriate technical and organisational measures to protect personal data;
not appoint any sub-processor without the Client’s prior written authorisation, unless otherwise agreed in writing;
assist the Client, so far as reasonably possible, with responding to data subject requests and meeting its UK GDPR obligations relating to security, breach notification, and data protection impact assessments;
delete or return personal data at the end of the services, at the Client’s choice, unless retention is required by law;
make available to the Client information reasonably necessary to demonstrate compliance with this clause; and
permit audits or inspections, subject to reasonable notice, confidentiality, and business continuity requirements.
The Client shall ensure that it has a lawful basis for all personal data shared with Exxya Creative Ltd. and shall provide all required privacy notices and permissions to data subjects.
GDPR
We process personal data in accordance with the UK GDPR and the Data Protection Act 2018. This means we only collect and use personal data where we have a lawful basis to do so, such as consent, contract, legal obligation, or our legitimate interests. We apply the principles of data minimisation, purpose limitation, accuracy, storage limitation, integrity, confidentiality, and accountability when handling personal information. Where required, we provide clear information about how data is used, how long it is kept, whether it is shared with third parties, and whether it may be transferred outside the UK. Individuals also have rights under data protection law, including the right to access their data, request correction or deletion, restrict or object to processing, withdraw consent where applicable, and lodge a complaint with the Information Commissioner’s Office.