• Industry-Focused Solutions

Privacy Policy

This policy explains how Crayola Digital Ltd collects, uses, and protects your personal data in accordance with the UK GDPR and the Data Protection Act 2018.

Last Updated: 1st April 2026

1. Who We Are

Crayola Development Private Limited is a web and mobile app Development Company providing software development and IT services.

📧 Email: hello@crayoladigital.com
🌐 Website: https://crayoladigital.com/

2. Personal Data We Collect

We may collect and process the following categories of personal data:

  • Identity data: first name, last name, job title, company name
  • Contact data: email address, telephone number, postal address
  • Technical data: IP address, browser type and version, time zone, browser plug-in types, operating system and platform
  • Usage data: information about how you use our website and services
  • Marketing data: your preferences in receiving marketing from us and your communication preferences
  • Financial data: limited payment information processed via secure third-party payment processors (we do not store card numbers)

3. How We Collect Data

We collect data through the following means:

  • Direct interactions: when you fill in our contact form, request a proposal, apply for a role, or communicate with us via email
  • Automated technologies: cookies, server logs, and similar technologies as you interact with our website
  • Third parties: analytics providers (Google Analytics), advertising partners, and publicly available sources

4. Legal Basis for Processing (GDPR)

Under the UK GDPR, we rely on the following legal bases:

  • Consent: where you have explicitly opted in to marketing communications
  • Contractual necessity: to perform a contract with you or to take steps at your request before entering a contract
  • Legitimate interests: for business development, security monitoring, and service improvement, where these are not overridden by your rights
  • Legal obligation: where we are required to retain records for tax or regulatory compliance

5. How We Use Your Data

We use your personal data to:

  • Respond to project enquiries and provide requested services
  • Manage our contractual relationships with clients
  • Send project updates, invoices, and service-related communications
  • Send marketing communications (where you have consented)
  • Improve our website and services through analytics
  • Comply with legal and regulatory obligations
  • Prevent fraud and maintain the security of our systems

6. Data Sharing

We do not sell your personal data. We may share it with:

  • Service providers: cloud hosting (AWS/GCP), CRM (HubSpot), payment processing (Stripe), project management tools — all bound by data processing agreements
  • Professional advisers: lawyers, accountants, and auditors under strict confidentiality obligations
  • Regulatory authorities: where required by law (e.g., HMRC, ICO)
  • Business transfers: in the event of a merger, acquisition, or asset sale, subject to equivalent data protection commitments

7. International Data Transfers

Some of our service providers operate outside the UK and European Economic Area. Where we transfer your data internationally, we ensure appropriate safeguards are in place, including:

  • Standard Contractual Clauses (SCCs) approved by the UK ICO or European Commission
  • Adequacy decisions covering the destination country
  • Binding Corporate Rules where applicable

8. Data Retention

We retain personal data only as long as necessary for the purposes for which it was collected, or as required by law:

  • Client contract data: 7 years after contract end (UK Companies Act / HMRC requirements)
  • Enquiry / contact data: 2 years if no contract results
  • Marketing data: until you unsubscribe or withdraw consent
  • Website analytics: 26 months (Google Analytics default, reviewed annually)
  • Job applicant data: 6 months after a hiring decision, unless you consent to longer retention

9. Your Rights Under GDPR

You have the following rights regarding your personal data:

  • Right of access: request a copy of data we hold about you (Subject Access Request)
  • Right to rectification: request correction of inaccurate data
  • Right to erasure: request deletion ("right to be forgotten") subject to legal obligations
  • Right to restriction: request that we limit processing of your data
  • Right to portability: receive your data in a machine-readable format
  • Right to object: object to processing based on legitimate interests or for direct marketing
  • Rights related to automated decision-making: we do not make solely automated decisions with significant effects

To exercise any right, email privacy@crayoladigital.com. We will respond within 30 days.

10. Cookies & Tracking

We use cookies and similar tracking technologies on our website. For full details on the types of cookies we use and how to manage them, please see our Cookie Policy.

You can control cookies through your browser settings or via our cookie consent banner. Disabling certain cookies may affect website functionality.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

  • Encryption in transit (TLS 1.3) and at rest (AES-256)
  • Role-based access controls and principle of least privilege
  • Regular security audits and penetration testing
  • Employee data protection training
  • Incident response procedures aligned with ICO reporting requirements

In the event of a data breach that poses risk to your rights and freedoms, we will notify you and the ICO within 72 hours of becoming aware.

12. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at privacy@crayoladigital.com and we will endeavour to resolve the matter promptly.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at any time:

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, technology, or our business practices. When we do, we will update the "Last Updated" date at the top of this page and, where changes are material, notify you by email or a prominent notice on our website.

We encourage you to review this policy periodically.

14. Contact Us

For any questions about this Privacy Policy or our data practices, please contact our data team:

Contents