This policy explains how Bright Loop Media collects, uses and protects personal data when you use our website (brightloopmedia.co.uk) or engage us for services. It is written in plain English. Where we use a legal term, we explain what it means.
We are committed to handling your data lawfully, fairly and transparently in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who We Are
Bright Loop Media is the data controller for personal data collected through brightloopmedia.co.uk and during our work with clients.
- Trading name: Bright Loop Media
- Trading region: Merseyside, United Kingdom
- Postal address for data protection enquiries: Available on request via the contact details below
- Contact: hello@brightloopmedia.co.uk
We comply with the registration and fee requirements of the Information Commissioner's Office (ICO) under the Data Protection (Charges and Information) Regulations 2018 to the extent they apply to our processing activities.
2. Information We Collect
We collect personal data only when you provide it or when it is necessary to operate the website and our services.
When you contact us through the website:
- Name
- Email address
- Phone number (if you choose to provide it)
- Business name (if you choose to provide it)
- The contents of your enquiry
When you become a client:
- Billing name and address
- Bank or payment details (processed by our payment provider, not stored by us directly)
- Project content you supply (text, images, brand assets)
- Communications relating to the project
When you visit the website:
- Technical data such as IP address, browser type, device type, operating system, and pages visited. Collected through cookies and analytics tools where you have consented.
We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has submitted personal data to us, please contact us and we will delete it.
3. How We Use Your Data and Our Lawful Basis
UK GDPR requires us to identify a lawful basis for every processing activity. Here is ours.
| Activity | Data Used | Lawful Basis |
|---|---|---|
| Responding to enquiries from the contact form | Name, email, phone, message contents | Legitimate interest (responding to a request you initiated) |
| Sending project updates and admin emails to active clients | Name, email, project data | Contract (necessary to perform the agreed work) |
| Issuing invoices and processing payments | Billing name, address, payment details | Contract and legal obligation (HMRC record-keeping) |
| Storing project assets after delivery | Client-supplied content, deliverables | Legitimate interest (warranty support, future project reference). You may request deletion at any time. |
| Sending marketing emails (only if you have opted in) | Name, email | Consent. You can withdraw at any time using the unsubscribe link. |
| Website analytics | IP address, anonymised usage data | Consent (for non-essential cookies via the consent banner) |
| Detecting fraud and securing the site | IP address, technical data | Legitimate interest |
We do not sell, rent or trade your personal data to anyone.
4. Who We Share Your Data With
We share data only with the third-party services we use to operate. Each is bound by its own data protection terms.
Confirmed processors:
- Netlify, Inc. (website hosting, form submissions). Data may be transferred to the United States under approved transfer mechanisms. Privacy: https://www.netlify.com/privacy/
- Google Workspace (email hosting). Privacy: https://policies.google.com/privacy
Subject to consent (only if you accept the relevant cookies):
- Google Analytics 4 (anonymised website analytics)
- Microsoft Clarity (heatmaps and session replays)
- Sentry (error monitoring, no personal content captured)
- Cookiebot (consent management)
Disclosed when legally required:
- HMRC, regulators, or law enforcement, where compelled by valid legal process.
- Professional advisers (accountant, solicitor) under a duty of confidentiality.
5. International Transfers
Some of our processors are based outside the UK. Where data is transferred outside the UK, we rely on one of the following safeguards approved under UK GDPR:
- The UK's adequacy decisions for the country in question, or
- The UK International Data Transfer Agreement (IDTA), or
- Standard Contractual Clauses with the UK Addendum.
Details available on request.
6. How Long We Keep Your Data
We keep personal data only for as long as needed for the purpose it was collected for or to meet legal requirements.
| Data Type | Retention Period |
|---|---|
| Contact form enquiries that did not lead to a project | 12 months from last contact |
| Active client project records | Duration of project plus 7 years (HMRC requirement for tax records) |
| Marketing email subscribers | Until you unsubscribe or 24 months of inactivity, whichever comes first |
| Website analytics (anonymised) | 14 months (default GA4 retention) |
| Error logs | 90 days |
After the retention period, data is deleted or fully anonymised.
7. Your Rights
Under UK GDPR you have the following rights. They are free to exercise. We will respond within one calendar month.
- Right of access. Request a copy of the personal data we hold about you.
- Right to rectification. Ask us to correct inaccurate or incomplete data.
- Right to erasure. Ask us to delete your data, subject to legal retention requirements.
- Right to restrict processing. Ask us to pause processing in defined circumstances.
- Right to data portability. Request your data in a structured, commonly used format.
- Right to object. Object to processing based on legitimate interest, including direct marketing.
- Right to withdraw consent. Where processing is based on consent, you can withdraw it at any time.
- Right to lodge a complaint. With the Information Commissioner's Office (see Section 10).
To exercise any of these rights, email hello@brightloopmedia.co.uk. We may need to verify your identity before responding to a substantive request.
8. Cookies
We use cookies and similar technologies on this website. Some are strictly necessary for the site to function. Others are loaded only with your consent.
For full details of every cookie set, see our Cookie Policy at /cookies.
You can change your cookie preferences at any time by clicking the "Cookie Settings" link in the footer.
9. Security
We protect personal data using:
- HTTPS encryption across the entire website.
- Access controls and least-privilege principles for our internal tools.
- Two-factor authentication on all critical accounts (email, hosting, payment, code repositories).
- Regular software updates and vulnerability patching.
- Encrypted backups of client project files.
- Confidentiality agreements with anyone who works on Bright Loop Media projects.
No system is 100% secure. If we ever experience a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours and contact affected individuals where required.
10. How to Complain
If you believe we have mishandled your personal data, please contact us first at hello@brightloopmedia.co.uk. We take concerns seriously and will investigate promptly.
You also have the right to complain directly to the Information Commissioner's Office:
- Web: https://ico.org.uk/make-a-complaint/
- Phone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
11. Changes to This Policy
We review this policy at least annually and update it when our practices or applicable law change. The "Last reviewed" date at the top reflects the most recent revision. Significant changes will be communicated to active clients by email.
12. Contact Us
For any privacy or data protection question:
Bright Loop Media Email: hello@brightloopmedia.co.uk Postal address: Available on request
