1. Introduction
Creating Impact Sustainability Consultancy Ltd (“we”, “us”, “our”) is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, store and protect personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data Controller
Creating Impact Sustainability Consultancy Ltd
Registered Address: 97 Albemarle Road, York. YO23 1EP.
Email: enquiries@creating-impact.co.uk
We act as the data controller for the personal data collected through our website.

3. Personal Data We Collect
We may collect and process the following categories of personal data:
Contact information — including your name, email address and any information you provide in a contact form submission.
Mailing list information — including your name and email address when you sign up to receive updates or newsletters.
Technical data — such as IP address, browser type and website usage information collected through analytics tools or server logs.
Any additional information voluntarily provided in communications with us.

4. How We Collect Personal Data
We collect personal data directly from you when you:
Submit a contact form
Sign up to our mailing list
Communicate with us by email or through our website
We may also collect limited technical data automatically through cookies or similar technologies, where applicable.

5. Purposes for Processing and Lawful Bases
We process your personal data for the following purposes:
Responding to enquiries – based on our legitimate interests in operating and growing our organisation.
Providing updates, newsletters or resources – based on your consent.
Maintaining website functionality and security – based on our legitimate interests.
Record‑keeping and compliance – based on our legal obligations.

6. Data Sharing
We may share your personal data with trusted third‑party service providers who support our operations, such as:
– Website hosting providers
– Email and newsletter distribution services
– Analytics providers
All third parties are required to process your data in accordance with UK GDPR and under appropriate contractual safeguards.

7. International Transfers
If any service providers transfer data outside the UK, we ensure that appropriate safeguards are in place, such as adequacy regulations or standard contractual clauses.

8. Data Retention
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting or reporting requirements. Specific retention periods are determined based on the type of data and purpose of processing.

9. Data Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction.

10. Your Rights
Under UK GDPR, you have the following rights regarding your personal data:
– Right of access
– Right to rectification
– Right to erasure
– Right to restrict processing
– Right to object
– Right to data portability
You also have the right to withdraw consent at any time where processing is based on consent.

11. Children’s Data
Our website and services are not intended for children, and we do not knowingly collect personal data relating to individuals under 16.

12. Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date.

13. Contact and Complaints
If you have any questions about this Privacy Policy or how we handle your data, please contact us at enquiries@creating-impact.co.uk.
You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe your data has been processed unlawfully.