Privacy Policy | Learn More About Our Data Privacy Practices — Leah Croft

Last updated: 22/07/2026

Who We Are

This Privacy Policy explains how Croftleah ("we", "us", "our") collects, uses and looks after your personal data when you visit croftleah.com or work with us.

For the purposes of UK GDPR and the Data Protection Act 2018, the data controller is:

Name: Leah Croft trading as Croftleah
Email:hello@croftleah.com
Location: Truro, Cornwall, United Kingdom

What Data We Collect

We only collect what we actually need. That includes:

Contact details you give us via forms or email (name, email, business name, phone number)
Enquiry content such as messages, project briefs and anything you send through a contact or discovery form
Client data needed to deliver our services (social account handles, brand assets, invoicing details)
Technical data like IP address, browser type, device info and pages visited (collected automatically)
Marketing preferences if you sign up to a newsletter or freebie

How We Use Your Data

We use your personal data to:

Respond to enquiries and provide quotes
Deliver the services you've hired us for
Send invoices and manage payments
Keep records for HMRC and legal obligations
Send marketing emails (only if you've opted in)
Improve our website and services

Our Legal Bases

Under UK GDPR we rely on the following lawful bases:

Purpose Lawful basis
Responding to enquiries Legitimate interest
Delivering services Contract
Accounting & tax records Legal obligation
Marketing emails Consent Website analytics Consent

Cookies and Tracking

Our website may use a small number of cookies to make things work and to understand how visitors use the site. For full details of what cookies we use and how to manage them, see our separate cookie policy (coming soon).

Who We Share Your Data With

We don't sell your data. We do share it with trusted third parties who help us run the business, including:

Email: Proton Mail (primary business email) and a secondary Google Workspace / Gmail account used only for administering Google Forms
Website hosting and forms: Squarespace (as a data processor for site content, contact forms and any information you submit through the site)
Client onboarding and tone of voice questionnaires: Google Forms (responses are stored in Google Drive under the secondary account above)
Social scheduling and analytics: Metricool and platform-native tools (Meta, LinkedIn, TikTok)
CRM and project tools: Notion
HMRC where legally required

Some of these providers may process data outside the UK. Where that happens we make sure appropriate safeguards are in place (UK International Data Transfer Agreement or adequacy decisions).

How Long We Keep Your Data

Enquiry emails: up to 2 years after last contact
Client records and contracts: 7 years after end of engagement (HMRC requirement)
Marketing list: until you unsubscribe

Your Rights

Under UK GDPR you have the right to:

Access the personal data we hold on you
Correct anything that's wrong
Erase your data ("right to be forgotten")
Restrict or object to processing
Withdraw consent at any time
Data portability (get your data in a usable format)
Complain to the ICO at ico.org.uk

To exercise any of these, email hello@croftleah.com - we'll respond within one month.

Keeping Your Data Safe

We take security seriously. That means strong passwords, two-factor authentication, encrypted storage and only giving access to people who need it. No system is 100% secure but we do our best to protect what you share with us.