YOUR INFORMATION · CLEARLY EXPLAINED

Privacy Policy

How I handle your information when you visit Creative Apple, contact me or work with me on a project. Your project is personal. The way I look after your information should be clear too.

Privacy notice · Updated 18 October 2026

Read the privacy information provided for this website.

One clear contact

Creative Apple Solutions Ltd is the controller. Michael is your contact for privacy questions.

Information with a purpose

Enquiries, bookings and project information are used to run the services you request.

Your choices and rights

You can ask about your information, raise a concern or object to direct marketing.

ON THIS PAGE

Find the information you need.

1. Who is responsible for your information

Creative Apple Solutions Ltd, company number 12417645, is the controller of the personal information covered by this notice. I am Michael, the owner and your contact for questions about how the company handles your information. References to “I”, “me” and “my” describe the company’s activities carried out by me.

Email [email protected]. Business contact address: Creative Apple Solutions Ltd, Europa Business Park, Bird Hall Lane, Building 67, Ground Floor, 67 G12, Stockport, SK3 0XA, United Kingdom.

This notice covers creativeapple.ltd and my own business enquiries, bookings, client administration and service delivery. A separate website or service, including another brand’s website, may have its own privacy notice. The organisation responsible for a client’s website normally provides that website’s privacy information.

Creative Apple Solutions Ltd is registered in England and Wales under company number 12417645. Its registered office is 67 Europa Business Park, Bird Hall Lane, Stockport, England, SK3 0XA. The more specific business correspondence address below can be used for project and privacy enquiries.

2. Information you provide

Depending on how you contact or work with me, I may receive your name, business name, role, email address, telephone number, billing details, appointment preferences and the contents of your messages. A project may also involve your brief, supplied text and images, files, feedback, approvals, correspondence and information needed to investigate a support request.

If you use a client account or booking service, the relevant account, appointment and service records are processed to provide that feature. Payment administration may include invoices, payment status and transaction references. Payment providers handle payment details under their own security arrangements; please do not send complete card details or passwords in an ordinary enquiry.

Please provide only information needed for your request. Do not send health information, identity documents, customer databases or other sensitive information through a general contact form. If access to personal information is necessary for a project, we should first agree a suitable method and the relevant responsibilities.

3. Information collected when you use the website

Website, hosting, security and delivery services can process an IP address, browser and device information, requested page, request time, referring page and information about errors or suspicious activity. Cookies and similar technologies may store or read information on your device. See the section on website technologies below.

I receive information directly from you, from the people you authorise to work with me, from the service providers used to administer your request and from your interactions with this website. Where relevant to a business enquiry or project, I may also refer to information you or your business have made public, such as a business website or professional contact details.

If your organisation or an authorised contact introduces you for a project, the information may include your name, role, business contact details and relevant correspondence. Public professional information may come from your business website or a professional profile. Where I obtain personal information from another source, I must provide the relevant privacy information within the applicable legal timetable, rather than assume that a public profile removes your privacy rights.

4. Why information is used and the legal bases

Enquiries, quotations and individual contracts. I use the relevant contact details and requirements to respond, prepare a quotation and perform an agreement. Where you are the individual entering the agreement, the legal basis is taking steps at your request before a contract or performing that contract.

Business contacts and representatives. Where you act for a company or another organisation, I use your business contact details and correspondence for the legitimate interests of communicating with that organisation, managing the relationship and delivering the agreed work. The contract legal basis does not automatically apply to every employee or representative.

Bookings, accounts and project support. The basis is the relevant individual contract where applicable, or the legitimate interests of arranging appointments, administering a business relationship, keeping necessary project records and resolving service queries.

Invoices, financial records and legal requirements. I process information needed to meet applicable accounting, tax and other legal obligations. Necessary records for explaining charges, establishing or defending a claim and managing a genuine dispute may also be kept on the basis of legitimate interests or a relevant legal obligation.

Security and operation. Protecting the website, accounts, communications and business from abuse, investigating faults and maintaining reliable services are legitimate interests. Storage or access technologies also need a valid basis under the separate rules that apply to those technologies.

Optional marketing and measurement. Marketing messages and storage/access technologies that require consent need a valid consent before that use. A permitted legitimate interest may support a particular business communication or measurement activity only where the applicable rules allow it and the necessary conditions are met. You can object to direct marketing at any time. This notice does not itself obtain consent.

Privacy requests and complaints. I use the information needed to recognise and respond to your request, check identity or authority where necessary, investigate a concern and keep proportionate evidence of the response. This supports my data protection obligations and, where applicable, the legitimate interests of explaining and defending the handling of the matter.

Approved project examples and testimonials. Where agreed, I may use permitted public business project material to explain my work. A business-content licence is separate from a lawful basis for personal information. If an example, image or quotation identifies an individual, I establish an appropriate legal basis and provide the necessary information; where consent is required, it is sought separately and can be withdrawn through the contact details in this notice. Private project records are not made public as a condition of ordinary support.

5. What happens if you do not provide information

You can browse the public website without sending an enquiry. Information marked as required in a form is needed for the relevant request. If essential contact, booking, billing or project information is missing, I may be unable to answer properly, arrange the appointment or provide the service. Optional information is not a condition of buying a service.

Consent to unrelated marketing is not a condition of agreeing a project. Withdrawing consent does not affect processing that was lawful before withdrawal. Separately identified processing that does not rely on consent, such as required accounting records, may continue where its own legal basis applies.

6. Who may receive information

Information may be handled by providers used for website hosting and delivery, security, email, appointments and calendars, forms, client accounts, file storage, payments, accounting and technical support. They receive the information needed for the relevant function. Professional advisers, regulators, public authorities or a court may receive information where needed for a lawful business purpose or legal requirement.

Enquiries are handled through the website’s WordPress/Elementor forms. Appointment features use Bookly, with appointment records held in the website’s database. The client file area uses a Google Drive integration, so files handled through that feature are processed using Google Drive as well as the relevant website access controls. Information needed for an enquiry or appointment may also be handled in the business communications used to respond to it.

Cloudflare provides website delivery, protection and performance services. Google services are used for website measurement and spam protection as described below. If you choose a payment or external communication service, that provider also handles information for its own relevant purposes under its own notice.

I do not sell personal information. Client information is not made public merely because it has been supplied for a project. Any permitted disclosure still needs an appropriate purpose and legal basis.

Company email addressed to creativeapple.ltd is routed through Hostinger’s mail servers. Hostinger therefore handles the relevant incoming business email. Website-generated email uses the website’s configured mail delivery. Hosting and file services used for a particular client project can differ: where I provide Hostinger hosting or work on your chosen host, the relevant account and data responsibilities are agreed for that project.

7. Cookies, measurement and spam protection

Necessary functions. Cookies or similar storage may be needed for security, a requested sign-in, a client session, booking or other functionality you choose to use. The rules may permit necessary storage or access without optional consent when their conditions are met.

Google Analytics. Google Analytics measurement is installed on this website. It can process information about visits, devices, page use and related identifiers according to its configuration. This is different from the information you deliberately submit in an enquiry. Read Google’s privacy information.

Cloudflare Turnstile. We use Cloudflare Turnstile to help protect our forms from spam and automated abuse. Cloudflare processes technical signals, such as IP address, browser information and the website origin, for this verification. Read Cloudflare’s privacy information and the Turnstile Privacy Addendum.

Cloudflare. Delivery and security features process request information. A Cloudflare performance beacon is also present on the website. Read Cloudflare’s privacy information.

Optional technologies must have the consent or another applicable exception required by law. The narrow exceptions for particular statistical or appearance functions do not automatically cover advertising, tracking or profiling. This notice is information about processing; reading it is not consent. Browser settings let you inspect, block or delete cookies, although blocking necessary storage can affect requested functions. Browser controls are separate from any consent required before a technology is used.

For a question about a particular cookie, provider or choice on this website, contact me with the page and technology concerned. The ICO explains cookies and your choices.

8. External links, messaging and social media

The website offers links to services such as WhatsApp, Messenger, Telegram and social media profiles. If you follow a link or choose to message me through a platform, that platform receives information about your use of its service and handles it under its own privacy terms. The information you send to me is also used to respond to your request and administer the relationship as explained here.

External sites have their own controllers, terms and technologies. A link does not mean their entire service is operated by Creative Apple. Choose an appropriate channel for the sensitivity of the information and contact me before sending confidential project access or customer information.

Some portfolio content includes an embedded YouTube video. When the player is loaded or you choose to play a video, the video provider may receive technical and viewing information, depending on the player’s configuration. The provider may use cookies or similar technologies. Any non-exempt storage or access needs the choice required by law; a video’s presence on this website does not itself provide consent.

9. Personal information in a client project

You may be responsible for personal information on your own website, shop, CRM, mailing list or other business system. When I access that information only to carry out your documented instructions, your organisation will normally be the controller and Creative Apple may act as a processor for that activity. The precise roles depend on the service.

Where required, we must put an appropriate written data processing agreement in place covering the instructions, access, security, confidentiality, relevant providers and arrangements when the work ends. This public notice does not replace that agreement or your own privacy information for your customers.

Please limit access and test data to what the work needs. We should agree any use of production customer records, an overseas provider or an AI service before that data is supplied to the relevant service. I do not treat a general project enquiry as permission to upload confidential customer data to an AI tool.

Project ownership and portfolio permissions are explained in the Terms & Conditions. Those provisions do not by themselves authorise publication of personal information about you or another person. Where a portfolio example would identify someone, I need an appropriate lawful basis, any required permissions and suitable privacy information. Contact me if you believe a public example contains personal information that should be reviewed.

10. Processing outside the United Kingdom

Some technology providers are international organisations and may process information outside the UK. The locations and recipients depend on the service being used; an international website link and a restricted transfer by Creative Apple are not automatically the same thing.

Where Creative Apple makes a restricted transfer, the applicable UK data protection requirements must be met. Depending on the recipient and circumstances, this may involve UK adequacy arrangements or an appropriate contractual safeguard and any required assessment. You can ask me which provider and relevant transfer arrangement apply to your request or project and how to obtain information about the safeguards. This notice does not claim that every provider processes all information in the UK.

11. How long information is kept

Information is kept for its purpose and any necessary legal, accounting or dispute requirement, rather than indefinitely just because storage is available. The relevant purpose, relationship, information sensitivity and need to explain work or a charge determine retention. A genuine complaint, claim, investigation or legal obligation can require relevant records to be kept longer.

Enquiries and appointments: for dealing with the request, any related quotation or follow-up and necessary evidence of the resulting service or a genuine dispute. If the enquiry becomes a project, the relevant material becomes part of the project records. Unneeded enquiry content should be removed when those purposes end.

Project records and issued reports: the necessary agreement, approvals, deliverables, issued reports and correspondence may be kept to deliver and support the project, explain the work and manage contractual or legal claims. I review what is still needed. An issued SEO report is separate from the detailed working notes described below; there is no blanket legal requirement to keep every report for six years.

Invoices and accounting records: generally six years from the end of the financial year they relate to, or longer where the law requires. Information needed to meet that obligation is not deleted simply because a shorter support or time-log period has ended.

Accounts and security records: while needed to provide the account or requested service, investigate abuse or an incident and meet relevant legal requirements. Redundant access should be removed when no longer needed. Where a backup contains a remaining copy, it may remain until overwritten or deleted under the relevant retention arrangement. Such a copy should be restricted to recovery needs, and a valid deletion must also be respected if a backup is restored.

Privacy requests and complaints: relevant correspondence and evidence are kept while needed to handle the matter, demonstrate the response and address a related legal requirement or genuine claim. I review whether identifying information is still necessary and limit retained copies to what that purpose requires.

12. The one-month rule for detailed SEO time logs

You may ask how much time has been worked during the current month. Detailed daily SEO working logs are normally retained until one calendar month after both the associated report has been expressly approved and the relevant invoice has been paid in full. You may request the available logs during that period.

If you expressly waive the report for that work, the month starts only after both the time and fee have been confirmed with you and the invoice has been paid in full. Silence is not treated as express approval. After the relevant month, the detailed logs are scheduled for deletion under this retention policy.

This short rule applies to the detailed working notes. It does not apply to issued reports, invoices, accounting records or necessary contract evidence. Relevant information is retained for longer where a genuine unresolved query, dispute, investigation or legal obligation requires it, with that need reviewed. If approval remains outstanding, I review whether the detailed records are still necessary; they are not kept indefinitely merely because no reply has been received. You should request any copy you need before the normal period ends; deletion cannot remove rights you have under the law.

13. Protecting information

Appropriate access restrictions, security measures and service arrangements should reflect the information and the work being carried out. Access is limited to the purposes for which it is needed. Please keep your own devices and account credentials secure and tell me promptly if access supplied for a project may have been compromised.

No website, email system, hosting service or other technology can promise absolute protection against every incident. This does not remove Creative Apple’s responsibility to use the care and safeguards required by law or an agreed service. If a personal data breach occurs, I will assess the circumstances and provide the notifications and cooperation required by law.

14. Your data protection rights

Depending on the circumstances, you can ask to access your personal information, correct inaccurate information, delete information, restrict its use, object to its use or receive certain information in a portable format. Where processing relies on consent, you can withdraw that consent at any time.

These rights have conditions and exceptions. For example, a deletion request does not require removal of an invoice that must lawfully be kept. If I cannot do what you ask, I will explain the relevant reason. I may ask for information reasonably needed to identify you or understand the request, without collecting unnecessary identification.

You can contact [email protected], write to the business address above or raise a request through another usual contact channel. You do not need a special form or legal wording. I respond without undue delay, normally within one calendar month. A complex request or several requests from the same person may permit up to two further months; I will explain any permitted extension and its reasons within the initial month. Necessary identification, authority or clarification affects timing only as the law allows. Requests are normally free; any lawful fee or refusal will be explained.

15. Your right to object and marketing choices

You can object to the use of your information for direct marketing at any time. Tell me using the contact details in this notice or use an unsubscribe option supplied with the message. Information needed to record that preference may be retained so your choice can be respected.

You can also object, on grounds relating to your particular circumstances, to processing based on legitimate interests. I will consider the request under the applicable data protection rules. Stopping optional marketing does not stop necessary communications about an existing booking, contract, invoice or service problem.

To withdraw consent to communications that rely on it, use the unsubscribe option provided with the message or contact [email protected]. Withdrawing consent does not affect earlier lawful use.

16. Automated decisions and children

Spam protection and website security may use automated signals to assess requests. Decisions about accepting a project, agreeing its scope and delivering my professional services are made by me. This notice does not describe a service that uses solely automated decisions to determine a person’s legal rights or similarly significant outcomes.

The website and business services are intended for business and professional use and are not directed at children. If you believe a child has supplied personal information that should not be held, please contact me so I can assess the circumstances and take appropriate action.

17. Questions and complaints

Please contact [email protected] with a privacy concern. Explain the relevant interaction, information and outcome you are seeking. I will acknowledge a data protection complaint within 30 days, investigate it without unnecessary delay, keep you informed and explain the outcome.

You can also complain to the Information Commissioner’s Office, the UK data protection regulator. You do not have to give up that right to contact me first. Make a complaint to the ICO.

You do not need to use a special form or refer to data protection law to raise a concern. You can also write to the business address above or use another usual contact channel. If someone acts for you, I may need appropriate evidence of their authority before sharing information about you.

18. Updates to this notice

This version is dated 18 October 2026. I will review the notice when services, technology or relevant requirements change. The current version will be available on this page, and a material change will be communicated where required. Updating a notice is not a substitute for obtaining new consent or putting safeguards in place when the law requires them.

For project prices, revisions, SEO reporting and service responsibilities, read the Terms & Conditions. This privacy notice explains personal information; it does not ask you to waive your legal rights.

If I plan to use personal information for a new purpose, I will explain that purpose and the relevant legal basis before the new use begins, unless a lawful exception applies. A change to this notice does not by itself authorise an incompatible use or replace consent where consent is required.

Contact me through the website if you have questions about privacy.

CONTACT & CLARIFICATION

Questions about this information?

You can contact me, Michael, if you need help locating a section or clarifying the written information.

Michael · Creative Apple Solutions Ltd

Europa Business Park, Bird Hall Lane, Building 67, Ground Floor, 67 G12, Stockport, SK3 0XA, United Kingdom

[email protected]

Company number: 12417645