We do not sell personal data or use it for purposes incompatible with those set out above. 4. Website and cookies Our website may use cookies and similar technologies to support core functionality and to understand how visitors use the site, for example through analytics tools. Where analytics or non-essential cookies are used, we will ask for your consent through a cookie banner, and you can change your preferences at any time through your browser settings or the cookie controls on our site. We do not use cookies to build advertising profiles of individual visitors. 5. Who we share your information with We share personal data only where necessary, with the following categories of recipient: IT and productivity providers who process data on our behalf, currently Microsoft 365 (Outlook), Google Workspace, ClickUp, and Apple iCloud, Claude Co-work used for email, file storage, and project management. Professional advisers, such as our accountant, where necessary to meet our legal obligations. Broadcasters, commissioners, or client organisations, where personal data forms part of a commissioned production or deliverable, and only as agreed with you. Regulators or law enforcement, where we are legally required to disclose information. We require every processor we use to protect personal data to a standard consistent with UK GDPR, whether through their standard terms or a data processing agreement. 6. International transfers Some of the service providers listed above may store or process data outside the UK, including in the United States. Where this happens, we rely on safeguards recognised under UK data protection law, such as the UK International Data Transfer Addendum or the provider's adequacy-based transfer mechanisms, to ensure your data remains protected to a UK standard. 7. How long we keep your information We keep personal data only for as long as necessary for the purpose it was collected: Enquiries that do not lead to a project: up to 12 months, then deleted. Client and supplier records, including contracts and invoices: 6 years after the end of our relationship, to meet HMRC and accounting requirements. Marketing consent records: until you withdraw consent, or 3 years of inactivity, whichever is sooner. Where we have no ongoing legal or business reason to keep data, we delete or anonymise it. 8. Your rights Under UK GDPR, you have the right to: Access the personal data we hold about you. Have inaccurate data corrected. Request erasure of your data, where applicable. Restrict or object to our processing of your data. Receive a copy of your data in a portable format. Withdraw consent at any time, where consent is our legal basis.