How we handle your data.
Effective date: August 2026
"The short version: We treat your data with the same respect we expect for our own. Transparently, securely, and with zero fluff. We don't sell data, and we only collect what's necessary to run campaigns, partner with creators, and deliver exceptional work."
1. Who We Are & How To Contact Us
This Privacy Policy applies to Red Thread Creative Ltd (referred to as "Red Thread", "we", "us", or "our").
Company Registration Number: 16771805
Registered Address: 93 Alexandra Drive, Surbiton, KT5 9AE, United Kingdom
Data Privacy Contact: hello@redthread.co
Under UK Data Protection Law (including UK GDPR and the Data Protection Act 2018), Red Thread Creative Ltd acts as the Data Controller for personal information processed under this policy.
2. The Information We Collect
A. Brands, Clients & Business Partners
Personal & Professional Details: Name, job title, work email address, phone number, and company name when you make an enquiry, request a proposal, or partner with us.
Financial Data: Billing addresses, bank details, and transaction histories required to process contracts and invoices.
B. Creators, Influencers & Talent
Profile & Contact Data: Name, email address, phone number, location, representation details, and shipping address (for campaign product deliveries).
Social Media & Performance Data: Public handles, audience demographics, follower counts, engagement metrics, and content links submitted directly by you or via public platform APIs (Meta, YouTube, TikTok).
Financial & Compliance Data: Bank details, tax IDs, and signed agreements required for campaign contracting and payout.
C. Website Visitors
Technical Data: IP address, browser type/version, time zone, operating system, and interaction patterns (pages viewed, click paths).
3. How & Why We Use Your Data (Legal Grounds)
Under UK GDPR, we must have a lawful basis to process your information. Here is how we apply it:
| Purpose / Activity | Data Types | Legal Ground (UK GDPR) |
|---|---|---|
| Responding to brand enquiries & pitches | Contact & Business Data | Legitimate Interests (growing our agency) |
| Managing contracts, campaign delivery & billing | Contact, Business & Financial | Contractual Necessity |
| Sourcing talent, matching briefs & creator payments | Creator Profile, Social & Payment Data | Contractual Necessity & Legitimate Interests |
| Campaign measurement & brand client reporting | Public Social & Engagement Metrics | Legitimate Interests |
| Website security & basic analytics | Technical & Usage Data | Legitimate Interests / Consent |
| Tax, accounting & regulatory record-keeping | Transactional & Financial Data | Legal Obligation (HMRC compliance) |
4. Social Media Platform Data & APIs
When reviewing creator metrics for brand campaigns, we process public social media activity in strict compliance with platform developer policies:
- Meta API (Instagram/Facebook): Public profile info and campaign analytics are processed in accordance with Meta's Data Policy.
- YouTube API Services: Processed in line with the Google Privacy Policy. You can revoke access via Google Security Settings at any time.
- TikTok & Other Platforms: Metrics are processed solely for campaign vetting and performance reporting.
5. Sharing Your Data
We do not sell, rent, or trade your personal data. Ever.
We only share information with vetted service providers who help us operate:
- Cloud Infrastructure: Secure hosting, communication, and project platforms (Vercel, Google Workspace, Slack).
- Financial Advisors: Accountants and auditors for UK tax compliance.
- Brand Clients (For Creators): Sharing public handles and audience stats for campaign approval.
- Legal Obligations: When strictly required by law or HMRC.
6. International Data Transfers
When cloud software processes data outside the UK or EEA, we ensure protection through UK Adequacy Decisions, standard contractual clauses (SCCs), or the UK International Data Transfer Agreement (IDTA).
7. Security & Data Retention
We enforce encrypted storage, HTTPS, access control, and two-factor authentication across all agency systems. We retain client and creator contract records for up to 6 years following campaign completion to fulfil UK tax rules.
8. Your Legal Rights (UK GDPR)
You have the right to access, rectify, delete, or restrict processing of your personal data. To exercise your rights, email us at hello@redthread.co. We respond within one calendar month.
You also have the right to lodge a complaint with the UK regulator: Information Commissioner's Office (ICO) at ico.org.uk.
9. Cookies & Policy Updates
We use essential cookies for site functionality and basic performance analytics. You can adjust your browser settings to block cookies at any time.
We review this policy periodically. Updates are published directly to this page.