Last updated: 1 September 2026
Privacy Policy
This Privacy Policy explains how we collect, use, share and protect personal data when you visit contentelevation.iteurope.com, contact us, or engage us as a client. It is written to meet our obligations under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
1. Who we are
Content Elevation Ltd (“we”, “us”, “our”) is a company registered in England and Wales, trading as Content Elevation, with its principal place of business at Tramshed Tech, Pendyris Street, Cardiff CF11 6BH, United Kingdom. We are the controller of the personal data described in this notice.
You can reach us at any time by email at [email protected], by telephone on +44 29 2018 0456, or by post at the address above marked for the attention of the Data Protection Lead.
We have not appointed a statutory Data Protection Officer because we are not required to do so. Our Data Protection Lead is responsible for privacy matters and can be reached at the contact details above.
2. The personal data we collect
2.1 Data you give us
- Identity and contact data — your name, business name, job title, email address and telephone number, submitted through our enquiry form or given to us directly.
- Enquiry content — the description of your project, requirements, budget indication and any other information you choose to include in your message.
- Client and project data — where we go on to work together, the correspondence, briefs, approvals, feedback and materials exchanged during the engagement.
- Billing data — invoicing name, billing address, VAT number and payment references. We do not collect or store full card details; payments are handled by our bank and payment provider.
2.2 Data collected automatically
- Technical data — IP address (truncated where our analytics settings permit), browser type and version, device type, operating system, screen size and language preference.
- Usage data — pages viewed, time on page, referring website, and the links or buttons you interact with.
- Consent data — a record of the cookie preference you selected and when you selected it, stored in your browser.
2.3 Data we do not want
We do not seek special category data (such as health, religious belief, political opinion, biometric or trade union data) and we ask that you do not include it in enquiry forms. If you send it to us unnecessarily we will delete it. We do not knowingly collect data from anyone under the age of 16.
3. Why we use your data and our lawful basis
| Purpose | Data used | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Responding to an enquiry and preparing a proposal | Identity, contact, enquiry content | Steps taken at your request prior to entering a contract (Art. 6(1)(b)) |
| Delivering the services we are engaged to provide | Client, project and billing data | Performance of a contract (Art. 6(1)(b)) |
| Issuing invoices and keeping accounting records | Billing data | Legal obligation (Art. 6(1)(c)) — Companies Act 2006 and HMRC requirements |
| Keeping the site secure and preventing abuse | Technical data | Legitimate interests (Art. 6(1)(f)) — protecting our systems and users |
| Understanding how the site is used and improving it | Usage and technical data | Consent (Art. 6(1)(a)) — given through our cookie banner |
| Sending occasional updates to existing clients about similar services | Contact data | Legitimate interests with an opt-out in every message (soft opt-in under PECR reg. 22(3)) |
| Establishing, exercising or defending legal claims | Any relevant data | Legitimate interests (Art. 6(1)(f)) and legal obligation where applicable |
Where we rely on legitimate interests we have carried out a balancing assessment and are satisfied that our interest does not override your rights and freedoms. You may ask us for a summary of that assessment at any time.
4. Cookies and similar technologies
We set only strictly necessary cookies by default. Analytics and preference cookies are set exclusively after you give consent through our cookie banner, and you may withdraw that consent at any moment using the “Cookie settings” link in the footer. Full detail, including a table of every cookie we use and its retention period, is set out in our Cookie Policy.
5. Who we share data with
We do not sell personal data and we do not share it for third-party marketing. We disclose data only to the following categories of recipient, each of which is bound by a written contract meeting the requirements of Article 28 UK GDPR:
- Hosting and infrastructure providers that operate the servers on which this website and our email run.
- Analytics providers, where and only where you have consented to analytics cookies.
- Professional advisers — accountants, auditors, insurers and solicitors — where they need the information to advise us.
- Payment and banking providers for the processing of invoices and receipts.
- Public authorities and law enforcement, where we are legally compelled to disclose information.
- A purchaser or successor in the event of a sale, merger or reorganisation of our business, subject to the same protections described here.
6. International transfers
Our primary hosting and storage is within the United Kingdom or the European Economic Area. Where a supplier processes data outside those territories, we ensure an appropriate safeguard is in place under Article 46 UK GDPR — normally UK adequacy regulations, or the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. You can request a copy of the relevant safeguard by writing to us.
7. How long we keep data
| Record | Retention period |
|---|---|
| Enquiries that do not become clients | 24 months from last contact, then deleted |
| Client project files and correspondence | 6 years after the end of the engagement |
| Invoices and accounting records | 6 full financial years, as required by HMRC |
| Website analytics (where consented) | 14 months, then aggregated or deleted |
| Cookie consent record | 12 months, after which we ask again |
| Marketing contact preferences | Until you opt out, plus a suppression record kept indefinitely so we do not contact you again |
8. Your rights
Under the UK GDPR you have the right to:
- be informed about how your data is used — which this notice is intended to do;
- request access to the personal data we hold about you;
- have inaccurate or incomplete data corrected;
- request erasure of your data where there is no continuing lawful reason for us to hold it;
- restrict our processing while an issue is being resolved;
- receive your data in a portable, machine-readable format, or have it transmitted to another controller;
- object to processing carried out on the basis of legitimate interests, and to direct marketing at any time and without giving a reason;
- withdraw consent at any time where consent is our lawful basis, without affecting processing already carried out.
To exercise any right, email [email protected]. We will respond within one calendar month. That period may be extended by up to two further months for complex requests, in which case we will tell you within the first month and explain why. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.
9. Complaints
If you are unhappy with how we have handled your personal data, please raise it with us first so we can put it right. You also have the right to complain to the UK supervisory authority: the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk.
10. Security
We apply technical and organisational measures appropriate to the risk, including encryption in transit (TLS) across the whole site, access control on a least-privilege basis, multi-factor authentication on business accounts, encrypted device storage, regular backups and a documented process for assessing and reporting personal data breaches to the ICO within 72 hours where the breach is reportable.
11. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you.
12. Links to other sites
This website may link to third-party sites. We are not responsible for their privacy practices and we encourage you to read the privacy notice of any site you visit.
13. Changes to this policy
We review this policy at least annually and whenever our processing changes materially. The date at the top of this page always reflects the current version. Where changes are significant we will draw attention to them on the home page for at least 30 days.
14. How to contact us
Content Elevation Ltd, Tramshed Tech, Pendyris Street, Cardiff CF11 6BH, United Kingdom. Email [email protected]. Telephone +44 29 2018 0456. Marked for the attention of the Data Protection Lead.