This policy explains how ARKA Creative collects and uses personal data through arkacreativeagency.com and in running our business. It applies when we decide why and how your personal data is used, which makes us the data controller under UK data protection law (the UK GDPR and the Data Protection Act 2018).

In this policy, "ARKA", "we", "us" and "our" mean ARKA Creative Limited, a company registered in England and Wales under company number 16167740, with its registered office at 56 Guildford Street, Chertsey, England, KT16 9BE.

This policy does not cover personal data we handle on behalf of our clients as part of client projects, for example leads collected through a client's ad campaigns. In those cases our client is the controller, and their own privacy policy applies.

You can contact us about this policy or your data at mujtaba@arkacreativeagency.com or by post to the address above

We collect only what we need to respond to you, work with you and run our business

We do not intentionally collect special category data (such as health or religious beliefs) through our website. If someone appearing in a production shares such information, we handle it only as agreed with them.

UK law requires a legal basis for each use of personal data. Ours are set out below.

Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can ask us for details of that assessment.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our advertising platforms may use your data for ad targeting, as described in section 10.

We send marketing emails only to people who have agreed to receive them, or to existing clients about services similar to those they already use. Every marketing email includes a way to unsubscribe, and you can also email us to stop them at any time.

When you submit a lead form in one of our Facebook or Instagram ads, we contact you about the enquiry you made. We will not add you to ongoing marketing unless you agree.

We never sell your personal data.

We share personal data only where needed, and only with organisations bound by contract to protect it.

If our business is sold or restructured, personal data may pass to the new owner under the same protections.

Some of your data is handled outside the UK.

• Pakistan: some of our outsourced production partners are based in Pakistan. Pakistan does not have a UK adequacy decision, so we protect these transfers with the UK International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses), plus a transfer risk assessment.

• United States: some of our software providers (such as Google, Meta, Calendly and Framer) process data in the US. We rely on the UK–US data bridge where the provider is certified under it, and otherwise on the International Data Transfer Agreement or UK Addendum.

• European Economic Area: the UK recognises EEA countries as providing adequate protection.

If we work with partners in any other country outside the UK, we protect those transfers in the same way. You can ask us for a copy of the safeguards we use.

We keep personal data only as long as we need it, then delete or anonymise it.

We may keep data longer where the law requires it, or to deal with a complaint or legal claim.

We use appropriate technical and organisational measures to protect personal data. These include two-step verification on business accounts, access limited to people who need it, confidentiality obligations on staff and contractors, and secure, reputable cloud providers. If a breach occurs that is likely to put your rights at risk, we will notify the ICO and, where required, you.

Under UK data protection law you have the right to:

• Access a copy of your personal data;

• Correct data that is inaccurate or incomplete;

• Erase your data in certain circumstances;

• Restrict how we use your data;

• Object to our use of your data, including at any time to direct marketing;

• Data portability, receiving data you gave us in a usable format;

• Withdraw consent at any time, where we rely on consent.

To use any of these rights, email mujtaba@arkacreativeagency.com. We will respond within one month, and we may ask you to confirm your identity. These rights are free to use and have some legal limits.

Complaints: please contact us first at mujtaba@arkacreativeagency.com so we can try to put things right. We will acknowledge your complaint within 30 days and respond without undue delay. If you are not satisfied, you can complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Cookies are small files a website stores on your device. We use essential cookies to make our website work, and Google Analytics cookies only to collect statistics that help us improve the site. We do not use them for advertising. You can opt out of Google Analytics at any time with Google's opt-out browser add-on, or by blocking cookies in your browser settings.

You can also block or delete cookies in your browser settings, though some parts of the site may then not work properly.