Customer Privacy Notice

Contact details

Post

Creative Industries Group Ltd, 41 Whitcomb Street, LONDON, WC2H 7DT, GB

Email

hello@wdf.me

What information we collect, use, and why

We collect or use the following information to provide services and goods, including delivery:

• Names and contact details
• Addresses
• Purchase or account history
• Payment details (including card or bank information for transfers and direct debits)
• Account information
• Website user information (including user journeys and cookie tracking)
• Photographs or video recordings
• Information relating to compliments or complaints

We collect or use the following information for the operation of customer accounts and guarantees:

• Names and contact details
• Payment details (including card or bank information for transfers and direct debits)
• Purchase history
• Account information, including registration details
• Information used for security purposes

We collect or use the following information for service updates or marketing purposes:

• Names and contact details
• Addresses
• Marketing preferences
• IP addresses
• Website and app user journey information
• Records of consent, where appropriate

We collect or use the following personal information for dealing with queries, complaints or claims:

• Names and contact details
• Account information

Lawful bases and data protection rights

Your Right of Access

You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. You can read more about this right here.

Your Right to Rectification

You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. You can read more about this right here.

Your Right to Erasure

You have the right to ask us to delete your personal information. You can read more about this right here.

Your Right to Restriction of Processing

You have the right to ask us to limit how we can use your personal information. You can read more about this right here.

Your Right to Object to Processing

You have the right to object to the processing of your personal data. You can read more about this right here.

Your Right to Data Portability

You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.read more about this right here.

Your Right to Withdraw Consent

When we use consent as our lawful basis you have the right to withdraw your consent at any time.read more about this right here.

Our lawful bases for the collection and use of your data

Services & Goods

Our lawful bases for collecting or using personal information to provide services and goods are:

• Contract

  We have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

• Legitimate Interests

  We’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

  • A website builder exists to help users create and publish websites.To function properly, websites often require essential details such as the website owner’s name, business name, or other identifying information. Without collecting this data, the website builder may be unable to publish the site or ensure it is presented correctly.
  • For both legal and practical reasons, website ownership must be clear.Collecting the user’s data ensures that:

    • The right individual has control over the website.
    • The correct person can receive support, account recovery assistance, or dispute resolution services.
    • Compliance with domain registration requirements is met, where applicable.

Operation of Customer Accounts and Guarantees

Our lawful bases for collecting or using personal information for the operation of customer accounts and guarantees are:

• Contract

  We have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

• Legal Obligation

  We have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Service Updates or Marketing Purposes

Our lawful bases for collecting or using personal information for service updates or marketing purposes are:

• Consent

  We have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

• Legitimate Interests

  We’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

  • To send service updates based on our interest in keeping users informed about important changes to our platform, such as:

    • Updates to our terms, policies, or security features.
    • New features or improvements relevant to the services users have already signed up for.
    • Technical issues, maintenance notifications, or service disruptions.

    This processing benefits users by ensuring they remain informed and can continue to use our services effectively. The impact on individuals is minimal since these updates are directly related to their use of the service, and they would reasonably expect to receive such communications. To balance our interests with users’ rights, we:

    • Only send essential service-related updates.
    • Provide clear opt-out options where appropriate (e.g., for non-critical feature updates).

Dealing with Queries, Complaints or Claims

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

• Consent

  We have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

• Contract

  We have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

  • Legal Obligation: we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
  • Legitimate interests: we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:

    • To ensure good customer service, improve our services, and resolve issues and queries such as:

      • Handling general complaints about website performance.
      • Investigating reports of misuse, fraud, or policy violations.
      • Addressing legal or reputational risks related to a complaint.

      In balancing our interests with users' rights, we ensure that:

      • Personal data is only used for the purpose of resolving the query or complaint.
      • Users can request access to or deletion of their data where appropriate.

Where we get personal information from

Primary Sources

• Directly from you
• Schools, colleges, universities or other education organisations
• Publicly available sources
• Providers of marketing lists and other personal information

Third Parties

Since some data is submitted by users rather than directly by the individuals concerned, the lawful bases for processing are: -

Legitimate Interest

We have a legitimate interest in allowing users to publish publicly available or relevant information on their websites, as this supports the purpose of the website builder - enabling users to share content such as:

• A producer listing cast members of a production.
• A business owner listing employees or partners on a company website.
• An event organiser listing speakers or performers.

We balance this interest against the rights of the individuals involved by encouraging users to ensure they have the right to share third-party data.

Public Interest

If the data being published is already public information, such as an actor's participation in a play. However, our third party users are still responsible for ensuring compliance with applicable privacy laws.

When Necessary

In cases where the information is not publicly known or its inclusion could impact the privacy of the individual, our third party users should obtain consent before publishing it. We encourage users to ensure that they have the necessary permissions before adding third-party data.

How long we keep information

We store data for as long as it is deemed necessary by the third-party users who add and manage it. Since data is added and removed by third-party users, they have control over its retention and can update or delete it as needed.

In addition to user-managed retention, we may periodically purge old, unused, or outdated data to maintain system performance, improve efficiency, and ensure data relevance. This may include:

• Removing inactive records that have not been updated for an extended period.
• Clearing outdated or inaccurate information that is no longer relevant.
• Deleting data upon request if required under applicable data protection laws.

Where legally required (e.g., for compliance, security, or fraud prevention), some information may be retained for a specific period before deletion.

Some data is added directly by users, such as information submitted by individuals who contact us. We will keep this data for as long as necessary to:

• Respond to inquiries and provide support.
• Fulfill any contractual or legal obligations.
• Maintain records for legitimate business purposes.

Once the data is no longer required, we will securely delete or anonymise it unless a longer retention period is required for legal or compliance reasons.

Who we share information with

Data Processors

• Google Firebase - Cloud Service Provider

  This data processor does the following activities for us:

  • Firebase provides user authentication services, enabling secure login and identity verification.
  • It also provides cloud storage for media files or other assets uploaded by users.

• MongoDB Cloud - Database Management Provider

  What they do for us:

  • MongoDB stores and manages all application data, including user-generated content and structured information.
  • It provides scalable and flexible NoSQL database solutions for efficient data retrieval and management.

• Vercel - Hosting & Deployment Provider

  What they do for us:

  • Vercel hosts and deploys our web applications including the Web Design For platform (https://wdf.me), your website previews and your published websites.
  • Uses Edge Computing to optimise speed and performance globally

• Google Workspace - Business Communiations

  What they do for us:

  • Google Workspace provides email hosting for business communications.

Others we share personal information with

Primary

• Professional or legal advisors
• Organisations we’re legally obliged to share personal information with
• Publicly on our website, social media or other marketing and information media
• Previous employers
• Suppliers and service providers

Third Parties

We may share the data added to our platform with third-party services that pay to access our API for their own purposes. These third parties form part of our wider network of brands and use the data in various ways that align with the intended purpose of making the information publicly available.

Legitimate Interest for Data Sharing: Since the data is added to be displayed on a website in the first place, it is reasonable to assume that users understand it will be publicly accessible., Examples of Third-Party Services That Use the Data include:

• A university may use the data to manage a list of their actor alumni, tracking their careers and showcasing success stories.,
• Websites that list upcoming productions may use the data to ensure accurate and up-to-date information about shows, cast members, and venues.
• Industry-specific job platforms may access the data to show current job openings, auditions, and crew opportunities for productions.

Nature of Data and Flexibility of Use: The data collected is entirely manipulatable, meaning it can be adapted and presented in different ways depending on the needs of each third-party service., This ensures flexibility in its application while maintaining the core principle that it was originally intended for public display.

Sharing information outside the UK

Where necessary, our data processors may share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place.

For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact us using the contact information provided above.

Google Firebase

Category of recipient:

Cloud Service Provider

Country the personal information is sent to:

US (Global)

How the transfer complies with UK data protection law:

The country or sector has a UK data bridge (also known as Adequacy Regulations)

MongoDB

Category of recipient:

Database Management Provider

Country the personal information is sent to:

US, UK, EU

How the transfer complies with UK data protection law:

Addendum to the EU Standard Contractual Clauses (SCCs)

Google Firebase

Category of recipient:

Cloud Service Provider

Country the personal information is sent to:

US (Global)

How the transfer complies with UK data protection law:

The country or sector has a UK data bridge (also known as Adequacy Regulations)

Vercel

Category of recipient:

Hosting & Deployment Provider

Country the personal information is sent to:

US (Global Edge)

How the transfer complies with UK data protection law:

Addendum to the EU Standard Contractual Clauses (SCCs)

Google Workspace

Category of recipient:

Business Communications

Country the personal information is sent to:

US (Global)

How the transfer complies with UK data protection law:

Addendum to the EU Standard Contractual Clauses (SCCs)

How to complain

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

The ICO's Address:
Information Commissioner’s Office,
Wycliffe House
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint