Privacy policy

Moutrey Creative Enterprises Ltd

Master draft version 1 • Prepared 10 September 2026

Draft for factual confirmation before publication. Complete the highlighted fields and the site schedule. The implementation appendix is internal and must be removed from the public version.

1 Who we are and what this policy covers

Moutrey Creative Enterprises Ltd (we, us or our) is the controller responsible for the personal information described in this policy, unless a service-specific notice identifies another controller. A controller decides why and how personal information is used.

Company number: [INSERT COMPANY NUMBER]

Registered office and postal contact: [INSERT FULL ADDRESS]

Privacy contact: admin@moutreycreative.com

This policy covers websites and services operated by this company under Moutrey Creative and its trading names. It covers our creative and commercial work in audio, podcasts, sound design, voice recording, film and theatre; paintings, portraits and wedding painting; tuition, workshops, societies, community activities, events and retreats; and related digital products and enquiries. The website’s privacy schedule identifies its trading name, domain and operator.

It applies to visitors, enquirers, clients, purchasers, gift recipients, contributors, performers, portrait subjects, event guests, students, members, suppliers and people contacting us professionally. Only the sections relevant to your interaction apply. A coming-soon website is covered from the point it collects information, even before its service launches. We handle information under the UK GDPR, Data Protection Act 2018 and applicable Privacy and Electronic Communications Regulations, as amended, including by the Data (Use and Access) Act 2025.

A trading name is not necessarily a separate company. A separately operated company, partner organisation or independent practitioner is not automatically covered by this policy merely because it is associated with Moutrey Creative. Where another organisation controls your information, we identify it in the relevant notice and explain its role.

We use this policy alongside the privacy schedule on the relevant website and any notice supplied when you book, submit material or join a production. These notices give specific details; they do not remove your statutory rights. This policy is information about how we use data, not a request for blanket consent or a substitute for a contract, contributor release or model release.

2 Information we collect

Contact and relationship information includes your name, email, telephone number, postal address, organisation, job title, preferred contact method and the service or trading name you contacted.

Enquiry and service information includes correspondence, briefs, proposals, quotations, booking dates, locations, requirements, preferences, membership or attendance records, feedback, complaints and records of services provided. We may hold professional biographies, credits, portfolios and availability supplied by contributors or contractors.

Transaction information includes billing and delivery details, order history, invoices, payment status, refunds and payment-provider references. Where you pay through a payment provider, that provider collects the card details needed to process payment. Please do not send full payment-card details by email or in an enquiry form.

Creative material can include photographs, identifiable paintings or other images, audio and video recordings, voice notes, interview answers, transcripts, scripts, personal accounts, names, voices, likenesses, credits and permissions. Material you supply may contain information about other people.

Event and teaching information can include the purchaser, participant or guardian’s details, attendance, emergency contacts and practical arrangements. Where genuinely needed, we may request limited accessibility, health or dietary information. Some of this is sensitive information, addressed in section 6.

Website and communications information can include IP address, browser and device type, operating system, referring page, pages requested, timestamps, approximate location derived from IP address, error or security logs, cookie identifiers and consent choices. The website’s privacy and cookie schedule explains the technologies actually used and their retention periods.

We also keep records of marketing preferences, consent and withdrawal, publication permissions, rights requests and actions taken to resolve privacy concerns. We do not require all these categories from every person.

3 Where information comes from

We receive information directly when you browse, enquire, book, pay, subscribe, take part, upload material or communicate with us. We also receive it through our service providers, such as website forms, booking systems, payment platforms and email services.

Other sources may include the person buying a gift, a wedding couple, a parent or guardian, your employer, a commissioning client, a producer, a venue, a collaborator or someone making an introduction. For professional enquiries and contributor research, sources may include your organisation’s website, public professional profiles, published work and publicly available directories. We do not treat public availability as permission for unrestricted use.

If we obtain your information from someone else, we provide the relevant privacy information normally within one month, or earlier when we first contact you or disclose it, as required by law. Where a lawful exception applies, we assess and record the reason. You can ask us which source provided your information.

When giving us another person’s information, share only what is needed and make sure you have an appropriate reason to do so. Where practical, give them this policy. We remain responsible for establishing our own lawful basis; a customer cannot give blanket consent on behalf of every guest or person appearing in a photograph.

4 Why we use information and our lawful bases

We identify a lawful basis for each purpose. Contract applies only where processing is necessary for a contract with you, or steps you ask us to take before entering one. It does not automatically cover other people featured in the work. Where we rely on legitimate interests, we assess necessity and balance our interests against your rights and reasonable expectations.

Enquiries and quotations. We use contact details, correspondence and requirements to answer questions, discuss scope and prepare proposals. Our basis is pre-contract steps requested by you; for an organisation’s representative or a general professional enquiry, it is our legitimate interest in responding and developing relevant business relationships.

Orders and delivery. We use booking, creative, delivery and transaction information to provide the agreed service, manage changes and provide support. Our basis is contract with the customer. For employees of a business client, gift recipients and other necessary contacts, it is our legitimate interest in coordinating and fulfilling the service. Separate rules for subjects and contributors appear in section 5.

Business administration. We use invoices and transaction records to meet applicable accounting and tax obligations, relying on legal obligation. We use proportionate records to collect debts, manage insurance, obtain advice and establish or defend claims, relying on legitimate interests, or legal obligation where a specific duty applies.

Security and service operation. We use technical logs and limited contact information to operate our websites, prevent fraud and abuse, diagnose problems and protect people and information. Our basis is legitimate interests in secure and reliable services, and legal obligation where applicable. Device storage and access are also subject to the cookie rules in section 8.

Professional contacts and suppliers. We use professional contact details, experience, availability and correspondence to source contributors, engage suppliers and administer collaborations. Our basis is contract with an individual supplier where necessary, or legitimate interests in finding and managing suitable professional relationships.

Marketing and optional publication. We use consent for subscribed marketing and the optional publicity uses described below. Where the electronic marketing rules allow the customer soft opt-in or relevant corporate outreach, we rely on legitimate interests for the personal-data processing. Section 7 explains the limits.

Rights, complaints and permissions. We use the information needed to answer privacy requests and complaints to meet legal obligations. We retain proportionate evidence of permissions and decisions to demonstrate compliance and protect legal rights, relying on legal obligation and, where applicable, legitimate interests.

You can ask for more information about a legitimate-interests assessment and object to processing based on legitimate interests. Where required information is missing, we may be unable to quote, deliver, take payment or make a requested adjustment. We explain this when collecting it. Optional marketing and publicity choices do not determine whether you can buy our core services.

5 Creative work and participation

Audio and other productions

Productions may involve recording, editing, transcription, fact checking, crediting, distribution and promotion of interviews, performances and personal stories. Before planned participation, the project notice explains the purpose, intended audience and channels, controller, proposed lawful basis, recipients and material retention arrangements. Permission to use your performance or copyright material and the data-protection basis are related but separate matters.

When we commission your participation directly, necessary administration may rely on our contract with you. Editorial production may rely on our legitimate interests in making and distributing the specified work, after considering the effect on contributors and others. Where consent is the appropriate basis, we request it specifically. Sensitive information needs an additional condition as described in section 6.

Where a client determines the purposes and we work only on its documented instructions, we act as its processor. The client’s privacy notice governs that processing and we help it handle requests. We may separately be controller for our own accounts, professional contacts or independently determined activities. If we and another organisation jointly determine purposes, we explain the arrangement and make its essential terms available.

We do not assume that all podcasts, films or artworks qualify for a journalism or artistic exemption. Any reliance on an exemption is assessed for the particular processing and statutory conditions. An exemption is not a general reason to ignore privacy rights.

Portraits and wedding painting

We use reference photographs, sitting notes, likenesses and practical details to plan, make and deliver artwork. For a customer who is also the subject, necessary processing may rely on contract. For another subject or incidental wedding guest, we assess a specific lawful basis, such as legitimate interests in fulfilling a commission, taking account of expectations, vulnerability and the setting. Where appropriate, we obtain consent.

We minimise unnecessary background details and avoid collecting private information irrelevant to the artwork. Couples and organisers should make guests aware of planned photography or recording. Tell us before the event, or speak to us on the day, if you have concerns about being included; we will discuss practical steps.

Creating and privately delivering a commission is distinct from using it in advertising. We ask for separate, specific permission before using identifiable private-commission images, customer stories or testimonials in our portfolio, social channels or advertising. Permission covers the proposed material and channels. We do not assume that payment for a painting authorises publicity, or that a purchaser can consent for every identifiable subject.

Lessons and community activities

We use participant, membership, attendance and contact details to administer lessons, sessions and societies. Our basis is contract with the person booking, or legitimate interests in administering participation where another person books. Recording lessons or using participant images for optional publicity requires a separate explanation and, under this policy, specific permission.

For retreats and events, we share only the practical details a venue, tutor, travel or accommodation supplier needs. A provider may be an independent controller for its own booking and legal duties. We identify relevant providers in the booking information. Gift recipients receive service communications, not automatic marketing subscriptions.

6 Sensitive information and children

Health, disability, some dietary information, racial or ethnic origin, religion, political opinions, sexual orientation and other specially protected information can arise in access requests or personal stories. We collect it only where needed for a defined purpose and identify both an ordinary lawful basis and an applicable special-category condition.

For optional health or access information supplied to arrange participation, our usual approach is explicit consent. For sensitive interview content, the project notice explains the particular condition before collection or publication. In exceptional circumstances, another lawful condition may apply, such as legal claims or vital interests where the statutory requirements are met. If consent is refused or withdrawn, we discuss whether practical alternatives are available.

Ordinary photographs and voice recordings are not automatically special-category biometric data. Using them for unique identification, or deliberately processing sensitive characteristics, can trigger additional requirements. Criminal-offence information has separate restrictions; we do not solicit it in general forms and assess a specific lawful authority before processing it for a project.

For services involving children, we provide information suited to their age and understanding, involve a parent or guardian where appropriate, and take account of the child’s own rights and wishes. We collect only necessary participant and safeguarding information. A parent’s booking does not automatically authorise recording, publication or advertising use.

We seek appropriate permission for planned identifiable publicity involving children and do not knowingly target them with behavioural advertising. Where safeguarding concerns arise, proportionate information may be shared with appropriate authorities under a relevant lawful basis and additional condition where needed. A service aimed directly at children will have an appropriate additional notice and safeguards before launch.

7 Marketing and preferences across our brands

You can choose to receive news and offers about named services or clearly described groups of services. Email, text and similar marketing to individuals is sent with consent or where all requirements of the customer soft opt-in are met: we obtained your contact details directly during a sale or genuine negotiations, the messages concern our own similar products or services, and you had a clear chance to opt out both when details were collected and in every message.

An enquiry about drum lessons does not automatically sign you up for portrait, wedding or audio-production promotions. Sharing ownership does not make every service similar. Wider Moutrey Creative marketing requires a clearly explained choice covering those services.

We may send relevant business marketing to corporate subscribers where permitted, using proportionate professional contact information and legitimate interests. Sole traders and some partnerships are treated as individual subscribers. We identify ourselves, give a working opt-out route and honour objections.

Unsubscribe through a message or email admin@moutreycreative.com. Tell us if you want to stop all Moutrey Creative marketing or only a particular subscription; an unqualified request to stop all marketing will be applied across our own lists. Essential booking, payment or service messages may still be sent. We keep a minimal suppression record so you are not inadvertently added again.

We do not sell your personal information or give customer lists to sponsors or other businesses for their independent marketing. Shared administration within the same legal company is limited to relevant purposes and authorised staff. Audience-list matching, advertising pixels and optional engagement tracking are used only where specifically disclosed and supported by the necessary choices and lawful basis.

8 Cookies and website technologies

Websites may use cookies, local storage, pixels, tags and similar technologies. Some are needed to provide a requested function, remember privacy choices, support payment or protect security. Optional technologies may measure use, enable third-party media or measure and personalise advertising.

Our standard approach is to seek consent before optional analytics or advertising technologies run. Where a website instead uses a permitted statutory exception for limited statistical or appearance purposes, its schedule will identify that use and provide the required information and a simple, free way to object. Advertising tracking is not treated as necessary merely because it supports our business.

Where optional technologies are used, the website provides cookie controls to accept, reject or choose relevant categories. You can revisit Cookie settings to withdraw or change a choice. Rejecting optional technologies does not prevent basic browsing, although an optional third-party feature may remain unavailable until you choose to enable it. Where practical, an external link is provided instead.

The site’s cookie schedule identifies active technologies, providers, purposes, expiry periods and relevant data sharing. Embedded audio, video, maps and social content may allow the external provider to receive information about your visit or playback. We explain this and obtain consent where required before loading those technologies.

Choices are normally stored for the particular site and browser or device. Clearing browser storage may remove them and cause the banner to reappear. A choice on one domain does not automatically authorise tracking on every Moutrey Creative site. Linking activity across domains or sending customer lists to advertising platforms requires a specific explanation and appropriate permissions.

9 Who receives information

Access within our business is limited to people who need it for the purpose concerned. This can include authorised producers, artists, tutors and administrators. Freelancers handling data for us are subject to appropriate confidentiality and data-processing arrangements where required.

External recipients can include hosting, form and security providers; email, file storage and CRM providers; booking, ticketing, payment and accounting services; production, transcription and editing suppliers; printers, framers and couriers; venues and accommodation providers; and professional advisers, insurers, regulators or authorities where necessary and lawful.

We select recipients according to the service. The website schedule and relevant project notice name key services and describe their roles. Providers acting as processors use information under our instructions and appropriate contracts. Independent controllers, including some payment services, broadcasters and platforms, have their own privacy notices and responsibilities.

Commissioning clients, broadcasters, publishers and distributors receive project information needed for the agreed production. Sponsors ordinarily receive aggregate performance information rather than identifiable audience or customer lists. If a specific project involves another disclosure, its notice explains the recipient, purpose and basis before it happens.

Published recordings, images and credits are accessible to their intended audience and may become globally available online. Others may download, copy or redistribute them. We cannot guarantee recall of every third-party copy, but this does not remove our responsibility to consider rights requests and take steps required by law.

If ownership or assets of a business change, relevant information may be disclosed to advisers and a prospective or new operator where necessary and lawful, with confidentiality protections and notice of material changes. We do not use this as permission for unrelated marketing.

10 International transfers

Some suppliers or collaborators may store or access information outside the UK. We identify relevant destinations or provider arrangements in the website schedule or project notice. Remote access from abroad can also amount to a transfer.

Where UK transfer restrictions apply, we use an applicable UK adequacy regulation or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum to approved standard contractual clauses, together with the assessment and additional measures required. A US provider’s certification is relied on only where it is current and covers the relevant UK transfer. Any exceptional transfer route must meet its own legal conditions.

Contact admin@moutreycreative.com for details of a relevant transfer or a copy of its safeguards, subject to necessary redactions. We do not treat using a website or making a booking as blanket consent to overseas transfers.

11 How long we keep information

We retain information for its stated purpose and then delete it or make it genuinely anonymous. The following are our standard periods, subject to a specific period explained at collection and necessary legal holds. We retain only the categories needed for the remaining purpose, rather than keeping an entire project because one invoice must be retained.

Unsuccessful enquiries and quotations: normally 12 months after the last substantive contact, unless you request continued discussion or a longer period is justified and recorded.

Contracts, invoices and essential service records: normally six years after the end of the relevant financial year or the end of the contract, whichever is later, with adjustments where a specific legal obligation or claim requires them.

Unselected references, unused recordings and working files: normally up to 12 months after final delivery or the decision not to proceed. A production’s archive, funder or commissioning requirements may justify a different period, disclosed in its project notice.

Final creative works and essential permission records: for the period of authorised exploitation, distribution or documented archival need; reviewed at least annually. Limited evidence of rights and permissions may be retained afterwards where needed to establish or defend legal claims. This does not justify indefinite retention of all raw personal material.

Routine attendance and booking administration: normally 12 months after participation ends, except information required as an essential contract or accounting record. Routine access and dietary details: normally deleted within three months after the event or course ends unless an ongoing arrangement or incident requires retention.

Safeguarding and incident records: retained under a specific schedule reflecting the incident, age of the person, applicable duties, insurer requirements and relevant claim periods. They are reviewed separately from ordinary attendance records, with restricted access.

Marketing preferences: until withdrawal or an inactivity review; we review inactive subscriptions at least every 24 months. Minimal suppression records are retained while needed to respect the objection. Privacy requests and complaints: normally three years after closure, unless continuing proceedings or accountability needs require longer.

Website logs, cookie identifiers, analytics records and consent records: retained for the periods specified in the relevant site schedule. Backups expire through the documented backup cycle; deleted material is not brought back into ordinary use if a backup is restored. You can ask about the period applying to your information.

12 Security and confidentiality

We use measures proportionate to the information and risk, including restricted access, secure account authentication, appropriate device and storage protection, controlled sharing, supplier checks and secure disposal. Particularly sensitive material is shared only with those who need it. We review access when work ends or a person’s role changes.

No system is entirely risk free. If a personal-data breach occurs, we investigate, take appropriate remedial action and notify affected people and the regulator where legally required. Please contact us promptly if you think information has been lost, misdirected or accessed improperly. Avoid sending sensitive material through general website forms; ask us for an appropriate transfer method.

13 AI tools and automated decisions

Where a project uses AI-assisted transcription, editing or similar tools with personal information, its notice or supplier schedule identifies the purpose, provider, information involved and relevant retention and transfer arrangements. We assess the service before use and limit the information supplied.

Our policy is not to submit confidential customer material or identifiable participant material for a provider’s general model training, or use it to train our own general-purpose models. Voice cloning, synthetic likenesses or training for a specific project require a separate explanation and appropriate permissions before use; accepting this privacy policy is not permission for them.

We do not make decisions about you that have legal or similarly significant effects solely by automated processing. Staff remain responsible for decisions about bookings, commissions and participation. Any future introduction of significant automated decisions will require an updated notice describing the process, effects and applicable rights before it is used.

14 Your rights and withdrawal of consent

Subject to the relevant legal conditions, you can request access to your information and a copy; correction of inaccurate or incomplete information; erasure; restriction of processing; and portability of information you provided where processing is automated and based on consent or contract.

You can object to processing based on legitimate interests for reasons relating to your situation. You have an absolute right to object to use of your personal information for direct marketing, including related profiling. Where processing relies on consent, you can withdraw it at any time without affecting the lawfulness of what happened before withdrawal.

Withdrawal of publicity consent stops future consent-based use within our control, subject to any applicable legal obligations or exceptions. We assess reasonable removal steps for existing online material. A copyright licence or contributor contract does not remove your data-protection rights; conversely, withdrawing consent for one purpose does not automatically require erasure of information we must lawfully retain for another purpose.

Email admin@moutreycreative.com or write to our postal address. You do not need a special form or legal wording. We may ask for proportionate identity information or clarification if necessary. We normally respond without undue delay and within one month. Where the law allows an extension of up to two further months for complexity or multiple requests, we explain the extension and reason within the applicable initial deadline. Any lawful pause while necessary information is awaited will be explained.

Requests are normally free. If a legal exception permits refusal, restriction or a reasonable fee, we explain the decision and your complaint rights. We may need to protect other people’s information, legal privilege or legally protected expression when responding. These are assessed individually rather than applied automatically.

15 Complaints and changes

If you are unhappy with our handling of your information, email admin@moutreycreative.com, with “Privacy complaint” in the subject if convenient, or write to our postal address. Tell us what happened and how you would like us to resolve it. We can help you make a complaint in an accessible way; you do not need to use a particular format.

We acknowledge data-protection complaints within 30 days, investigate and respond without undue delay, keep you informed of progress and explain the outcome and any action taken.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority, at https://ico.org.uk/make-a-complaint/. You can contact the ICO for advice about raising a concern. Our internal process does not remove your right to complain to the regulator or seek a legal remedy.

We update this policy when our practices, services or legal requirements change. The published version states its effective date. For material changes we provide appropriate notice; if a new use requires consent, we obtain it before starting that use. Future websites can adopt this policy only after their actual processing and operator have been checked and their site schedule completed.

Published effective date: [INSERT DATE AFTER CONFIRMATION]