T’G0 Creative Data Processing Policy
Effective date: 1st January 2024
T’Go Creative is committed to handling personal information responsibly and in accordance with the UK GDPR and Data Protection Act 2018, as amended. This policy applies to personal information used in our work and handled by our staff and contractors.
1. Only use what we need
We collect and use only the personal information needed to provide our services, manage our business and meet our legal responsibilities. We use it fairly, for clear purposes and on a lawful basis, and take reasonable steps to keep it accurate.
2. Follow our clients’ instructions
When handling personal information on a client’s behalf, we follow their written instructions and keep it confidential. We do not sell that information or use it for our own marketing. We do not put client personal information into AI tools without appropriate written authorisation and safeguards.
3. Keep information secure
We use security measures appropriate to the information and risks involved. These include strong passwords, restricted access, multi-factor authentication where available, updated devices and software, secure sharing and storage, and backups where needed. Staff and contractors must keep information confidential. We review access and security regularly.
4. Share carefully
We share personal information only where necessary and lawful. Providers handling it for us must offer suitable protection and have appropriate written data protection terms. When working on a client’s behalf, we obtain the required authorisation before using another provider. Transfers outside the UK must meet applicable data protection requirements.
5. Do not keep information longer than needed
We keep personal information only for as long as needed for its purpose, agreed client requirements or legal obligations. We securely delete or dispose of it when no longer needed. At the end of client work, we follow the client’s instructions to return or delete their information, unless the law requires retention. Backup copies remain protected until deleted.
6. Deal with requests and problems promptly
We respond appropriately to requests about personal information. Requests concerning information held for a client are passed to that client promptly. Staff must report any loss, unauthorised access or disclosure immediately to the policy owner. We investigate, take steps to limit harm and notify affected clients without undue delay. We make any legally required notifications to the ICO or individuals.
7. Responsibility and contact
The policy owner is responsible for implementing this policy, helping staff understand their responsibilities and reviewing it annually or when our work changes.
Policy owner: Gary Paterson
Data protection contact: gary@tgocreative.co.uk