Privacy Policy

Effective date: 28 September 2026
Last updated: 29 September 2026

1. Who We Are

This Privacy Policy explains how Red And White Agency UK Limited, trading as “red&white” (“red&white”, “we”, “us” or “our”), collects and uses your personal data when you visit uk.redandwhite.agency (the “Website”), contact us, or engage us for our services.

For the purposes of UK data protection law, red&white is the “controller” of the personal data described in this Policy.

Controller: Red And White Agency UK Limited
Company number: 16185457 (registered in England and Wales)
Registered address: 3 Downsberry Road, Kingsnorth, Ashford, Kent, TN25 7EW
ICO registration number: ZC260640
Privacy contact: info@redandwhite.agency

This Policy applies to individuals in the United Kingdom. If you are located in South Africa or the United States, please refer to the Privacy Policy applicable to your region.

2. The Personal Data We Collect

We may collect and process the following categories of personal data:

(a) Information you provide, when you complete a contact or enquiry form, request a proposal, subscribe to updates, or correspond with us:

identity and contact data (name, email address, telephone number);
business data (company name, job title, website);
the content of your messages and any details you choose to share; and
marketing and communication preferences.

(b) Information we collect automatically, when you use the Website:

technical data (IP address, browser type and version, time zone, device information);
usage data (pages viewed, links clicked, referring URLs, session duration); and
cookie and similar-technology identifiers (see section 9).

(c) Information from third parties, analytics and advertising platforms, and publicly available professional sources (e.g. a company website or LinkedIn).

We do not generally collect special category data (such as data about health, race, religion, or sexual orientation) through the Website, and we ask that you do not provide it to us unless specifically requested.

3. How We Use Your Personal Data, and Our Lawful Bases

Under the UK GDPR we must have a lawful basis to process personal data. We rely on the following bases:

Purpose	Lawful basis (UK GDPR Article 6)
Respond to enquiries and provide requested information	Legitimate interests (Art. 6(1)(f)) / Steps prior to a contract (Art. 6(1)(b))
Provide, manage and improve services to clients	Performance of a contract (Art. 6(1)(b)) / Legitimate interests
Send service communications (proposals, invoices, notices)	Performance of a contract / Legal obligation (Art. 6(1)(c))
Send marketing communications (see section 4)	Consent (Art. 6(1)(a)) / Legitimate interests
Operate, secure, analyse and improve the Website	Legitimate interests
Comply with legal, tax and regulatory obligations	Legal obligation
Establish, exercise or defend legal claims	Legitimate interests

Where we rely on legitimate interests, our interest is in operating, promoting, securing and growing our business, and we balance that interest against your rights and freedoms. You can ask us for more information about this balancing exercise.

Where we process special category data (which we expect to be rare), we will identify an additional condition under Article 9 of the UK GDPR before doing so.

4. Marketing and Electronic Communications (PECR)

We will only send you electronic marketing (such as email) where:

you have consented; or
you are an existing customer, we obtained your details when you bought (or negotiated to buy) a similar product or service from us, and you did not opt out at that time (the PECR “soft opt-in”).

Every marketing message includes an easy way to opt out, and you can withdraw consent or unsubscribe at any time by using the link in the message or contacting us. We do not share your details with third parties for their own marketing without your consent.

We do not sell your personal data. We may share it with:

Processors acting on our behalf under a written contract, for example hosting, email, CRM, analytics, advertising and form providers;
Clients, where you have interacted with us in connection with a project we are delivering for them;
Professional advisers (lawyers, accountants, auditors, insurers);
Public authorities and regulators, where required by law; and
A buyer or successor, in connection with a business sale, merger or reorganisation.

6. International Transfers

Some of our processors are located outside the UK. Where we transfer personal data outside the UK, we ensure an appropriate safeguard is in place, such as:

a transfer to a country covered by UK “adequacy regulations”;
the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; or
another lawful transfer mechanism recognised under UK data protection law.

You can request a copy of the relevant safeguard by contacting us.

7. How Long We Keep Your Personal Data

We keep personal data only for as long as necessary for the purposes set out in this Policy, including to meet legal, accounting, tax or reporting requirements and to establish or defend legal claims. The criteria we use to set retention periods include the nature of the data, the purpose for which we hold it, and applicable legal requirements. When data is no longer needed, we securely delete or anonymise it.

8. Your Rights Under UK Data Protection Law

You have the following rights in relation to your personal data:

Right to be informed, about how we use your data (this Policy);
Right of access, to a copy of the personal data we hold about you;
Right to rectification, to have inaccurate or incomplete data corrected;
Right to erasure, to have your data deleted in certain circumstances (“right to be forgotten”);
Right to restrict processing, in certain circumstances;
Right to data portability, to receive certain data in a structured, machine-readable format;
Right to object, to processing based on legitimate interests, and to direct marketing at any time;
Rights relating to automated decision-making and profiling, not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects, except as permitted by law; and
Right to withdraw consent, where we rely on consent, at any time, without affecting prior processing.

You can exercise these rights by contacting us (section 11). We will respond within one month, although this can be extended by up to two further months for complex requests. Exercising your rights is free in most cases, and we may need to verify your identity before responding.

9. Cookies and Similar Technologies

The Website uses cookies and similar technologies. Under PECR and the UK GDPR, we set non-essential cookies (such as analytics and advertising cookies) only with your consent, which you can give or refuse through our cookie banner (where available). Strictly necessary cookies do not require consent. Cookie categories typically include:

Strictly necessary, required for the Website to function;
Analytics/performance, to understand and improve how the Website is used;
Functionality, to remember your preferences; and
Advertising/targeting, to deliver and measure relevant advertising.

You can manage cookies through our banner and your browser settings. Blocking some cookies may affect how the Website works.

10. Data Security and Breaches

We have appropriate technical and organisational measures in place to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These include access controls, encryption in transit where appropriate, and contractual safeguards with our processors. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the ICO (and, where required, you) in accordance with our legal obligations.

11. How to Contact Us

For any privacy question or to exercise your rights:

red&white Email: info@redandwhite.agency Post: 3 Downsberry Road, Kingsnorth, Ashford, Kent, TN25 7EW

12. Complaints to the ICO

If you have a concern about how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner’s Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Helpline: 0303 123 1113 Website: https://ico.org.uk

13. Children

The Website is not directed at children, and we do not knowingly collect personal data from children under 13 without parental consent. If you believe a child has provided us with personal data, please contact us so we can delete it.

14. Changes to This Policy

We may update this Policy from time to time. The “Last updated” date above shows when the latest changes took effect. We will notify you of material changes where appropriate.