Contact

Privacy policy

Last updated: November 2026

This policy explains how Toca Creative Ltd (“Toca Creative”, “we”, “us”, “our”) collects and uses personal information when you visit tocacreative.com, get in touch with us, or work with us as a client. We’ve kept it short and in plain English. If anything is unclear, email us at hello@tocacreative.com.

1. Who we are

Toca Creative Ltd is the controller of your personal information. This means we decide how and why it is used.

Company: Toca Creative Ltd, registered in England and Wales, company number 11234427
Registered office: The Coach House, Powell Road, Buckhurst Hill, Essex, IG9 5RD
Email: hello@tocacreative.com
Phone: +44 330 057 0255
ICO registration number: ZC287800

We are a small business and have not appointed a Data Protection Officer. Questions about privacy go to hello@tocacreative.com.

2. What information we collect

When you contact us
If you use the contact forms on our website, email or call us, we collect your name, email address, company name (if you give it), and anything you tell us in your message.

When you become a client
To deliver a project or ongoing service, we collect:

contact details for you and your team (names, job titles, email addresses, phone numbers)
billing details (company name, billing address, VAT number if relevant)
project information you share with us, such as briefs, content, images and files
where you ask us to manage social media, SEO, a website, hosting or email for you, the login access or account permissions needed to do that work (for example social media accounts, website, hosting, domain and Google accounts)

Payments
We send invoices through Invoice2Go. You can pay them by bank transfer or by card through Stripe. Ongoing subscriptions (for example SEO, social media management, website hosting and maintenance, and business email hosting) are paid by recurring card payment through Stripe.

Card details are entered with Stripe and handled by Stripe. We never see or store your full card number. We receive limited payment information, such as your name, the last four digits of your card and whether a payment succeeded or failed. If you pay by bank transfer, we see the payment details that appear on our bank statement, such as the name on the account and the payment reference.

When you visit our website
Our website is built and hosted on Framer. When you visit, Framer records basic, privacy-friendly usage statistics (such as pages viewed, the type of device and browser, and the country you’re visiting from) so we can see how the site is used.

We don’t use Google Analytics at the moment. If we add it in future, it will only ever load if you agree to analytics cookies through a cookie banner, and we’ll update this policy before we do.

Our web fonts are loaded from Google Fonts, which means your browser connects to Google’s servers and shares your IP address with Google so the fonts can be delivered.

We also use Google Search Console to see how our site performs in Google search. This gives us summary data about searches and does not identify individual visitors.

When you sign up to our newsletter
If you sign up to our monthly email newsletter, we collect your email address and, if you give them, your name and company name. Our newsletter platform also tells us whether emails are delivered, opened and which links are clicked, so we can make the newsletter better.

Information from other sources
We may look up publicly available business information, such as your company website or LinkedIn profile, when responding to an enquiry.

We do not knowingly collect information from children, and our services are aimed at businesses.

3. How we use your information and our lawful bases

UK data protection law (the UK GDPR and the Data Protection Act 2018) says we must have a lawful basis for using personal information. We rely on:

Reply to your enquiry and send you a quote or proposal: Legitimate interests (responding to people who contact us), or steps before entering a contract
Deliver projects and ongoing services, including managing accounts you give us access to: Contract
Take payments, including recurring subscriptions through Stripe, and chase late payments: Contract
Keep accounting and tax records: Legal obligation
Show finished work in our portfolio and on social media (unless you asked us to keep it confidential): Legitimate interests (promoting our business), in line with our terms
Keep our website working and secure, and understand how it’s used through Framer’s statistics: Legitimate interests
Measure how people use our website with Google Analytics (not in use yet, see section 9): Consent. Google Analytics will only ever load if you agree through a cookie banner, and you can withdraw your consent at any time
Send our monthly email newsletter: Consent, if you signed up. For existing clients, legitimate interests under the “soft opt-in” rule, which lets us email you about similar services as long as you can opt out easily. You can unsubscribe at any time.
Deal with complaints or legal claims: Legitimate interests and legal obligation

We do not sell your personal information, and we do not use it for automated decision-making.

4. Who we share it with

We only share personal information when we need to, with companies that help us run our business. They act on our instructions and must keep your information secure:

Framer (website building and hosting, contact forms and website statistics). Messages sent through our contact forms are passed by Framer to our own email inbox, hosted by GoDaddy.
Stripe (card payments for invoices and subscriptions)
Invoice2Go (creating and sending invoices)
GoDaddy (our email, hello@tocacreative.com)
Google (Google Drive for file storage, Google Fonts on our website and Google Search Console)
Apple (iCloud for file storage)
Our newsletter platform (sending our monthly email newsletter). We’ll name the platform here when the newsletter launches.
Hosting and email hosting providers for client services. We host client websites with reputable hosting providers chosen for each project, such as Framer, and set up client email through GoDaddy or Google Workspace.
Freelancers who help on a project, where needed. Each one works under a contract with us that includes a non-disclosure agreement, and only gets the information they need for the work.

When we manage social media accounts for clients, the social media platforms (such as Instagram, Facebook, LinkedIn and TikTok) process data under their own privacy policies.

We may also share information if the law requires it, or to protect our rights, for example with professional advisers or the authorities.

5. International transfers

Some of our providers store or access information outside the UK. Framer is based in the European Union, and Google, Apple (iCloud), Stripe, GoDaddy and Invoice2Go are based in the United States or use servers there.

The UK recognises the European Union as giving adequate protection, so information can go there safely. For the United States, we rely on the protections set out in UK data protection law. That means either the UK–US “Data Bridge”, for companies certified under the EU–US Data Privacy Framework and its UK Extension, or the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, which these providers include in their data processing terms.

6. How long we keep it

Enquiries that don’t lead to work: 12 months after our last contact
Client details, project files and correspondence: while you’re a client and for up to 6 years after your last project with us
Invoices and payment records: 6 years from the end of the financial year they relate to, as HMRC requires
Access to client accounts (social media, website, hosting, Google): removed or handed back when the service ends
Website statistics: as set by Framer
Newsletter sign-ups: until you unsubscribe. After that, we keep your email address on a suppression list so we don’t email you again by mistake.

After this, we delete or anonymise the information securely. If you ask us to delete your details sooner, we will, unless the law requires us to keep them (for example, invoices for tax purposes).

7. How we keep it secure

We use reputable providers, strong passwords, two-factor authentication where available, and limit access to the people who need it. Passwords and client login details are kept in a password-protected file and only used for the agreed work. No system is completely secure, but we take reasonable steps to protect your information and will tell you and the ICO about a serious data breach where the law requires.

8. Your rights

You have the right to:

ask for a copy of the personal information we hold about you
ask us to correct information that is wrong or incomplete
ask us to delete your information
ask us to limit how we use it
object to us using it, including for direct marketing
ask us to transfer it to you or another organisation, in some cases
withdraw your consent at any time, where we rely on consent

Unsubscribing from our newsletter
We only send our newsletter to people who sign up, or to existing clients about similar services. Every email has an unsubscribe link, and you can unsubscribe at any time, either with that link or by emailing hello@tocacreative.com.

To use any of these rights, email hello@tocacreative.com. We’ll reply within one month. There is usually no charge.

9. Cookies

Cookies are small files saved on your device when you visit a website.

Cookies we always use
Framer’s website statistics are designed to work without cookies. Our site may use a small number of cookies it needs to work. These don’t need your consent.

Analytics cookies
We don’t use Google Analytics or any other analytics cookies at the moment. If we add Google Analytics in future, it will only ever load if you agree to it through a cookie banner, and we’ll update this policy before we do.

You can clear or block cookies in your browser settings at any time.

We do not use advertising cookies.

Our website may link to other websites and social media pages. They have their own privacy policies, and we are not responsible for how they use your information.