Privacy Policy
How Nebs-Creative collects, uses, shares and protects personal data.
Last updated: 8 October 2026
1. Who we are
Nebs IT Solutions Ltd, trading as Nebs-Creative is a company registered in England and Wales (company number 16128885) with its registered office at Suite A82, James Carter Road, Mildenhall, Bury St Edmunds, IP28 7DE, United Kingdom. Nebs-Creative operates from a design and development studio at 796 South Donia, Kadamtali, Dhaka 1236, Bangladesh. For the personal data described in this Privacy Notice, Nebs-Creative is generally the controller, meaning we decide why and how that data is used.
Privacy enquiries and rights requests can be sent to contact@nebs-creative.com. Our current ICO application number is C2053745.
This notice covers nebs-creative.com, enquiries and calls, sales and marketing, client relationships, and the personal data we process for our own business purposes. When we process personal data solely on behalf of a client - for example data in a client system, analytics, user-research materials or test data - the client normally acts as controller and our Data Processing Agreement applies.
2. Personal data we collect
| Category | Examples |
|---|---|
| Enquiries | Name, business email, phone or WhatsApp number, company, role, service interest, budget range, message, meeting details and files you choose to send. |
| Client and project information | Business contact details, contracts, proposals, statements of work, requirements, project communications, approvals, feedback, support records and account contacts. |
| Billing and transaction information | Billing name/address, company details, invoices, payment status, transaction references and accounting records. Full card data is handled by the payment provider where card payments are offered. |
| Website and device information | IP address, browser/device type, pages viewed, referral source and website actions, where collected through cookies or similar technologies. |
| Marketing information | Communication preferences and business contact details obtained from you or from public business sources such as company websites and LinkedIn where lawful. |
| Client-provided data | Personal data contained in systems, files, research materials or datasets that a client makes available for a project. We process this under the client agreement and DPA where we act as processor. |
Please do not send special-category, criminal-offence, children’s or other highly sensitive personal data unless it is genuinely required for the agreed services and has been expressly agreed with us in writing.
3. How we collect personal data
- Directly from you through forms, email, WhatsApp, calls, proposals, contracts, meetings and project-management channels.
- Automatically from our website through server logs, security tools, and cookies or similar technologies where permitted.
- From business platforms and public sources, including LinkedIn, Dribbble, Behance, marketplaces and company websites.
- From clients, partners and service providers where necessary to deliver a project or manage the business relationship.
4. Why we use personal data and our legal bases
| Purpose | Typical legal basis under UK GDPR |
|---|---|
| Respond to enquiries, arrange calls and prepare proposals | Legitimate interests and/or steps requested before entering into a contract. |
| Deliver design and development services, administer projects and communicate with client teams | Contract and legitimate interests in managing the client relationship. |
| Billing, bookkeeping and tax records | Contract and legal obligations. |
| Website analytics and advertising measurement | Consent where required through the cookie consent manager. |
| Business-to-business marketing | Legitimate interests where permitted; consent where applicable law requires it. Every direct-marketing message should provide an easy opt-out. |
| Security, fraud prevention, incident response and legal claims | Legitimate interests and legal obligations. |
| Improve our services and internal processes | Legitimate interests, using aggregated or minimised information where reasonably possible. |
Where we rely on consent, you may withdraw it at any time. Withdrawal does not make earlier processing unlawful.
5. Cookies and advertising technologies
We may use Google Analytics, Google Ads, Meta technologies and other tools described in our Cookie Policy. Where consent is required, optional analytics and advertising technologies are used only after you make a choice through our consent manager. You can revisit your choices through the Cookie Settings link on the website.
6. Who we share personal data with
- Authorised Nebs-Creative personnel, contractors and group companies that need the information for the relevant enquiry or project.
- Cloud, communications, design, hosting, project-management, payment, email, analytics, advertising and professional-service providers that support our operations.
- Marketplaces or platforms you choose to use when contacting or hiring us.
- Banks, accountants, insurers, lawyers, auditors and other professional advisers.
- Courts, regulators, law-enforcement authorities or other bodies where disclosure is legally required or necessary to protect legal rights.
- A buyer, investor or successor in connection with a corporate transaction, subject to appropriate confidentiality and data-protection safeguards.
We do not sell personal data for money. Some advertising technologies may, however, be treated as “sharing”, “targeted advertising” or a similar concept under certain US state laws. Where those rules apply, relevant opt-out mechanisms are provided through our cookie controls or other legally required method.
7. International transfers
Nebs-Creative serves international clients and its design and development team works from Bangladesh. Some service providers may also process data in the United States and other countries. Where applicable law requires a transfer safeguard, we use an appropriate legal mechanism, which may include an adequacy regulation or data bridge, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, the EU Standard Contractual Clauses, or another recognised mechanism. Additional contractual and technical safeguards may also be used where appropriate.
8. How long we keep personal data
| Data | Current retention position |
|---|---|
| Unsuccessful enquiries | 24 months after the last meaningful contact, unless a shorter period is required or a longer period is justified. |
| Client contracts, project records and correspondence | Normally 6 years after the project ends, subject to legal, tax, dispute and contractual requirements. |
| Invoices and accounting records | Normally 6 years after the relevant financial year, or longer if law requires. |
| Marketing preferences and suppression records | Until you opt out; we may retain a minimal suppression record so we can respect the opt-out. |
| Website analytics | [CONFIRM current Google Analytics retention setting; existing pack states 14 months]. |
| Cookies | As stated in the current Cookie Policy and consent platform. |
| Client Personal Data processed as processor | Returned or deleted in accordance with the client agreement and DPA, normally within 30 days after the relevant processing ends, subject to lawful backup and retention exceptions. |
9. Security
We use organisational and technical measures intended to protect personal data, including access controls, multi-factor authentication where supported, encrypted devices, approved systems, confidentiality commitments and restricted access based on business need. Security measures are reviewed and adjusted according to the nature of the services and information involved. No internet-connected system can be guaranteed completely secure.
10. Your privacy rights
Depending on the law that applies to you, you may have rights to access, correct, delete, restrict or object to processing; receive certain data in a portable form; withdraw consent; opt out of direct marketing, targeted advertising, sale or sharing where applicable; and complain to a regulator. Rights are not absolute and legal exemptions may apply.
To make a request, email contact@nebs-creative.com. We may need to verify your identity before acting. For UK GDPR requests, we aim to respond within the statutory period, normally one month, subject to lawful extensions.
11. Complaints
Please contact contact@nebs-creative.com first if you have a privacy concern. If UK data-protection law applies, you may also complain to the UK Information Commissioner’s Office. If another data-protection authority has jurisdiction over your complaint, you may contact that authority as well.
12. People outside the United Kingdom
If EU/EEA data-protection law, a US state privacy law, UAE, Saudi, Bangladesh or another privacy regime applies to a particular processing activity, we will handle applicable rights and obligations in accordance with that law. This Privacy Notice does not remove any mandatory rights that apply to you.
13. Children
Our website and services are primarily intended for businesses and professional users and are not directed to children. We do not knowingly offer our services directly to children. If a project requires processing children’s data, that processing must be specifically agreed and governed by appropriate client instructions and safeguards.
14. AI-assisted tools
We may use approved AI-assisted tools for activities such as ideation, drafting, coding support, documentation, testing and workflow assistance. We do not use Client Personal Data to train our own AI models, and our client DPA restricts the use of Client Personal Data in AI tools. Confidential or personal client information may only be used with an approved tool where the relevant safeguards, settings and client instructions permit it.
15. Changes to this notice
We may update this Privacy Notice to reflect changes in our services, providers, technology or legal obligations. The current version and “Last updated” date will be published on this page. Where a change materially affects an existing client relationship, we may provide additional notice.
Nebs IT Solutions Ltd, trading as Nebs-Creative
Company number 16128885 · Registered office: Suite A82, James Carter Road, Mildenhall, Bury St Edmunds, IP28 7DE, United Kingdom
Questions about this page?
Email our team and we will reply as soon as we can.
contact@nebs-creative.com