Legal

Privacy Policy

Last updated: 5 May 2026

CT Design respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and protect personal data when you visit our website or contact us about our services.

This Policy is issued in compliance with:

The General Data Protection Regulation (Regulation (EU) 2016/679) (“EU GDPR”);
The United Kingdom General Data Protection Regulation, as incorporated into UK law by the Data Protection Act 2018 (“UK GDPR”);
Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD);
Spanish Law 34/2002 of 11 July on Information Society Services and Electronic Commerce (LSSI-CE).

1. Who We Are (Data Controller)

The data controller responsible for your personal data is:

Legal name: Carter Tro Design Limited (trading as CT Design)
Companies House registration number: 17168080
Registered office: Hillcroft Ashton Lane, Braithwell, Rotherham, South Yorkshire, S66 7AJ
Email for privacy matters: carter@ctdesign.tech
General contact: carter@ctdesign.tech

For the purposes of GDPR, CT Design acts as the data controller of personal data collected through the Website and through direct enquiries.

When CT Design processes personal data on behalf of a client (for example, when maintaining a client’s website that handles their customers’ enquiries), CT Design acts as a data processor under a separate written Data Processing Agreement with that client. This Privacy Policy concerns CT Design’s role as data controller only.

2. What Personal Data We Collect

We collect the following categories of personal data:

Data you provide directly:

Identification data: name, surname.
Contact data: email address, telephone number, WhatsApp number.
Business data: company name, role, country of operation, project requirements, budget indication.
Communication content: any information you choose to include in messages to us, in attachments (such as logos, brand documents, or briefs uploaded to our shared folders), or during calls and meetings.

Data we collect automatically when you visit the Website:

Technical data: IP address, browser type and version, device type, operating system, referring URL, pages viewed, and timestamps.
Usage data: how you interact with the Website, including page paths and time on page.

Data we receive from third parties:

Information from referrals or introductions made by mutual contacts (for example, when an existing client introduces you to us).

We do not knowingly collect special categories of personal data (such as health, religious, or political data) and we do not intentionally collect data from minors.

3. How We Use Your Personal Data and the Legal Basis

We process your personal data for the following purposes, on the following legal bases under Article 6 of the GDPR:

Purpose	Categories of data	Legal basis
Responding to enquiries you submit through the contact form, WhatsApp, or email	Identification, contact, and communication content	Article 6(1)(b) — steps taken at your request prior to entering into a contract
Preparing and sending proposals and quotations	Identification, contact, business, and communication content	Article 6(1)(b) — pre-contractual measures
Providing the contracted services and managing the client relationship	All categories	Article 6(1)(b) — performance of a contract
Sending occasional updates about CT Design services to existing clients	Identification and contact	Article 6(1)(f) — legitimate interest in maintaining client relationships, balanced against your right to object at any time
Sending marketing communications to non-clients who have opted in	Identification and contact	Article 6(1)(a) — your consent, given by an explicit opt-in (in line with Article 21 LSSI-CE)
Operating, securing, and improving the Website	Technical and usage data	Article 6(1)(f) — legitimate interest in running a secure and functional website
Complying with legal, accounting, and tax obligations	Identification, contact, and transactional data	Article 6(1)(c) — legal obligation

You can withdraw any consent at any time without affecting the lawfulness of processing carried out before withdrawal. To withdraw consent, email carter@ctdesign.tech.

4. How Long We Keep Your Personal Data

We retain personal data only for as long as necessary for the purposes set out above:

Enquiries that do not lead to a contract: up to 12 months from the last interaction, unless you ask us to delete them sooner.
Active client records: for the duration of the client relationship, plus the period required to defend potential legal claims (typically up to 6 years from the end of the relationship under English law).
Accounting and tax records: as required by United Kingdom tax law (currently 6 years from the end of the relevant accounting period).
Marketing contacts: until you withdraw your consent or unsubscribe.
Website server logs: up to 12 months.

We do not sell your personal data. We share it only with the following categories of recipient, and only where necessary:

Service providers acting on our behalf (data processors):
- Google (Google Workspace) — email and file storage.
- Vercel Inc. — website hosting and serverless infrastructure.
- GitHub, Inc. — source code management.
- WhatsApp / Meta Platforms Ireland Ltd — when you contact us via WhatsApp.
- Any web analytics provider we use, where applicable.
Each of these providers has been chosen for their privacy and security practices and is bound by a Data Processing Agreement (or equivalent) with us.
Professional advisers: accountants, lawyers, and insurers, where necessary to run the business or defend legal claims.
Authorities: where we are required to disclose personal data by law, court order, or to a competent regulator.

6. International Transfers of Personal Data

Because CT Design is established in the United Kingdom and several of our service providers are based in the United States, your personal data may be transferred outside the European Economic Area.

For transfers from the EEA:

Transfers to the United Kingdom are covered by the European Commission’s adequacy decision of 28 June 2021, which recognises the UK as providing an adequate level of data protection.
Transfers to third countries without an adequacy decision (such as some United States-based service providers) are protected by the Standard Contractual Clauses adopted by the European Commission, supplemented by additional safeguards where appropriate. Where applicable, we rely on the EU-US Data Privacy Framework certification of the recipient.

You can request a copy of the safeguards we use by emailing carter@ctdesign.tech.

7. Your Rights

You have the following rights in relation to your personal data:

Right of access — to obtain confirmation of whether we are processing your data and a copy of it.
Right of rectification — to have inaccurate or incomplete data corrected.
Right of erasure — to have your data deleted in certain circumstances (“right to be forgotten”).
Right to restriction of processing — to limit how we use your data in certain circumstances.
Right to data portability — to receive your data in a structured, commonly used, machine-readable format.
Right to object — to object to processing carried out on the basis of legitimate interest, including direct marketing.
Right to withdraw consent — at any time, where processing is based on consent.
Rights in relation to automated decision-making — we do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

To exercise any of these rights, email carter@ctdesign.tech. We will respond within one month, in line with Article 12 of the GDPR. We may need to verify your identity before acting on your request.

8. Right to Lodge a Complaint

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with a supervisory authority. You may contact:

The Spanish Data Protection Agency (AEPD) if you are based in Spain — https://www.aepd.es
The Information Commissioner’s Office (ICO) in the United Kingdom — https://ico.org.uk
The data protection authority of the EU Member State where you live or work, or where the alleged infringement took place.

We would, however, appreciate the opportunity to address your concerns first by emailing carter@ctdesign.tech.

9. Cookies

The Website uses a limited number of cookies and similar technologies. Detailed information is provided in our Cookie Policy, in line with Article 22 of the LSSI-CE and the AEPD’s published guidelines on cookies.

This Website does not currently set any cookies that require consent under the AEPD’s May 2024 guidelines or under PECR, so no cookie consent banner is shown. If we ever introduce technologies that do require consent, we will implement a compliant consent banner before any non-essential cookies are set.

10. Security

We apply appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These include encryption in transit (HTTPS), access controls on our systems, secure authentication for our service providers, and regular review of our practices.

No system is ever completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, you, in line with Articles 33 and 34 of the GDPR.

11. Changes to This Policy

We may update this Privacy Policy from time to time, for example to reflect changes in the law or in our practices. The date at the top of this page indicates when it was last updated. Material changes will be communicated through the Website or, where appropriate, by email.

12. Contact

For any question about this Privacy Policy or about how we handle your personal data, please contact us at:

carter@ctdesign.tech

Carter Tro Design Limited (trading as CT Design)
Hillcroft Ashton Lane, Braithwell, Rotherham, South Yorkshire, S66 7AJ