Privacy Policy.

This Privacy Policy explains how Hollinger Creative LTD (trading as Sprint, "we", "us" or "our") collects, uses and protects your personal data when you visit madebysprint.com (the "site"), get in touch with us, or use our client platform (the "platform"). It should be read alongside our Cookies Policy and Terms and Conditions.

We are the data controller for the personal data described in this policy. Hollinger Creative LTD is a company registered in Scotland, with its registered office at 4 Rosedale Gardens, Dumfries, UK, DG1 4LE. As a UK company, we handle personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

The personal data we collect

When you visit our site. We collect limited technical and usage information through Google Analytics, such as your approximate location, device and browser type, and the pages you view. We only collect this where you have given your consent through our cookie banner. See our Cookies Policy for details.

When you contact us. If you complete our enquiry form or email us, we collect your name, email address, and any other information you choose to include in your message.

When you use the client platform. If you hold an account, we collect the information needed to set up and run that account, such as your name, email address, company details, login credentials, and records of your activity on the platform. We also process the files and content you upload in order to deliver our services to you.

Billing information. Where you pay us for our services, payment is processed by our payment provider. We do not store your full card details ourselves.

How we use your data and our lawful bases

Under the UK GDPR we must have a lawful basis for using your personal data. The list below sets out how and why we use it.

• Responding to your enquiry, our legitimate interest in answering questions and providing quotes
• Setting up and running your platform account and delivering our services, performance of our contract with you
• Taking payment and keeping financial records, performance of our contract, and our legal obligations
• Understanding how the site is used so we can improve it (analytics), your consent
• Sending marketing emails or a newsletter, where you have signed up, your consent
• Keeping the site and platform secure and preventing misuse, our legitimate interest in protecting our business and users

Marketing communications

We plan to offer an email newsletter and occasional marketing updates. Where we do, we will only send these to you if you have opted in, and every message will include a simple way to unsubscribe. Withdrawing your consent will not affect any service you already receive from us.

Who we share your data with

We do not sell your personal data. We share it only with trusted service providers who help us run our business and platform, and who act on our instructions under contract. Depending on the services you use, these may include:

• Supabase, platform database and authentication
• Stripe, payment processing
• Google, website analytics and calendar
• Resend, sending emails
• Cloudflare, video hosting and delivery
• Dropbox, file storage
• Slack, team and client communication
• Vercel and Webflow, website and platform hosting

We may also share data where we are required to by law, or to establish, exercise or defend legal claims.

Client content and our role as a processor

Where you upload your own files and data into the platform, including any personal data relating to your customers or staff, you remain the controller of that data and we act as your processor. Our handling of that data is governed by the data processing terms in our agreement with you rather than by this policy.

QuickBooks Online integration

If you connect your QuickBooks Online account, Hollinger Creative LTD (trading as Sprint Creative Agency) accesses and processes certain data from your QuickBooks company in order to provide accounting-sync features.

What we access. With your authorisation through Intuit's secure OAuth 2.0 sign-in, we access your QuickBooks company details, customers, items (products and services), tax codes and rates, and the invoices, estimates and payments relating to the work you manage through our portal. We never receive or store your QuickBooks (Intuit) username or password.

How we use it. We use this data solely to create and update customers, invoices and estimates in your own QuickBooks company on your behalf, and to read your tax and account settings so those records are categorised correctly. We do not use QuickBooks data for advertising, and we do not sell, rent or share it with third parties. Data flows one way - from our portal into your QuickBooks company; we do not use the connection to change data back in the portal.

How we store and protect it. The tokens that authorise the connection are encrypted at rest and transmitted only over encrypted (HTTPS) connections. Access is restricted to the systems that provide the sync.

Your control. You can disconnect QuickBooks at any time from your settings. Disconnecting revokes our access at Intuit and deletes the stored connection tokens. Records already written to your QuickBooks company remain in your QuickBooks account and are governed by Intuit's own terms and privacy policy.

International transfers

Many of our service providers are based in the United States, so your personal data may be transferred outside the UK. Where it is, we make sure it is protected by an appropriate safeguard recognised under UK law, such as the UK Extension to the EU-US Data Privacy Framework, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

How long we keep your data

We keep your personal data only for as long as we need it for the purposes set out in this policy. Account and service records are kept for the duration of our relationship and for a reasonable period afterwards. Financial records are kept for as long as required by law. Enquiry messages are kept for as long as needed to deal with your query and follow up.

How we keep your data secure

We use appropriate technical and organisational measures to protect your personal data, including access controls, encryption in transit, and vetted service providers. No system can be guaranteed completely secure, but we take reasonable steps to reduce the risk of unauthorised access, loss or misuse.

Your rights

Under the UK GDPR you have the right to:

• ask for a copy of the personal data we hold about you
• ask us to correct data that is inaccurate or incomplete
• ask us to delete your data in certain circumstances
• ask us to restrict or object to how we use your data
• ask us to transfer your data to another provider where this applies
• withdraw your consent at any time, where we rely on consent

To exercise any of these rights, please contact us using the details below. We will respond within one month.

A note for visitors outside the UK

If you are based in the United States or elsewhere, your local privacy laws may give you additional rights, for example rights to access your information or to opt out of its sale or sharing under certain US state laws. Please contact us if you would like to exercise any such rights.

Complaints

If you are unhappy with how we have handled your personal data, please contact us first so we can try to put things right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office, at ico.org.uk.

Children

Our site and platform are intended for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 18.

Changes to this policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this policy.

Contact us

For any questions about this Privacy Policy or your personal data, please contact:

Hollinger Creative LTD

4 Rosedale Gardens, Dumfries, UK, DG1 4LE

Email: hello@madebysprint.com