Privacy policy

What this Privacy Policy Covers

We are Uncovered Group Limited (company number: 11018986) (“Uncovered”, “we”, “us”), a social first creative agency. We are committed to being open and transparent about how we handle personal data.

For the purposes of UK data protection law, Uncovered is the “data controller” of personal data we collect through our website. This means we determine what we collect, how it’s used and how it is protected, as set out in this Privacy Policy (the “Privacy Policy”).

If you have any questions about this policy or how we handle your data, you can contact us at [email protected].

What personal data we collect

Our website is primarily informational. We collect personal data in two ways: (a) information you choose to provide to us when you submit an enquiry through the contact form on our website; and (b) limited data collected automatically when you visit our website.

When you submit an enquiry through our contact form, we collect your name, email address and project details (all mandatory) and, if you choose to provide it, your company name.

When you visit our website, we may collect the following data automatically:

IP address
Browser type and device information
Pages visited and general usage data
Mobile device data and operating systems (if our website is visited through your mobile)

This information is collected through:

Standard server and security logs
Google Analytics, which we use to measure page views and website traffic (see section 8 below)
Website analytics (if enabled)
Essential cookies or similar technologies

Certain information collected through our website, such as contact details submitted through forms, may directly or indirectly identify you. We use this information only for the purposes described in this Privacy Policy.

Why we collect your data

We collect your personal data for the following purposes:

Operating and securing the website
Responding to enquiries you submit through our contact form
Understanding website performance and usage
Improving the content, user experience and our services
Comply with our legal obligations

We do not currently use the details you submit through our contact form for marketing or outreach purposes. If this changes, we will update this Privacy Policy and, where required by law, ask for your consent before sending you marketing communications.

Our lawful bases for processing

We only use your personal data when we have a valid legal reason to do so under applicable data protection laws. We rely on the following lawful bases:

Legitimate interests: to operate our website securely, to respond to enquiries you send us, and to take steps at your request before potentially entering into a contract with you or your organisation.
Consent: to place non-essential analytics cookies (Google Analytics) on your device and to use the resulting data to understand how our website is used. You can withdraw your consent at any time through our cookie settings.
Legal obligation: where we need to process personal data to comply with our legal obligations.

Sharing your data

We may share your personal data with carefully selected third parties when this is necessary for our operations. We never sell your personal data. We may share your information with:

Service providers, including Cloudflare (website delivery), Sanity (content management), and SMTP2GO (contact form email delivery)
Affiliate entities
Analytics of performance tools

How long we keep your data for

We keep your personal data for as long as necessary to fulfil the purposes we collected it for, including any legal, accounting or reporting requirements. Once personal data is no longer required, we will delete it, anonymise it or store it in a form that no longer identifies you.

Contact form submissions are not stored on our website. They are delivered to our new business inbox, where we keep them for 12 months after our last communication with you, unless they become part of an ongoing business relationship, in which case we keep them for as long as needed for that relationship.

Our email provider may keep delivery logs for a limited period in line with its own retention practices.

Data Security

We take the security of your personal data seriously and use appropriate and reasonable measures to protect it from loss, misuse, unauthorised access, alteration or disclosure. These measures are designed to provide a level of security appropriate to the nature of the data we hold and the risks involved in our processing activities.

Cookies and analytics

Our website may use cookies or similar technologies to function properly and understand how visitors interact with the site. Cookies are small text files placed on your device when you visit a website. Some are essential, while others help us improve performance and user experience.

We use essential cookies for the website to function securely and correctly. They cannot be switched off and do not collect information for marketing purposes. We also use Google Analytics cookies to measure page views and website traffic. We use this information only for analytics purposes and not for advertising. We will only place Google Analytics cookies on your device if you consent through our cookie banner, and you can change your preferences at any time through our cookie settings. You can also control cookies through your browser settings at any time.

Your Rights

You have several rights over your personal data under data protection law. These include the right to:

Access the personal data we hold about you.
Correct any inaccurate or incomplete information.
Ask us to delete your personal data in certain circumstances.
Object to certain types of processing, including direct marketing.
Limit how we use your data in specific situations.
Request a copy of your data in a portable format.
Withdraw consent at any time, where we rely on consent.

If you want to exercise any of these rights, please contact us using the details below. We may need to verify your identity before responding.

International Transfers

Some of our service providers operate internationally. Cloudflare delivers our website through a globally distributed network, so technical data such as your IP address may be processed in data centres outside the UK. Contact form submissions are processed by SMTP2GO within the European Economic Area, which benefits from UK adequacy regulations. Google Analytics data may be transferred to and processed in the United States and other countries where Google operates.

Where we transfer personal data outside the UK, we take appropriate steps to ensure it is protected in accordance with applicable data protection laws. Depending on the destination country and circumstances of the transfer, this may include relying on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified) or implementing appropriate contractual safeguards, such as the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs).

Contact Us & Updates to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our activities, legal requirements, or how we handle personal data. When we make changes, we will update the ‘Last Updated’ date at the top of this page.

If you have questions, concerns or complaints, regarding this Privacy Policy or our use of your personal data, you can contact us by emailing [email protected].

We will acknowledge any complaint within 30 days of receipt and will investigate and respond without undue delay. If you remain dissatisfied, you have the right to complain to the Information Commissioner's Office (ICO).