Legal
Privacy policy
How we collect, use, store and share your personal data. Written in plain English, kept current with UK GDPR and the Data (Use and Access) Act 2025.
01
Purposes of this policy
This Privacy Policy explains how Helmflux Ltd ("Helmflux", "we", "us", or "our") collects, uses, discloses, and protects your personal data when you interact with our website, use our client portal, subscribe to our services, or communicate with us in any way.
This Privacy Policy aims to give you information on how Helmflux collects and processes personal data:
It is important that you read this Privacy Policy together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal data about you. This Privacy Policy supplements those other notices and is not intended to replace them.
02
What we do
Helmflux is a creative subscription agency based in Bristol, UK. We provide three core services to businesses across the United Kingdom: unlimited graphic design, WordPress website development and hosting, and AI building and training. Our clients subscribe to monthly plans and submit requests through our Portal. We deliver professional creative work, build and maintain websites, and develop custom AI tools and strategies.
03
The personal data we collect about you
Personal data means any information about an individual from which that person can be identified. We may collect, use, store, and transfer the following types of personal data:
- Identity data
- Your name, job title, company name, and company size. We collect this when you submit a form on our Website, create a Portal account, or communicate with us.
- Contact data
- Your email address, telephone number, and postal address.
- Financial and transaction data
- Payment card details, billing address, and payment history. We collect and store financial transaction information when processing payments for our Services. This data is processed securely through our third-party payment provider.
- Technical data
- Your internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system type and version, and device type and version.
- Browsing data
- Traffic data, location data, weblogs, and the resources you access when you visit our Website or use our Portal. We also track frequency of access and usage patterns within the Portal.
- Analytics data
- Information about your use of our Website and Portal, such as page views, session duration, and user activity data. We use this for analytics purposes and to measure traffic and usage trends.
- Communications data
- Records of all correspondence and interactions between you and Helmflux, including emails, contact form submissions, Portal messages, call notes, and video call recordings. We may record calls or video conferences for training and quality purposes.
- Project data
- Creative briefs, brand assets, design files, website content, copy, images, login credentials for third-party platforms you provide to us, and any other materials you supply as part of our Services.
- Marketing data
- Your preferences for receiving marketing communications from us, your communication preferences, and information about what you view, click on, and access in our marketing emails.
- Cookie data
- We use cookies and similar technologies across our Website and Portal. Please see the Cookies section below for specific information.
04
How we collect your personal data
We use different methods to collect data from and about you:
Direct interactions
We collect personal data directly from you when you:
- Create a Portal account with us
- Subscribe to or use our Services
- Complete a form on our Website
- Communicate with our team via email, phone, video call, or through the Portal
- Update your communication preferences
- Provide materials for a project
We may record phone calls and video conferences for training and quality monitoring purposes.
Automated technologies
When you browse our Website or use our Portal, we automatically collect Technical Data, Browsing Data, and Analytics Data about your equipment, browsing actions, and patterns. We collect this using cookies and similar technologies. We may also receive Technical Data about you if you visit other websites that use our tracking technologies.
Third-party sources and publicly available information
- Technical Data from analytics providers such as Google
- Identity Data from publicly available business directories, company websites, and professional networking platforms such as LinkedIn
- Identity Data and Contact Data from business data providers and lead generation tools
- Financial and Transaction Data from our payment processing provider
05
Children's personal data
Our Services, Website, and Portal are designed for businesses and professionals. We do not target, market to, or knowingly collect personal data from children under the age of 18.
Access to our Portal is restricted to authorised users who have been set up with login credentials by Helmflux or by an authorised representative of the subscribing business. We do not permit individuals under the age of 18 to create Portal accounts or subscribe to our Services.
If we become aware that we have collected personal data from an individual under the age of 18 without appropriate consent, we will take steps to delete that data promptly. If you believe that someone under 18 may have provided us with personal data through our Website or Portal, please contact us at info@helmflux.co.uk.
In line with the Data (Use and Access) Act 2025 amendments to the UK GDPR, we give appropriate consideration to the higher protection needs of children when designing and implementing our data processing activities, even though our Services are not directed at children.
06
How we use your personal data
We use the personal data listed above for the following purposes:
07
Marketing and advertising
Promotional communications from us
We may process your Identity Data, Contact Data, Browsing Data, and Marketing Data to evaluate which of our Services, news, and promotions may be relevant to you. You will receive marketing communications from us if you have requested information, subscribed to our Services, or provided your details through a form on our Website, and you have either consented to or not opted out of receiving that marketing.
Third-party marketing
We will never share your personal data with any third party for their own marketing purposes. We do not sell your personal data.
Opting out
You can opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email, or by contacting us at info@helmflux.co.uk. Where you opt out, this will not apply to personal data we need to process in connection with your active subscription or delivery of our Services.
08
Our lawful bases for processing
Under the UK GDPR, we must have a lawful basis for processing your personal data. The table below sets out each processing purpose, the data types involved, and the lawful basis we rely on.
| Purpose / activity | Type of data | Lawful basis |
|---|---|---|
| To deliver our Services, manage your Portal account, and fulfil our contractual obligations | IdentityContactFinancialProjectCommunications | Performance of a contract with you |
| To process payments for our Services | IdentityContactFinancial | Performance of a contract with you |
| To communicate with you about your projects, account, and service updates | IdentityContactCommunications | (a) Performance of a contract (b) Legitimate interests (to manage our relationship with you) |
| To ensure content from our Website and Portal is presented effectively for you and your device | IdentityBrowsingTechnicalCookie | Legitimate interests (to ensure a smooth-running, customer-facing website) |
| To improve our Website, Portal, and Services | TechnicalBrowsingAnalyticsCookie | Legitimate interests (to improve our services, website performance, and user experience) |
| To send you marketing communications about our Services | IdentityContactMarketing | (a) Consent (b) Legitimate interests (PECR soft opt-in for existing clients) |
| To identify prospective clients and conduct outreach | IdentityContact | Legitimate interests (to grow our business and reach potential clients) |
| To ensure the security of our Website, Portal, and Services and to detect and prevent abuse | TechnicalBrowsing | Legitimate interests (to protect our business, prevent fraud, and maintain security) |
| To comply with legal obligations such as tax reporting and responding to lawful requests | IdentityContactFinancial | Legal obligation |
| To record calls and video conferences for training and quality purposes | IdentityCommunications | Legitimate interests (for training, quality monitoring, and record keeping) |
| To process certain cookies on your device | TechnicalCookie | (a) Consent (non-essential cookies) (b) PECR exemptions (strictly necessary and exempt analytics cookies) |
| To process information from satisfaction surveys or feedback forms | IdentityCommunications | Legitimate interests (to improve our service levels and client satisfaction) |
Recognised legitimate interests: As introduced by the Data (Use and Access) Act 2025, we may also rely on recognised legitimate interests for specific pre-approved processing activities where no balancing test is required. We will clearly identify when we rely on this basis.
Change of purpose
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will explain the legal basis that allows us to do so. We may process your personal data without your knowledge or consent where this is required or permitted by law.
10
International data transfers
Some of our third-party service providers may be based outside the United Kingdom. Where we transfer your personal data outside the UK, we ensure appropriate safeguards are in place by implementing at least one of the following:
If you would like further details about the specific safeguards we use, please contact us at info@helmflux.co.uk.
11
Data security
We have put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered, or disclosed.
These measures include encrypted data transmission (SSL/TLS), secure cloud storage with access controls, regular security reviews, and staff training on data protection.
We limit access to your personal data to those employees, contractors, and third-party providers who have a business need to access it. They will only process your personal data on our instructions and are subject to a duty of confidentiality.
Where we have given you, or you have chosen, a password that enables you to access the Portal or other parts of our service, you are responsible for keeping this password confidential. Do not share your password with anyone.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator where we are legally required to do so.
12
Data retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the processing purposes, and applicable legal requirements.
| Data type | Retention period | Reason |
|---|---|---|
| Client account and project data | Duration of subscription + 6 years | Statutory limitation periods |
| Financial and billing records | 7 years | HMRC tax and accounting obligations |
| Marketing consent records | Until consent is withdrawn | Ongoing consent management |
| Website analytics data | 26 months from collection | Analytics and service improvement |
| Enquiry and correspondence records | 2 years from last communication | Unless a business relationship is established |
| Call and video recordings | 12 months from date of recording | Training and quality monitoring |
| Portal access logs | Duration of subscription + 12 months | Security and access auditing |
In some circumstances, we may anonymise your personal data so that it can no longer be associated with you. We may use anonymised data indefinitely without further notice. When personal data is no longer needed, we securely delete or anonymise it.
14
Your legal rights
Under the UK GDPR and the Data Protection Act 2018, you have the following rights:
Right of access
Obtain confirmation of whether your data is being processed, and access that data along with processing details.
Right to rectification
Have inaccurate or incomplete personal data corrected.
Right to erasure
Request deletion of your personal data where there is no good reason for continued processing.
Right to restrict processing
Ask us to suspend processing of your personal data in certain circumstances.
Right to data portability
Receive your personal data in a structured, commonly used, machine-readable format.
Right to object
Object to processing where we rely on legitimate interests or recognised legitimate interests.
Automated decision-making
Request human intervention, contest decisions, and express your point of view where solely automated decisions produce significant effects. Helmflux does not currently make such decisions.
Right to withdraw consent
Withdraw consent at any time. This will not affect the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, please contact us at info@helmflux.co.uk. We will respond within one month. In complex cases, we may extend this by a further two months.
What we may need from you
We may need to request specific information from you to help confirm your identity and ensure your right to access your personal data or exercise your other rights. This is a security measure to ensure personal data is not disclosed to any person who has no right to receive it. We may also contact you for further information to help us action your request more efficiently.
In some cases, we may refuse to comply with, or charge a reasonable fee for, a request that is manifestly unfounded or excessive.
15
Data protection complaints
We are committed to handling data protection concerns promptly and fairly. If you believe we have not handled your personal data appropriately, you have the right to complain.
To submit a complaint, please contact us at info@helmflux.co.uk with the subject line "Data Protection Complaint". You may also write to us at 14 Beyon Drive, Cam, Gloucester GL11 5JW.
We will acknowledge your complaint within 30 days and provide a full response without undue delay.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). However, we would appreciate the chance to deal with your concerns before you approach the ICO.
Information Commissioner's Office (ICO)
Website: www.ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
16
Use of artificial intelligence
Helmflux uses AI tools internally to support process optimisation, content strategy, and internal operations. We do not input client personal data into any third-party AI system.
All creative deliverables produced by Helmflux are human-made. AI is used as an internal productivity tool only, not as a replacement for human creative work.
Where we use AI tools in ways that may involve automated decision-making with significant effects on individuals, we will ensure appropriate safeguards are in place, including transparency, the right to contest decisions, and the right to request human review.
17
Third-party links
Our Website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. We encourage you to read the privacy policy of any website you visit.
18
Changes to this privacy policy
We may change this Privacy Policy from time to time. If the changes are material, we will notify you via email or through a notice on our Website. Your continued use of the Services and our Website after the updated policy takes effect indicates your acceptance of the changes. If you do not accept the updated policy, please stop using the Services and contact us.
We recommend that you review this Privacy Policy regularly. The date at the top of this document indicates when it was last updated.
19
Data controller
Helmflux Ltd is the data controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025 (DUAA).
20
Contact us
If you have any questions, concerns, or requests relating to this Privacy Policy or our handling of your personal data, please contact us:
- Company
- Helmflux Ltd
- Address
- 14 Beyon Drive, Cam, Gloucester GL11 5JW
- info@helmflux.co.uk
- Website
- www.helmflux.co.uk
This document was last updated on 20 April 2026.