Your information. Treated with care.

1. Introduction

Little Moo Group is committed to handling personal information lawfully, fairly, transparently and securely.

This Privacy Policy forms part of the Little Moo Group Legal Framework and applies to personal information processed by Little Moo Limited through Little Moo Group and its specialist divisions.

Our specialist divisions currently include:

• Little Moo Media;
• Little Moo Hosting;
• Little Moo Print; and
• Little Moo Connect.

Individual division websites or services may provide additional privacy information where their processing activities require further explanation.

Throughout this Policy, references to “Little Moo Group”, “we”, “our” and “us” mean Little Moo Limited unless we expressly state otherwise.

2. Who is responsible for your information

Little Moo Limited is generally the data controller responsible for deciding why and how personal information described in this Policy is processed.

Legal company

Little Moo Limited

Company number

16986790

Registered in

England and Wales

Registered office

Radcliffe House
Blenheim Court
Solihull
England
B91 2AA

ICO registration

ZC168766

Privacy contact

privacy@littlemoogroup.com

In some circumstances, Little Moo Limited may process personal information on behalf of a customer. When this happens, the customer will normally be the controller and Little Moo Limited will act as its processor under the applicable service agreement or data processing terms.

3. Who this Policy applies to

This Policy may apply to:

• website visitors;
• prospective customers;
• individual and business customers;
• customer representatives and authorised contacts;
• suppliers and professional contacts;
• people who submit enquiries or support requests;
• newsletter subscribers;
• job applicants;
• event and sponsorship contacts;
• complainants;
• and other people who interact with Little Moo Group.

This Policy does not normally explain personal information that we process solely on a customer’s documented instructions. The customer’s own privacy information should explain that processing.

4. Personal information we collect

The information we collect depends on how you interact with us and the services involved.

We may collect the following categories of information:

Identity information

• name;
• title;
• username or account identifier;
• business or organisation name;
• and information used to verify identity where necessary.

Contact information

• email address;
• telephone number;
• postal address;
• billing address;
• business address;
• and preferred communication method.

Business information

• company or trading name;
• job title or role;
• business sector;
• company number;
• website and domain information;
• and information about business requirements.

Enquiry and project information

• the services you are interested in;
• project goals and requirements;
• budget and timescale information;
• content, branding and technical requirements;
• messages, attachments and supporting documents;
• and information needed to prepare a quotation or proposal.

Customer and contractual information

• orders and services purchased;
• proposals and quotations;
• contracts and accepted terms;
• invoices and payment status;
• service history;
• customer preferences;
• and communications relating to the customer relationship.

Account and portal information

• account username;
• customer or account number;
• login and authentication records;
• account permissions;
• portal activity;
• service configuration;
• and account security information.

Payment and transaction information

• invoice details;
• payment method type;
• payment status;
• transaction references;
• refund and chargeback information;
• and financial records required for accounting.

We do not normally store complete payment card details. Card and online payments are generally processed by specialist payment providers.

Support and technical information

• support ticket content;
• technical issues and error messages;
• screenshots and diagnostic information;
• affected services, websites, domains or accounts;
• device, browser and software information;
• and records of actions taken to resolve an issue.

Website and usage information

• IP address;
• browser and device type;
• operating system;
• pages visited;
• referring website;
• date, time and duration of visits;
• cookie preferences;
• and security or access logs.

Marketing information

• marketing preferences;
• newsletter subscription status;
• communications opened or interacted with;
• interests in particular services;
• and opt-out or objection records.

Recruitment information

• CV and employment history;
• education, skills and qualifications;
• portfolio information;
• application and interview records;
• references where requested;
• right-to-work information where relevant;
• and salary or availability information.

Complaint and legal information

• details of a concern or complaint;
• supporting documents and evidence;
• investigation notes;
• responses and outcomes;
• legal correspondence;
• and information needed to establish or defend legal rights.

5. How we collect personal information

We may collect information directly from you when you:

• contact us by email, telephone or social media;
• complete a website form;
• request a quotation or consultation;
• place an Order or accept a proposal;
• create or use an account or client portal;
• submit a support request;
• subscribe to a newsletter;
• apply for a job;
• raise a complaint;
• make an event or sponsorship enquiry;
• attend a meeting or consultation;
• or otherwise communicate with us.

We may also receive information from:

• a business or organisation you represent;
• another authorised contact connected to your account;
• a customer who asks us to provide a service involving you;
• payment and fraud-prevention providers;
• website, hosting and technical platforms;
• publicly available business websites and directories;
• social media and professional networking platforms;
• suppliers and referral partners;
• and public authorities where lawful and appropriate.

Where we receive information from another source, we will provide privacy information where required and will consider whether you would reasonably expect us to use the information in that way.

6. How we use personal information

We may use personal information to:

• respond to enquiries;
• understand your requirements;
• prepare quotations, proposals and recommendations;
• take steps before entering into a contract;
• provide products and services;
• manage accounts and customer relationships;
• process orders, invoices and payments;
• provide support and investigate technical issues;
• maintain service, security and access records;
• communicate about projects, renewals and service changes;
• manage complaints and disputes;
• recruit staff and contractors;
• send lawful marketing communications;
• manage events, partnerships and sponsorship enquiries;
• improve our websites, services and processes;
• prevent fraud, misuse and security incidents;
• comply with legal, regulatory and accounting obligations;
• establish, exercise or defend legal claims;
• and protect our organisation, customers and third parties.

We will not use personal information for an unrelated purpose without first considering whether that use is lawful, fair and compatible with the original reason it was collected.

7. Our lawful bases

We must have a valid lawful basis whenever we use personal information. The basis relied upon depends on the purpose and circumstances.

Contract

We may process information where necessary to enter into or perform a contract with you.

This may include:

• responding to a service request;
• preparing an agreed quotation;
• processing an Order;
• providing Services;
• managing an account;
• and communicating about contractual matters.

Legal obligation

We may process information where necessary to comply with a legal obligation.

This may include:

• maintaining financial and tax records;
• responding to lawful authority requests;
• meeting data protection obligations;
• and complying with court orders or regulatory requirements.

Legitimate interests

We may process information where necessary for our legitimate interests or those of another person, provided those interests are not overridden by your rights and interests.

Our legitimate interests may include:

• operating and improving our business;
• responding to business enquiries;
• managing customer and supplier relationships;
• maintaining service and security records;
• preventing fraud and misuse;
• protecting our legal rights;
• understanding how our websites and services are used;
• and sending appropriate business-to-business communications.

Where we rely on legitimate interests, we consider the purpose, necessity and likely impact of the processing.

Consent

We may rely on consent where you have been given a genuine choice and have clearly agreed to a specific use of your information.

This may include:

• certain marketing communications;
• optional cookies;
• and specific uses of sensitive information where appropriate.

You may withdraw consent at any time. Withdrawing consent does not affect processing that was lawful before withdrawal.

Vital interests

In rare circumstances, we may process information where necessary to protect someone’s life.

8. Enquiries and contact forms

Our websites may provide forms for:

• general contact;
• quotation requests;
• newsletter subscriptions;
• job applications;
• complaints;
• support requests;
• account or client portal enquiries;
• event or sponsorship enquiries;
• and other forms of contact.

The information requested may vary depending on the form and the nature of your enquiry.

We normally use this information to understand and respond to your request, take requested pre-contract steps, maintain a record of the communication and identify any appropriate follow-up.

Required fields will normally be identified. If you do not provide information needed to respond or provide a requested service, we may be unable to proceed.

9. Customers and service delivery

When you become a customer, we use personal information to manage the commercial and operational relationship.

This may include:

• confirming identity and contact information;
• preparing and managing Contract Documents;
• providing Services and Deliverables;
• communicating about progress and approvals;
• managing invoicing and payment;
• providing support;
• managing renewals and cancellations;
• maintaining service and account records;
• and dealing with complaints or legal matters.

Where a customer is an organisation, we may process information about directors, employees, contractors and authorised contacts acting on its behalf.

10. Accounts and client portals

Some Services may provide access to an account, dashboard or client portal.

We may process information to:

• create and administer the account;
• authenticate users;
• manage permissions;
• provide access to services, invoices and support;
• record account activity;
• detect misuse and security incidents;
• and provide account-related communications.

You are responsible for keeping your account details current and protecting your login credentials.

11. Support requests

We process information contained in support tickets, emails, calls, screenshots and related communications to investigate and respond to support requests.

Depending on the issue, we may need access to relevant account, service, website, domain, email or technical information.

You should not send passwords or sensitive credentials through an insecure channel. Where access is required, use the secure method provided or follow our instructions.

Support records may be retained to document actions taken, improve future support, protect security and establish what was communicated or agreed.

12. Marketing and newsletters

We may send marketing communications about Little Moo Group or relevant division services where permitted by law.

Depending on the recipient and communication method, we may rely on:

• your consent;
• the limited existing-customer marketing exception;
• or legitimate interests where appropriate and lawful.

We will provide a clear method to unsubscribe or object where required.

You can withdraw consent or object to direct marketing at any time by:

• using the unsubscribe option in the message;
• emailing privacy@littlemoogroup.com;
• or contacting us using the details in this Policy.

We may keep a limited suppression record after you unsubscribe so that we can respect your preference and avoid contacting you again through the same channel.

13. Recruitment and applications

When you apply for a role, contract opportunity, placement or similar position, we may process information to:

• assess your application;
• communicate with you;
• arrange interviews;
• verify relevant qualifications or experience;
• obtain references where appropriate;
• consider reasonable adjustments;
• make recruitment decisions;
• and comply with employment and legal obligations.

Please do not provide special category or highly sensitive information unless it is relevant and reasonably required.

If your application is unsuccessful, we may retain recruitment records for a limited period to respond to queries, defend legal claims and consider you for another suitable opportunity where appropriate.

14. Events and sponsorship enquiries

Where you contact us about an event, sponsorship, partnership or community opportunity, we may process your identity, contact and organisational information together with details of the opportunity.

We use this information to assess the enquiry, communicate with relevant parties, make decisions, document agreed arrangements and manage any resulting relationship.

15. Complaints and disputes

When you raise a complaint or dispute, we may process information to:

• acknowledge and investigate the matter;
• review relevant communications and service records;
• request further information;
• communicate our findings and outcome;
• take corrective action where appropriate;
• meet legal data protection complaint-handling duties;
• and establish, exercise or defend legal rights.

Further information about our general complaints process is available in our Complaints Policy.

16. Website and technical information

When you use our websites or online systems, technical information may be processed automatically.

We may use this information to:

• deliver website content;
• maintain security;
• detect suspicious or abusive activity;
• diagnose faults;
• understand website performance;
• remember preferences;
• and improve usability and content.

Some technical logs are necessary for website operation and security. Optional analytics or similar technologies will be used in accordance with applicable consent requirements.

17. Cookies and similar technologies

Our websites may use cookies and similar technologies to support essential functionality, remember preferences, understand website use and provide integrated features.

Non-essential cookies will be used only where permitted and, where required, after you have provided consent.

You can find further information about the categories of cookies we use and how to manage them in our Cookie Policy.

18. Special category and sensitive information

We do not routinely seek special category personal information.

Special category information may include information about:

• health;
• racial or ethnic origin;
• religious or philosophical beliefs;
• political opinions;
• trade union membership;
• genetic or biometric identification;
• sex life;
• or sexual orientation.

If processing this information is necessary, we will identify both an Article 6 lawful basis and an additional legal condition for processing special category information.

Please do not send sensitive information unless it is relevant, necessary and requested through an appropriate channel.

We do not routinely process criminal conviction or offence information. Where such processing is necessary, we will ensure an appropriate legal basis and condition applies.

19. Children’s information

Little Moo Group does not knowingly sell products or services directly to anyone under the age of 18.

Our websites and general enquiry services are not intended to encourage children to provide personal information without the involvement of a parent, guardian or responsible adult.

We may occasionally process information relating to a child where it is lawfully supplied by an adult customer or organisation and is necessary for the requested Service.

If you believe a child has provided personal information to us without appropriate authority, please contact privacy@littlemoogroup.com.

20. Who we share information with

We do not sell personal information.

We may share information where reasonably necessary with:

• staff and authorised contractors;
• hosting and infrastructure providers;
• website and software providers;
• email and communication providers;
• payment and accounting providers;
• customer relationship and support platforms;
• professional advisers, including accountants and solicitors;
• production, fulfilment and delivery partners;
• fraud-prevention and security providers;
• insurers;
• regulators, courts and public authorities;
• and a buyer or successor in connection with a genuine business transaction.

We share only the information reasonably required for the relevant purpose and use contractual, technical or organisational safeguards where appropriate.

We may disclose information where required by law or where reasonably necessary to protect legal rights, safety, systems or third parties.

21. Suppliers and service providers

We use third-party providers to support the operation of our websites, communications, billing, customer services and technical infrastructure.

Where a provider processes personal information on our behalf, we require appropriate contractual terms and expect the provider to process information only for authorised purposes.

Providers may change as our systems and services develop. We review suppliers according to the nature of the service, the information involved and the risks presented.

22. International transfers

Some suppliers or technical systems may process or make personal information accessible outside the United Kingdom.

Where a restricted international transfer occurs, we will use an appropriate legal mechanism where required, such as:

• UK adequacy regulations;
• approved contractual safeguards;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved contractual clauses;
• or another lawful transfer mechanism.

Where required, we will assess whether additional safeguards are needed in the circumstances.

You may contact us for further information about safeguards relevant to your personal information.

23. Information security

We use reasonable technical and organisational measures designed to protect personal information from unauthorised access, alteration, disclosure, loss or destruction.

Measures may include:

• access controls and account permissions;
• authentication and password controls;
• encryption where appropriate;
• secure hosting and communications;
• software maintenance and security updates;
• backups and recovery processes where applicable;
• supplier assessment;
• staff and contractor confidentiality obligations;
• monitoring and logging;
• and incident response procedures.

No system can be guaranteed completely secure. You should also protect your own devices, accounts, credentials and communications.

If we identify a personal data breach, we will investigate, contain and assess it and make notifications where required by law.

24. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, regulatory, security and dispute-resolution requirements.

Retention periods vary according to:

• the nature and sensitivity of the information;
• the purpose for which it is used;
• the duration of the customer or service relationship;
• legal limitation periods;
• tax and accounting requirements;
• security and fraud-prevention needs;
• contractual obligations;
• and whether a complaint, dispute or legal claim exists.

Typical categories may be retained as follows, subject to circumstances and legal requirements:

• general enquiries that do not lead to a customer relationship: normally up to 24 months after the last meaningful contact;
• quotations and proposals: normally up to 24 months after expiry or last contact where no Agreement is formed;
• customer, contractual and financial records: normally for up to seven years after the end of the relevant financial year or relationship;
• support and technical records: for the duration reasonably required to provide support, maintain security and resolve disputes;
• unsuccessful recruitment records: normally up to six months after the recruitment process, unless a longer period is agreed or justified;
• marketing information: until consent is withdrawn, an objection is made or the information is no longer reasonably required;
• suppression records: retained as necessary to respect unsubscribe and objection requests;
• complaint records: retained for the period needed to resolve the matter and meet legal or evidential requirements;
• website security logs: retained for a proportionate period based on security and operational needs.

We may retain information for longer where necessary for an active dispute, legal claim, regulatory enquiry, fraud investigation or legal preservation requirement.

When information is no longer required, we will delete, anonymise or securely dispose of it where reasonably practicable.

25. Your data protection rights

Depending on the circumstances and lawful basis, you may have the right to:

Be informed

You have the right to receive clear information about how your personal information is used.

Request access

You may request confirmation of whether we process your personal information and obtain a copy of relevant information.

Request correction

You may ask us to correct information that is inaccurate or complete information that is incomplete.

Request erasure

You may ask us to delete personal information in certain circumstances.

Request restriction

You may ask us to restrict how personal information is used in certain circumstances.

Object to processing

You may object to certain processing based on legitimate interests and have an absolute right to object to direct marketing.

Data portability

In certain circumstances, you may ask for personal information you provided to be supplied in a structured, commonly used and machine-readable format or transferred to another controller.

Withdraw consent

Where processing is based on consent, you may withdraw that consent at any time.

Rights concerning automated decisions

You may have rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.

These rights are not absolute and may be limited by legal exemptions or the circumstances of the processing.

26. Your right to object

You have the right to object at any time to the use of your personal information for direct marketing.

When you object to direct marketing, we will stop using your information for that purpose.

You may also object to processing based on legitimate interests. We will stop the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required for legal claims.

To object, email privacy@littlemoogroup.com.

27. How to exercise your rights

To exercise a data protection right, contact:

privacy@littlemoogroup.com

Please describe the right you wish to exercise and provide enough information for us to locate the relevant records.

We may request reasonable evidence of identity before disclosing, changing or deleting personal information.

You are not normally required to pay a fee. A reasonable fee may be charged, or a request may be refused, where the law permits this because a request is manifestly unfounded or excessive.

We will respond within the applicable legal timeframe. We may extend that period where permitted for a complex request or multiple requests and will explain the extension where required.

28. Automated decision-making and profiling

Little Moo Group does not currently make decisions about individuals based solely on automated processing where those decisions produce legal or similarly significant effects.

We may use limited automation to:

• route enquiries;
• identify potentially suspicious activity;
• support website analytics;
• manage communications;
• and improve service administration.

If we introduce solely automated significant decision-making, we will provide appropriate information about the logic, likely effect and available safeguards.

29. Third-party websites and services

Our websites may contain links to or integrations with websites, platforms and services operated by other organisations.

Those organisations are responsible for their own privacy practices where they act as separate controllers.

You should review their privacy information before providing personal information or using their services.

30. Data protection complaints

If you are concerned about how we have handled your personal information, please contact us first so we can investigate and respond.

Data protection complaints may be sent to:

privacy@littlemoogroup.com

Please include:

• your name and contact details;
• a clear explanation of your concern;
• relevant dates and communications;
• the outcome you are seeking;
• and any supporting information.

We will acknowledge and investigate data protection complaints in accordance with applicable legal requirements. We may contact you for further information and will provide an outcome once our investigation is complete.

You also have the right to complain to the Information Commissioner’s Office.

Visit the Information Commissioner’s Office

We would appreciate the opportunity to address your concern before you contact the ICO, but you are not required to contact us first.

31. Changes to this Policy

We may update this Privacy Policy to reflect:

• changes in data protection law or regulatory guidance;
• changes to our websites, systems or services;
• new processing activities;
• changes to suppliers or international transfers;
• changes to our Group structure;
• and improvements to clarity or accuracy.

The latest version will be published through the Little Moo Group Legal Centre.

Where a material change significantly affects how we use existing personal information, we will provide additional notice where required.

32. Contact information

Privacy and data protection

privacy@littlemoogroup.com

General enquiries

contact@littlemoogroup.com

Telephone

0300 124 6935

Post