Privacy & Policy

1. Who We Are

DXRK Media is a creative media agency based in the United Kingdom. We provide professional videography, photography, drone footage, content creation, social media management, logo design, website development and print design services to businesses across the UK and internationally.

For UK data protection law purposes, DXRK Media is the Data Controller responsible for your personal data.

• Business: DXRK Media
• Based in: United Kingdom
• Phone / WhatsApp: +44 7961 855339

2. Our GDPR Commitment

We process personal data in accordance with the six principles of UK GDPR (Article 5). We are committed to ensuring your data is:

• Processed lawfully, fairly and transparently
• Collected for specified, explicit and legitimate purposes only
• Adequate, relevant and limited to what is necessary
• Accurate and kept up to date where reasonably possible
• Kept for no longer than necessary
• Processed with appropriate security to protect against loss, damage or unauthorised access

If you believe we have fallen short of these commitments, please contact us immediately — see Section 15.

3. Data We Collect

Contact & Identity

• Full name, business name and type
• Phone number and WhatsApp number
• Email address and business address

Communication Data

• Messages and enquiries sent via WhatsApp, email or phone
• Project briefs, feedback, approval records and scheduling information

Financial Data

• Invoice and payment records — retained for legal compliance
• We do not store full card or bank details; payments are handled by third-party processors

Technical & Usage Data

• IP address (anonymised where possible), browser type and version
• Pages visited, time on site, device type and referral source

Content & Project Data

• Images, videos and brand materials provided for project work
• Social media credentials shared for account management (stored securely)

4. How We Use Your Data

• Service delivery — on-site visits, content creation, editing and social media management
• Client communication — responding to enquiries, project updates and booking coordination
• Invoicing & payment — issuing invoices and maintaining financial records
• Contract management — fulfilling and tracking our contractual obligations
• Website improvement — understanding how visitors use our site
• Marketing — where you have given consent or we have a legitimate interest (see Section 13)
• Legal compliance — meeting applicable laws and regulations
• Portfolio use — unless you opt out in writing, we may feature your work or brand in our portfolio and social media

5. Legal Basis for Processing

Every instance of processing has a lawful basis under UK GDPR Article 6:

• Contract (Article 6(1)(b)): Processing necessary to deliver a booked service or respond to a pre-contract enquiry — e.g. conducting shoots, editing content, managing social media
• Legitimate interests (Article 6(1)(f)): Processing that serves our reasonable business interests without overriding your rights — e.g. website analytics, follow-up communications, portfolio use
• Legal obligation (Article 6(1)(c)): Processing required by law — e.g. retaining financial records for HMRC
• Consent (Article 6(1)(a)): Where you have given clear consent — e.g. marketing emails. You may withdraw consent at any time without affecting prior lawful processing.

6. Data Sharing

We do not sell, rent or trade your personal data. We may share it only in these circumstances:

• Service providers: Carefully selected third-party tools (cloud storage, invoicing platforms, communication tools). All processors are contractually bound to our instructions and UK GDPR standards.
• Social media platforms: Where we manage your accounts, we act on your behalf on Instagram (Meta), Facebook (Meta) and TikTok — each governed by their own privacy policies.
• Professional advisors: Accountants or legal advisors who hold professional confidentiality obligations.
• Regulatory/legal: Where required or permitted by law — e.g. court order, regulatory request.
• Business transfers: In any merger, acquisition or restructure, data may pass to the new entity with the same protections.

7. International Data Transfers

We serve clients internationally including the EU, USA, Switzerland, Kuwait and UAE. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place under UK GDPR Chapter V, including:

• UK adequacy decisions — transfers to countries the UK has confirmed offer adequate protection
• Standard Contractual Clauses (SCCs) — ICO-approved contractual terms binding recipients to equivalent standards

Contact us for details of safeguards for any specific transfer.

8. Cookies

Our website uses cookies — small files stored on your device — to improve functionality and understand usage patterns. We use:

• Strictly necessary: Required for basic functionality such as your dark/light mode preference. Cannot be disabled without affecting the site.
• Analytics: Understand how visitors use the site (page views, duration). Data is anonymised and aggregated where possible.
• Preference: Remember your choices (e.g. theme) for a better experience.
• Marketing: Only placed with your explicit consent.

You can manage cookies through your browser settings. Visit allaboutcookies.org for guidance. Disabling certain cookies may affect functionality.

9. Data Retention

• Active client data: Held throughout the client relationship
• Post-contract: Retained for 6 years after contract end (UK statutory limitation period / HMRC requirements)
• Enquiries (no contract): Up to 12 months from last contact
• Financial records: 6 years from end of relevant financial year (HMRC)
• Marketing data: Until you unsubscribe or we determine it is no longer relevant
• Analytics: Per the analytics platform's configured retention settings

Data no longer required is securely deleted or fully anonymised.

10. Your Rights Under UK GDPR

Under UK GDPR and the Data Protection Act 2018, you have the following rights. We will respond to all valid requests within one calendar month.

• Access (Art. 15): Request a copy of the personal data we hold about you (Subject Access Request)
• Rectification (Art. 16): Request correction of inaccurate or incomplete data
• Erasure (Art. 17): Request deletion where data is no longer necessary, consent is withdrawn or processing was unlawful — subject to legal retention obligations
• Restriction (Art. 18): Request we limit processing while accuracy or lawfulness is verified
• Portability (Art. 20): Receive your data in a portable format where processing is consent- or contract-based and automated
• Object (Art. 21): Object to processing based on legitimate interests or direct marketing — we will stop unless we have compelling overriding grounds
• Automated decisions (Art. 22): Not to be subject to solely automated decisions with significant effects. We do not use such automated processing.
• Withdraw consent: At any time, without affecting lawfulness of prior processing

To exercise any right, contact us via the details in Section 15. We may verify your identity before processing requests and will not charge a fee for reasonable requests.

If you are unhappy with our response, you have the right to complain to the Information Commissioner's Office (ICO):

11. Security

We apply appropriate technical and organisational security measures, including:

• Secure, password-protected devices and systems with restricted access
• Encrypted communications where appropriate
• Access controls — only those who need data can access it
• Regular review of data-handling practices

In the event of a personal data breach likely to risk your rights, we will notify the ICO within 72 hours (UK GDPR Article 33) and notify you directly if the risk is high (Article 34). No internet transmission is 100% secure; we cannot guarantee absolute security.

12. Children's Privacy

Our services are directed at businesses, not individuals under 13. We do not knowingly collect data from children. If you believe we have done so inadvertently, contact us immediately and we will delete the data.

13. Marketing Communications

We may send marketing communications where you have given explicit consent, or where you are an existing client and we promote similar services (the "soft opt-in" under PECR). You may opt out at any time by replying "STOP", contacting us directly, or using an unsubscribe link. Opting out does not affect service-related communications.

14. Changes to This Policy

We may update this policy to reflect changes in our practices, technology or legal requirements. The current version will always be on this page with a revised date. For significant changes that affect how we process your data, we will take reasonable steps to notify you directly.

15. Contact Us & How to Complain

For any privacy-related questions, to exercise your rights, or to raise a concern: