Privacy policy — Podcast Foundry

Who we are

Podcast Foundry is a trading name of Cardboard Creative Limited, a company registered in England and Wales. Our registered office is at:

Cardboard Creative Limited
63 The Causeway, Potters Bar, EN6 5HF
Company number: 12039844

We are the data controller for personal data collected through this website. This policy explains what we collect, why we collect it, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Questions about this policy or how we handle your data can be sent to kev@cardboardcreative.co.uk.

What data we collect

Contact form submissions

When you complete the contact form on this website, we collect your name, email address, and the content of your message. This data is submitted via Formspree, a third-party form processing service, and delivered to us by email.

Analytics data

If you accept analytics cookies, we use Google Analytics 4 to collect anonymised data about how visitors use this website. This may include:

Pages visited and time spent on each page
How you arrived at the site (referral source, search terms)
Browser type, device category, and operating system
Approximate geographic location at country and region level

IP addresses are anonymised before any data leaves your browser. We do not use analytics data to identify individual visitors.

Technical data

Our hosting provider automatically records standard server logs when you visit the site. These may include your IP address, request timestamps, and pages accessed. This data is used solely for security and operational purposes.

How we use your data

To respond to enquiries. We use your name and email address to reply and to discuss whether we can work together.
To assess project fit. The content of your message helps us understand the scope and nature of a potential project.
To improve this website. Anonymised analytics help us understand how the site is used and where it can be improved.
To maintain security. Server logs help us identify and respond to technical issues and security threats.

We do not use your data for automated decision-making or profiling. We do not sell, rent, or share your personal data with third parties for their own marketing purposes.

Legal basis for processing

We rely on the following legal bases under UK GDPR Article 6:

Legitimate interests (Article 6(1)(f)) — for processing contact form submissions. Our legitimate interest is in responding to business enquiries and assessing potential client relationships. We have assessed that this does not override your rights and freedoms, given that the processing is limited in scope and matches the purpose for which you submitted your details.
Consent (Article 6(1)(a)) — for Google Analytics cookies. You are asked for your consent when you first visit the site. You can withdraw consent at any time using the cookie preferences link in the footer.
Legal obligation (Article 6(1)(c)) — where we are required by law to process or retain certain data.

How long we keep your data

Contact form enquiries — retained for up to 24 months from the date of last contact, or for the duration of any resulting project relationship, whichever is later. After that, correspondence containing personal data is deleted unless a legal obligation requires otherwise.
Analytics data — Google Analytics retains anonymised usage data for a maximum of 14 months (the default GA4 retention period). We do not hold a separate copy of this data.
Server logs — typically retained for up to 30 days by our hosting provider for security and operational purposes.

Data sharing and processors

We share data only with the following service providers who act as data processors on our behalf:

Formspree (Formspree, Inc.) — processes and routes contact form submissions to us. Formspree maintains a Data Processing Agreement and operates under terms compliant with data protection law.
Google LLC — provides Google Analytics 4. Google processes anonymised usage data under a Data Processing Agreement with appropriate safeguards in place for international data transfers.

We do not share your personal data with any other third party unless required to do so by law or a court of competent jurisdiction.

International data transfers

Both Formspree and Google LLC are based in the United States. Personal data processed by these services may be transferred to and stored on servers outside the UK.

We ensure that appropriate safeguards are in place for any such transfers, including Standard Contractual Clauses (SCCs) and other transfer mechanisms recognised under UK data protection law. By using this website, you acknowledge that your data may be processed in countries outside the UK that may not provide an equivalent level of data protection.

Cookies

We use cookies and browser local storage in the following ways:

Consent preference — we store your cookie consent choice in your browser's local storage so we do not ask again on return visits. This is a functional necessity and does not itself require consent.
Analytics cookies — if you accept analytics, Google Analytics places cookies to track page sessions and distinguish between visits. These are only placed with your explicit consent.

We do not use advertising cookies, tracking pixels, or third-party marketing cookies. You can change your preferences at any time using the cookie preferences link in the footer of every page.

Your rights under UK GDPR

You have the following rights in relation to any personal data we hold about you:

Right of access — to request a copy of the personal data we hold about you (a Subject Access Request).
Right to rectification — to ask us to correct inaccurate or incomplete data.
Right to erasure — to ask us to delete your data where there is no compelling reason for us to continue holding it.
Right to restriction of processing — to request that we limit how we use your data in certain circumstances.
Right to data portability — where processing is based on consent or contract, to receive your data in a structured, commonly used, machine-readable format.
Right to object — to object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests and rights.
Right to withdraw consent — where processing is based on your consent, to withdraw that consent at any time without affecting the lawfulness of processing that took place before withdrawal.

To exercise any of these rights, contact us at kev@cardboardcreative.co.uk. We will respond within one calendar month. We may need to verify your identity before fulfilling a request.

Right to complain

If you believe we have not handled your personal data correctly, you have the right to complain to the Information Commissioner's Office (ICO) — the UK supervisory authority for data protection.

Submit a complaint at ico.org.uk/make-a-complaint

We would welcome the opportunity to address any concern directly before you contact the ICO. Please do reach out to us first.

Third-party links

This website contains links to external sites, including Cardboard Creative and other group brands. We are not responsible for the content or privacy practices of those sites. We encourage you to read their privacy notices before submitting any personal data.

Children's data

This website is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has submitted data through this site, please contact us immediately so we can delete it.

Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, or legal obligations. When we do, we will revise the date at the top of this page. We encourage you to review this policy periodically.

Contact

Podcast Foundry
Trading as Cardboard Creative Limited
63 The Causeway, Potters Bar, EN6 5HF
kev@cardboardcreative.co.uk