Privacy Policy

Last updated: 18 October 2026.

Crescat Insure is a brand of Crescat Digital Ltd. This notice covers crescat.insure.

In short

Crescat Digital Ltd is the data controller. Our Data Protection Officer is Lee Thomas, lee@crescatdigital.com.
We collect your details when you send us an enquiry, book a call, buy from us, or become a client.
Every automated email we send has an Unsubscribe link at the bottom, and most email apps can unsubscribe you in one click. Receipts and invoices from Stripe, and booking emails from Calendly, come from those companies without our Unsubscribe link.
We never sell your data and never use it to train AI models. Our website's advertising and tracking tools, if and when we switch them on for this site, load only if you accept them in our cookie banner; our cookie policy explains them.
Website enquiries that go no further are deleted after 90 days. Section 12 lists every period. If you ask us to stop contacting you, we stop (emails about something you bought still come), and keep a scrambled (hashed) copy of your address so that we never contact you again.
You can ask for a copy of your data, or ask us to correct or delete it, at any time. You can complain to us, and to the Information Commission, the UK regulator for data protection.

Contents: 1. Who we are · 2. What this notice covers · 3. Where we keep your details · 4. The data we collect · 5. How we collect it · 6. How we use it · 7. Our emails, and how to stop them · 8. Cookies · 9. Who we share it with · 10. International transfers · 11. Security · 12. How long we keep it · 13. Your rights · 14. Complaints · 15. Changes to this notice · 16. Glossary

1. Who we are and how to contact us

Crescat Digital Ltd ("Crescat Digital", "we", "us") is the controller of your personal data. Company number 09369289, registered in England and Wales. Registered office: Unit 2 The Bramley Business Centre, Station Road, Bramley, Guildford, Surrey GU5 0AZ.

Our Data Protection Officer is Lee Thomas. Contact him with any question about this notice or to exercise your rights:

Email: lee@crescatdigital.com (or hello@crescatdigital.com)
Post: Crescat Digital Ltd, Unit 2 The Bramley Business Centre, Station Road, Bramley, Guildford, Surrey GU5 0AZ

If you are unhappy with how we have handled your data, section 14 explains how to complain to us and to the Information Commission, the UK regulator for data protection.

2. What this notice covers

This notice explains how we collect and use personal data when you:

send us an enquiry from this website, book a call with us, or talk to us at an event;
ask us for a quote or proposal, or become a client;
use this website, or ask for our emails.

Our website is for businesses. It is not intended for children and we do not knowingly collect data about children.

We may give you a separate notice when we collect data for a specific purpose. That notice adds to this one; it does not replace it.

Our site links to other websites and services. We do not control them and are not responsible for their privacy practices. Read their notices before you share data with them.

3. Where we keep your details

These services hold some of your details, for one job each:

Microsoft 365 hosts our email, including hello@crescatdigital.com and our staff mailboxes. When you send a form on our website, our website emails us about it through Resend. The email carries the whole enquiry and is our record of it. Your replies to our emails, and any email you send us, also arrive in Microsoft 365.
Calendly holds the calls you book with us through our calendar.
Stripe holds your payments.
Resend sends our emails. If you ask for our marketing emails, Resend also keeps you on the list they are sent to, and takes you off it when you unsubscribe.

4. The data we collect about you

Personal data means information that can identify you. It does not include anonymous data. We collect these kinds:

Identity data: your name, job title or role and the firm you work for.
Contact data: email address, telephone number, and postal or invoicing address.
Financial data: payment card details, handled by Stripe, and bank details for invoiced work.
Transaction data: details of payments and services you have bought from us.
Enquiry data: what you tell us in a form, an email, a call or a meeting, and where our conversations about working together have got to, such as a call booked or a proposal sent.
Permission data: the permissions you gave or refused, the exact words you saw, where and when; your requests to stop contacting you; and whether an email to you bounced or was marked as spam.
Source data: how you heard about us, if you tell us; and the page you sent a form from.
Technical data: IP address, browser type and version, device and operating system, and how you reached our site.
Usage data: how you use our website and services.
Marketing and communications data: your marketing preferences and how you have responded to our emails.

We also use aggregated data. It is derived from personal data but cannot identify you, so it is not personal data in law. If we ever combine it with personal data, we treat the result as personal data.

We do not ask for special categories of personal data (such as health, religion, politics or sexuality) or data about criminal convictions.

Where we need data to perform a contract with you and you do not provide it, we may not be able to provide the service. We will tell you if that is the case.

5. How we collect your data

Directly from you: when you fill in a form on this website, book a call, email or phone us, give us your details at an event, contact us on LinkedIn, sign a contract or buy from us.
Automatically: technical and usage data through cookies, server logs and similar technologies when you use our website. The tools on our website that are not strictly necessary collect it only with your consent. See section 8.
From the companies that provide services to us: Calendly (the calls you book), Stripe (payments), CallTrackingMetrics (calls to our tracking numbers, if and when we switch it on for this site), and analytics, advertising and visitor-identification providers (technical data, only if you accept them in our cookie banner).

6. How we use your personal data, and the law that allows it

We only use your data when the law allows it. Most often that is because:

you have asked us to do something, or we are performing a contract with you;
it is in our legitimate interests, and your interests and rights do not override them;
we must comply with a legal obligation;
you have given your consent.

We rely on consent for two things: sending you marketing emails, and the advertising and tracking tools and the map on our website. You can withdraw any of them at any time.

Purposes and lawful bases

Purpose	Type of data	Lawful basis
Answer your enquiry, whether it reaches us through our website, by email, by phone or at an event	Identity, Contact, Enquiry, Source	Steps taken at your request before a contract; legitimate interests (answering the people who contact us)
Book a call with you through the calendar on our website, which Calendly provides for us, and prepare for it	Identity, Contact, Enquiry, Technical	Steps taken at your request before a contract; legitimate interests (preparing for the call you booked)
Keep track of where our conversations about working together have got to, prepare proposals and record the outcome	Identity, Contact, Enquiry	Steps taken at your request before a contract; legitimate interests (running our sales)
Send you our occasional marketing emails	Identity, Contact, Marketing and communications	Consent, given by telling a member of our staff, who records it with a note of what you were asked and what you said. Withdraw it at any time (section 7)
Register you as a client and deliver our services	Identity, Contact	Performance of a contract with you
Manage payments, fees and money owed to us	Identity, Contact, Financial, Transaction	Performance of a contract; legitimate interests (recovering debts)
Manage our relationship, including notices about changes to our terms or this notice, and asking for reviews or feedback	Identity, Contact, Marketing and communications	Performance of a contract; legal obligation; legitimate interests (keeping records up to date)
Find out which of our marketing brings enquiries and clients: how you heard about us and the stages your enquiry reached	Source, Enquiry, Usage	Legitimate interests (knowing which of our marketing works, so we spend on what helps firms find us). We do not send the details we keep to Google, LinkedIn or any other advertising company. If you accept Advertising and tracking in our cookie banner, the tools it loads read the page's address, tags included, when they count a visit.
Keep a record of the permissions you gave or refused, and of your requests to stop, so we respect them and can show that we have	Permission	Legal obligation (to show consent was given, and to respect objections to direct marketing); legitimate interests
Run and protect our business and websites: troubleshooting, testing, security, hosting and reporting, and keeping spam out of our forms	Identity, Contact, Technical	Legitimate interests (running the business, security, preventing fraud); legal obligation

Marketing and measurement tools

Purpose	Type of data	Lawful basis	Providers
Measure how our website is used and improve it	Technical, Usage. Contact details you type into our forms, which Google receives in scrambled (hashed) form	Consent: Advertising and tracking in our cookie banner. Withdraw it at any time in Cookie settings	Google Analytics, if and when we switch it on for this site
Send email marketing about our services and content	Identity, Contact, Marketing and communications	Consent only. You can opt out with the unsubscribe link in any email or by contacting us. We keep a record of your consent, with the exact words you saw and when	Resend
Measure our adverts and show them to people who have visited our website	Technical, Usage. Contact details you type into our forms, which Google receives in scrambled (hashed) form	Consent: Advertising and tracking in our cookie banner. Withdraw it at any time in Cookie settings	Google Ads, LinkedIn (the LinkedIn Insight Tag) and OpenAI (its pixel for our ChatGPT adverts), if and when we switch them on for this site
Track which marketing brought in each phone call	Contact, Technical, Usage	Consent: Advertising and tracking in our cookie banner. Withdraw it at any time in Cookie settings. Your number is recorded when you call and is not used for anything else without your permission	CallTrackingMetrics, if and when we switch it on for this site
Work out which organisations visit our website and which pages they view. If you browse from home or a small office, the result may point to you rather than to an organisation	Technical, Usage	Consent: Advertising and tracking in our cookie banner. Withdraw it at any time in Cookie settings	Lead Forensics, which calls Demandbase, LiveIntent and a service at a.usbrowserspeed.com, if and when we switch it on for this site
Show our office on a map	Technical	Consent: pressing Show map, for that one map	Google Maps
Link to our company page on LinkedIn	None until you press the link	Not needed: it is a plain link, and LinkedIn receives nothing from our pages until you press it. LinkedIn's own notice applies on its site	LinkedIn

We do not upload your details to Google, LinkedIn or any other advertising platform so that they can show you our adverts.

Change of purpose

We only use your data for the purpose we collected it for, or for a compatible purpose. If we need it for something unrelated, we will tell you and explain the lawful basis. We may process your data without your knowledge where the law requires or allows it.

7. Our emails, and how to stop them

7.1 The emails we send

Emails about something you asked for or bought: receipts and our answer to your enquiry. These come while you use the service. Opting out of marketing does not stop them. We stop only if an email to you bounces or you mark one as spam. Either lifts if you tell us the address works again, or that you want our emails again (section 12).
Marketing emails: our occasional emails about winning clients online. You get them only if you ask a member of our staff for them.

If two years pass with no activity from you, we ask you once whether you still want our marketing emails. If you do not answer, we stop sending them, and delete your details unless we need them for another reason in section 12.

7.2 How to stop them

Press Unsubscribe at the foot of the email. It opens a page that asks you to confirm with one button. We act only when you press it, so a security scanner that opens every link in an email never unsubscribes you.
Use your email app's own unsubscribe button, if it shows one. Our emails carry the standard one-click unsubscribe, so Gmail, Yahoo and other apps can unsubscribe you without opening a page.
Reply "no thanks" or "unsubscribe" to any email from us, or email hello@crescatdigital.com or lee@crescatdigital.com.
Tell any member of our staff, by phone or in person. They record it straight away.

When you unsubscribe or object, your email address goes on our suppression list: one list that every email we send is checked against, whatever the reason for it. We keep only a scrambled (hashed) form of the address, never the address itself, so that we can recognise it if it reaches us again, from any source, and not write to you. Staff can also add a phone number, a firm's web domain or a postal name and postcode to the list in the same form. A hashed entry still counts as personal data. We keep it indefinitely, because its only use is to make sure we do not contact you again.

Unsubscribing stops our marketing emails and any email offering our services. It also withdraws any consent you gave to our marketing emails, so that consent no longer keeps your details (section 12), and takes you off our mailing list at Resend if you were on it. It does not stop emails about something you bought. The unsubscribe page says so before you confirm.

We do not share your data with anyone outside Crescat Digital for their marketing without your consent. If you accept Advertising and tracking in our cookie banner, Google, LinkedIn, OpenAI, LiveIntent and Demandbase receive details of your visits to our website, if and when we switch those tools on for this site, and also use them for their own purposes, such as advertising. Our cookie policy explains this.

8. Cookies and similar tools

Our website asks for your consent, in our own cookie banner, before it uses cookies and similar tools that are not strictly necessary. Advertising and tracking, if and when we switch it on for this site, loads Google Analytics, Google Ads, the LinkedIn Insight Tag, CallTrackingMetrics, and Lead Forensics with the services it calls (Demandbase, LiveIntent and a service at a.usbrowserspeed.com), and our own code loads OpenAI's pixel for our ChatGPT adverts. Nothing from them loads until you accept it. The map loads only when you press Show map, and a note under it says so. You can change your choice at any time with Cookie settings, at the foot of every page.

For anything about cookies, see our cookie policy. It lists the cookies and similar tools we know of on this website, who sets each one, what it does, how long it lasts and how to control it.

The booking calendar on our Book a call page is provided by Calendly and runs inside our page. Calendly asks for your consent in its own banner inside the calendar; our banner does not cover it. Calendly sets its own cookies in it to make booking work and keep it secure, and, only if you choose Accept all in its banner, to measure how the calendar is used and for marketing. You can change that choice with Cookie settings at the foot of the calendar. Calendly's privacy notice explains them.

Our emails carry no tracking pixels: open and click tracking is switched off at Resend, which sends them.

We share personal data with the providers named in sections 3 and 6, and with:

service providers who host our systems, send our emails, take payments and support our services. Vercel hosts our website at crescat.insure and sees the technical data of every request, such as your IP address, including the forms you send. Microsoft hosts our email;
professional advisers, such as lawyers, bankers, auditors and insurers;
HM Revenue & Customs, regulators and other authorities where the law requires it;
a buyer or merger partner if we sell or restructure our business. They may use your data only as set out in this notice.

We require every provider that processes data for us to keep it secure and to process it only on our instructions, and we do not allow them to use it for their own purposes.

Some of the companies we use are not only our providers: they also use what they collect for their own purposes, as their own notices explain. They are Google (Google Analytics with Google signals, and Google Ads), LinkedIn, OpenAI (through its pixel for our ChatGPT adverts), LiveIntent and Demandbase, which receive data only if you accept Advertising and tracking, and only if and when we switch those tools on for this site; in part, Calendly; and Stripe, for fraud prevention and its own legal duties. Our cookie policy names the website tools and links to their notices.

10. International transfers

Some of our providers are outside the UK, mainly in the United States: among them Resend, Calendly, Stripe, Vercel and Cloudflare. Whenever we transfer your data out of the UK we make sure it has protection equivalent to UK law, by one of these routes:

the country has UK adequacy regulations, such as the European Economic Area;
the provider is certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US "data bridge");
we use the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

11. Security

We use appropriate technical and organisational measures to stop your data being lost, misused, accessed without authority, altered or disclosed. Access is limited to people who need it for their work, and they must keep it confidential. In particular:

our suppression list holds only scrambled (hashed) values.

We have procedures for suspected data breaches and will tell you and the regulator where the law requires it.

12. How long we keep your data

We keep personal data only as long as we need it for the purpose we collected it, including legal, accounting and reporting requirements. When deciding how long, we consider how sensitive the data is, the risk of harm if it were misused, and whether we can achieve the purpose another way.

If more than one row below applies to you, the longest period applies to your contact details.

Your situation	What we keep	How long
You sent us an enquiry, from our website or at an event, and it went no further	Your details and your enquiry	90 days after the enquiry
We are talking about working together	Your details, your bookings and our notes	While the conversation is open. If you had a call with us and did not go ahead, 12 months after we close the conversation, in case you come back to it. If the conversation closes before any call takes place, 90 days after it closes
You are, or were, a client	Identity, contact, financial and transaction data	While you are a client, and six years after the relationship ends, for tax and to deal with any claim
You asked for our marketing emails	Your details and your consent	Until you unsubscribe. After two years with no activity from you, we ask you once whether you still want them. If you do not answer, we stop and delete your details (section 7.1)
You unsubscribed, objected, or asked us not to contact you	A scrambled (hashed) form of your email address, phone number, firm's web domain or postal name and postcode, with why and when it was added; never the address or number itself	Indefinitely, so we never contact you again (section 7.2). The rest of your record follows the other rows
Records of the permissions you gave or refused, and of your objections	What each one was for, yes or no, the exact words you saw, where, when and how you gave it, and the member of staff who recorded it if one did, under a scrambled (hashed) form of your email address. A note our staff wrote about it is deleted with the rest of your record	Indefinitely, even after the rest of your record is deleted, so that a refusal or an objection still counts if your address reaches us again. If you ask us to delete your data, a consent you gave loses the hashed address; a refusal or an objection keeps it
An email to you bounced or was marked as spam	That it happened, and when, under a scrambled (hashed) form of your email address. The message from the receiving mail server, which can quote your address, is deleted with the rest of your record	Indefinitely, so that we do not keep writing to an address that does not work, or to someone who complained. Our staff can lift either once you tell us the address works again, or that you want our emails again. The record that it happened stays

Copies held elsewhere follow the same periods where we control them:

Emails in our Microsoft 365 mailboxes about a website enquiry: 90 days, unless the enquiry goes further, when they are kept with the rest of our conversation.
Bookings in Calendly: deleted 90 days after the call.
Resend keeps a log of each email it sends, including the address, for 30 days.
Stripe keeps its own payment records under its own legal duties.

In some cases we anonymise data for research or statistics, so it can no longer be linked to you. We may keep anonymised data indefinitely.

13. Your legal rights

Under UK data protection law you have the right to:

Access the personal data we hold about you (a "subject access request"). We can give you everything in our records about you in one file.
Correct data that is inaccurate or incomplete.
Erase your data where there is no good reason for us to keep it. We may have to keep some data for legal reasons, such as a purchase record for tax, and will tell you if so. If you also ask us not to contact you again, we keep the hashed entry described in section 7.2, because without it we could not keep that promise. Any refusal or objection you made before, and any bounce or spam report, is kept in the same hashed form (section 12), so that it still counts if your address reaches us again.
Object to processing based on legitimate interests, and to direct marketing at any time. An objection to direct marketing always stops it.
Restrict processing while a question about accuracy, lawfulness or a legal claim is resolved.
Transfer data you gave us to you or another provider, in a machine-readable format, where we process it by automated means under consent or a contract.
Withdraw consent at any time, without affecting what was done before. For our emails, see section 7.2. For the tools on our website, use Cookie settings at the foot of any page.

We do not make decisions about you by automated means that have legal or similarly significant effects. Our forms refuse entries that look like spam by simple rules; if yours is refused by mistake, phone or email us.

To exercise any right, email lee@crescatdigital.com. There is no fee, unless a request is clearly unfounded, repetitive or excessive. We may ask for information to confirm your identity. We respond within one month; if a request is complex we will tell you and keep you updated.

14. Complaints

If you are unhappy with how we have handled your personal data, please tell us first. Email lee@crescatdigital.com, or write to us at the address in section 1. Say what happened and what you would like us to do. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.

You can also complain at any time to the Information Commission, formerly the Information Commissioner's Office (ICO). It is the UK regulator for data protection. Its website is ico.org.uk and its helpline is 0303 123 1113. You can complain to it online at ico.org.uk/make-a-complaint.

15. Changes to this notice

We update this notice when we change what we collect, why, or who handles it. The date at the top shows when we last changed it. If a change affects how we use details you have already given us, we will tell you by email before it takes effect.

16. Glossary

Legitimate interests means our interest in running our business well and giving you a good, secure service. We weigh any impact on you and your rights before relying on it, and do not use it where the impact on you would outweigh our interest.
Performance of a contract means processing needed to deliver a contract with you, or to take steps you ask for before entering one.
Legal obligation means processing needed to comply with a law or regulation we are subject to.
Consent means a clear yes from you, such as ticking a box that is never ticked for you. You can withdraw it at any time.
Suppression list means our list of people who have asked us not to contact them, which every email we send is checked against.
Hashed means scrambled by a one-way calculation. We can tell whether an address we are about to use matches a hashed one, but cannot turn the hash back into the address.
Processor means a provider that handles data on our behalf and on our instructions.