Privacy Policy
Last updated: 21 April 2026
1. Introduction
This Privacy Policy explains how Creativemark (“we”, “us”, “our”) and the relevant Seller process your personal data when you use the Creativemark marketplace and checkout service (the “Platform”). We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and, where applicable, the EU General Data Protection Regulation (EU GDPR).
2. Data controller
Creativemark is the data controller for personal data processed through the Platform. Where a Seller processes your data independently (for example, for their own marketing), the Seller acts as an independent data controller for that processing.
3. Personal data we collect
| Category | Data | Source |
|---|---|---|
| Identity and contact | Full name, email address | You, at checkout |
| Billing information | Billing address, country, company name (optional), VAT/tax number (optional) | You, at checkout |
| Transaction data | Items purchased, order amounts, currency, discount codes, tax calculations, payment status | Generated during purchase |
| Technical data | IP address, browser type and version (user agent), device information, access timestamps | Collected automatically |
| Communication data | Support correspondence, dispute records | You, and our systems |
4. How we use your data
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Processing and fulfilling your order | Performance of a contract (Art. 6(1)(b)) |
| Delivering licence keys and download access | Performance of a contract |
| Calculating and collecting taxes | Legal obligation (Art. 6(1)(c)) |
| Fraud prevention and security | Legitimate interests (Art. 6(1)(f)) |
| Responding to support enquiries | Performance of a contract / Legitimate interests |
| Defending against disputes and chargebacks | Legitimate interests |
| Compliance with legal obligations (tax records, accounting) | Legal obligation |
| Service improvement and analytics | Legitimate interests |
5. Who we share your data with
- Payment processors (e.g. Stripe, PayPal) — to process your payment securely.
- Sellers — the merchant from whom you purchase, to fulfil your order and provide support.
- Email delivery services — to send order confirmations, licence keys, and transactional emails.
- Hosting and infrastructure providers — to operate the Platform securely.
- Tax and accounting services — to calculate and report taxes as required by law.
- Law enforcement or regulators — where required by law or to protect our rights.
We do not sell your personal data to third parties. We do not share your data for third-party marketing purposes.
6. International transfers
Your data may be transferred to, and processed in, countries outside the United Kingdom or European Economic Area (EEA). Where such transfers occur, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK Information Commissioner or the European Commission, or transfers to countries recognised as providing an adequate level of protection.
7. Data retention
- Transaction and delivery records: retained for 7 years from the date of the transaction for tax, accounting, and legal compliance purposes.
- Technical logs (IP addresses, access logs): retained for up to 24 months for fraud prevention and security.
- Support correspondence: retained for 3 years from resolution, or longer if related to an unresolved dispute.
- Marketing preferences: retained until you withdraw consent or request deletion.
After the retention period, data is securely deleted or anonymised.
8. Your rights
Under the UK GDPR and, where applicable, the EU GDPR, you have the following rights:
- Access — request a copy of the personal data we hold about you.
- Rectification — request correction of inaccurate or incomplete data.
- Erasure — request deletion of your data (subject to legal retention obligations).
- Restriction — request that we limit how we use your data.
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — where processing is based on consent, you may withdraw it at any time.
To exercise your rights, contact the Seller using the support details in your order confirmation, or contact us using the details on our website. We will respond within one month.
9. Right to complain
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk, or with the supervisory authority in your country of residence.
10. Cookies
We use cookies and similar technologies as described in our Cookie Policy.
11. Automated decision-making
We may use automated fraud screening to assess transactions. This processing is based on our legitimate interests in preventing fraud. You have the right to request human review of any automated decision that significantly affects you.
12. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated via the Platform. The version in effect at the time of your transaction will apply.