Privacy Policy
Last updated: 28 October 2026
1. Introduction
This Privacy Policy explains how Creativemark (“we”, “us”, “our”) and the relevant Seller process your personal data when you use the Creativemark marketplace and checkout service (the “Platform”). We are committed to protecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and, where applicable, the EU General Data Protection Regulation (EU GDPR).
2. Data controller
Creativemark is the data controller for personal data processed through the Platform. Where a Seller processes your data independently (for example, for their own marketing), the Seller acts as an independent data controller for that processing.
3. Personal data we collect
| Category | Data | Source |
|---|---|---|
| Identity and contact | Full name, email address | You, at checkout |
| Billing information | Billing address, country, company name (optional), VAT/tax number (optional) | You, at checkout |
| Transaction data | Items purchased, order amounts, currency, discount codes, tax calculations, payment status | Generated during purchase |
| Technical data | IP address, browser type and version (user agent), device information, access timestamps | Collected automatically |
| Communication data | Support correspondence, dispute records | You, and our systems |
4. How we use your data
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Processing and fulfilling your order | Performance of a contract (Art. 6(1)(b)) |
| Delivering licence keys and download access | Performance of a contract |
| Calculating and collecting taxes | Legal obligation (Art. 6(1)(c)) |
| Fraud prevention and security | Legitimate interests (Art. 6(1)(f)) |
| Responding to support enquiries | Performance of a contract / Legitimate interests |
| Defending against disputes and chargebacks | Legitimate interests |
| Compliance with legal obligations (tax records, accounting) | Legal obligation |
| Service improvement and analytics | Legitimate interests |
5. Who we share your data with
- Payment processors (e.g. Stripe, PayPal) — to process your payment securely.
- Sellers — the merchant from whom you purchase, to fulfil your order and provide support.
- Email delivery services — to send order confirmations, licence keys, and transactional emails.
- Hosting and infrastructure providers — to operate the Platform securely.
- Tax and accounting services — to calculate and report taxes as required by law.
- Law enforcement or regulators — where required by law or to protect our rights.
We do not sell your personal data to third parties. We do not share your data for third-party marketing purposes.
6. International transfers
Your data may be transferred to, and processed in, countries outside the United Kingdom or European Economic Area (EEA). Where such transfers occur, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK Information Commissioner or the European Commission, or transfers to countries recognised as providing an adequate level of protection.
7. Data retention
- Transaction and delivery records: retained for 7 years from the date of the transaction for tax, accounting, and legal compliance purposes.
- Technical logs (IP addresses, access logs): retained for up to 24 months for fraud prevention and security.
- Support correspondence: retained for 3 years from resolution, or longer if related to an unresolved dispute.
- Marketing preferences: retained until you withdraw consent or request deletion.
After the retention period, data is securely deleted or anonymised.
8. Your rights
Under the UK GDPR and, where applicable, the EU GDPR, you have the following rights:
- Access — request a copy of the personal data we hold about you.
- Rectification — request correction of inaccurate or incomplete data.
- Erasure — request deletion of your data (subject to legal retention obligations).
- Restriction — request that we limit how we use your data.
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — where processing is based on consent, you may withdraw it at any time.
To exercise your rights, contact the Seller using the support details in your order confirmation, or contact us using the details on our website. We will respond within one month.
9. Right to complain
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk, or with the supervisory authority in your country of residence.
10. Cookies
We use cookies and similar technologies as described in our Cookie Policy.
11. Automated decision-making
We may use automated fraud screening to assess transactions. This processing is based on our legitimate interests in preventing fraud. You have the right to request human review of any automated decision that significantly affects you.
12. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be communicated via the Platform. The version in effect at the time of your transaction will apply.
13. Google sign-in and connected Google reports
Google sign-in lets you identify yourself using your Google account. Where you choose to connect reporting, Creativemark separately asks for read-only access to Google Analytics or Search Console. Signing in or installing a tracking tag does not by itself authorise reading your reports.
The connection can receive your Google account email, the properties and sites you can access, web-stream identifiers and dated aggregate reports. Reports may include visits, acquisition sources, pages, engagement, device or country groups, purchase-event counts and search performance. Google-reported purchase events are not treated as confirmed platform payments.
We use this information to let you select the correct store property, import reports, show account-scoped dashboards and prepare Growth Insights. Scheduled imports use the offline access you approve. Connection tokens are encrypted in the platform database. Report access follows the account, store and staff-role permissions configured for your business.
Aggregate reporting may be processed by the Cai inference service configured for your account to explain changes and suggest practical actions. This is for your requested store features, not general-purpose model training. Authorised staff and service providers may process the information to operate, secure or support those features. We do not sell Google user data or use it for advertising. Material actions such as sending a campaign require the relevant separate permissions and approval.
You can disconnect reporting in Tools > Connectors or revoke access through your Google account. Disconnecting stops future imports but does not automatically erase saved reports or transaction records. Use the platform contact form to request removal of connected Google data or exercise your privacy rights. We assess retained information against the purpose of the service, your request and applicable legal duties; transaction records with a separate lawful retention requirement remain subject to the retention terms above.
Creativemark restricts the use and transfer of information received from Google APIs in accordance with the Google API Services User Data Policy, including its Limited Use requirements.