Privacy

+ Terms

1. Who we are

This privacy notice explains how It's Off Brand Limited ("OFF+BRAND.", "we", "us", "our") collects, uses and protects your personal information.

We are a company registered in Scotland (company number SC675682). Our registered office is at BK Plus, Gordon Chambers, 90 Mitchell Street, Glasgow G1 3NQ.

For questions about this notice, or to exercise your data protection rights, email contact@itsoffbrand.com.

2. The law we follow

We process personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where we work with people in the European Economic Area, we also follow the EU GDPR where it applies.

3. Information we collect

Identity data: name, job title, role and company.
Contact data: email address, telephone number and business address.
Enquiry data: what you tell us when you contact us or submit a form on our website, such as your project brief, budget range, timeline and where you heard about us.
Business research data: publicly available information about your organisation that we gather when assessing an enquiry (see section 6).
Call data: recordings, transcripts and summaries of calls we hold with you, where you have been told the call is being recorded (see section 7).
Communication data: emails, messages and other correspondence with us, including project discussions and feedback.
Transaction data: details of the services we provide to you, invoices and payment records.
Technical data: IP address, browser type and version, device information, time zone and similar identifiers when you visit our website.
Marketing data: your preferences about receiving communications from us.
Recruitment data: if you apply to work with us, your CV, portfolio, contact details and anything else you choose to send.
Client project data: information, content and materials you provide to us for projects we deliver for you (see section 8).

4. How we collect it

Directly from you: when you contact us, submit a form on our website, request a proposal, join a call, apply for a role or engage our services.
From our website: automatically, through cookies and similar technologies (see section 12).
From public sources: such as your organisation's website, company registries, news coverage and professional profiles, when we assess an enquiry you have sent us.
From third parties: such as people who refer or introduce you to us.

5. How we use it, and our lawful bases

Performing a contract. When you engage us, we use your data to deliver our services, communicate with you about the project and manage our contract with you.

Legitimate interests. Where it is necessary for our legitimate business interests, and those interests are not overridden by your rights, we use your data to:

respond to enquiries and assess whether we are a good fit for your project;
research the organisation behind an enquiry, using public business information (see section 6);
record and transcribe calls so we can accurately follow up on what was discussed (see section 7);
keep records of our clients, prospects, projects and sales pipeline;
send existing clients relevant information about similar services;
improve our website and services;
protect our legal rights.

Consent. Where you have given consent, for example to marketing emails or non-essential cookies, we rely on that consent. You can withdraw it at any time.

Legal obligation. We keep some records because the law requires it, such as financial records for tax purposes.

6. AI and automated tools

We use AI tools, including Anthropic's Claude, to help our team work efficiently. When you send us an enquiry, these tools may:

research the organisation behind the enquiry using publicly available business information, such as company size, sector, funding news and recent announcements;
summarise the enquiry and suggest how well it fits our services and likely budget;
summarise calls and help draft follow-up emails and proposals.

This research is limited to public, business-related information about your organisation and your professional role. We do not research private individuals' personal finances, home addresses or families.

All AI output is reviewed by our team, and every decision about whether and how to work with you is made by a person. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.

You have the right to object to this processing at any time (see section 13).

7. Call recording

We may record and transcribe calls and video meetings, using a notetaking service, so we have an accurate record of what was agreed. We will tell you at the start of a call if it is being recorded. If you would prefer not to be recorded, tell us before or during the call and we will stop.

Recordings, transcripts and summaries are kept with our records for your enquiry or project and deleted in line with section 11.

8. Client project data

When you engage us for creative or development services, we act as a data processor for any personal data you provide as part of the project, such as content for your website. You remain the data controller for that information. We will:

only process it in line with your documented instructions;
keep it secure;
only share it with subcontractors we need to deliver the work, who are bound by confidentiality and data protection obligations;
return or delete it on request when the project ends, unless the law requires us to keep it.

Where required, we will agree a separate data processing agreement with you.

9. Who we share your data with

We do not sell your personal data.

We share it only where needed, with:

Service providers that host or process data for us, under contracts that require them to protect it. They currently include:
- Webflow (our website and its forms)
- Cloudflare (website infrastructure and the automation that processes form submissions)
- Google Workspace (email and calendars)
- Notion (our records of enquiries, clients and projects)
- Slack (internal communication about enquiries and projects)
- Fireflies.ai (call recording, transcription and summaries)
- Anthropic (AI assistance, see section 6)
- Figma (design and proposal documents)
- Vercel (hosting for some of our web projects)
- Google Analytics
- Stripe, Xero
Freelancers and partner studios who work with us on your project, bound by confidentiality obligations.
Professional advisers such as accountants, lawyers and insurers, where necessary.
Regulators, courts and law enforcement, where the law requires it or to protect our legal rights.

10. International transfers

Several of our service providers are based in, or process data in, the United States and other countries outside the UK. When your data is transferred outside the UK, we make sure it is protected by one of the following:

UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework for certified US providers;
the ICO's International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses.

You can ask us for more detail about the safeguards for a particular provider.

11. How long we keep it

We keep personal data only as long as we need it for the purposes above:

DataHow longEnquiries that do not become a project, including our research notes and any call recordings2 years after our last contactClient project files, correspondence and call records6 years after the project endsFinancial and invoicing records7 years, as the law requiresMarketing contactsUntil you withdraw consent, or after 3 years of inactivity, whichever comes firstWebsite analytics data26 monthsUnsuccessful job applications12 months, in case a suitable role comes upEmployee and contractor records6 years after the relationship ends

After these periods we securely delete or anonymise the data, unless the law requires us to keep it longer.

12. Cookies

Our website uses cookies:

Essential cookies are needed for the website to work and cannot be switched off.
Analytics cookies help us understand how visitors use the site.
Marketing cookies help us show relevant advertising, and are only set with your consent.

You can manage your preferences through our cookie banner or your browser settings. Turning some cookies off may affect how the site works. For details of the specific cookies we use, contact us.

13. Your rights

Under UK data protection law you have the right to:

access a copy of the personal data we hold about you;
correct data that is inaccurate or incomplete;
erase your data in certain circumstances;
restrict how we use your data;
data portability: receive your data in a structured, machine-readable format, or have it sent to another organisation;
object to processing based on our legitimate interests, including the business research described in section 6 and call recording, and to direct marketing at any time;
withdraw consent where we rely on it.

To exercise any of these rights, email contact@itsoffbrand.com. We may need to confirm your identity before acting on a request. We will respond within one month, as the law requires.

14. Keeping your data secure

We use appropriate technical and organisational measures to protect your data, including:

encryption in transit (TLS) across our website and systems;
access limited to the people who need it for their work;
two-factor authentication on our business accounts;
regular reviews of our systems and service providers.

No method of transmitting data over the internet is completely secure, so we cannot guarantee absolute security. If a data breach is likely to put your rights at risk, we will tell you and the ICO as the law requires.

15. Marketing

We only send you information about our services if you asked for it, if you are an existing client and it relates to similar services, or if you have given consent. You can opt out at any time by using the unsubscribe link in any email or by contacting us.

16. Links to other websites

Our website may link to other websites. We are not responsible for their privacy practices and encourage you to read their privacy notices.

17. Complaints

If you are unhappy with how we have handled your data, please contact us first so we can try to put it right.

You also have the right to complain to the Information Commissioner's Office:

Website: ico.org.uk/make-a-complaint
Telephone: 0303 123 1113

18. Changes to this notice

We may update this notice from time to time. The date at the top shows when it was last changed.

19. Contact us

Email: contact@itsoffbrand.com
Post: It's Off Brand Limited, BK Plus, Gordon Chambers, 90 Mitchell Street, Glasgow G1 3NQ