1. Who we are and scope
Belfrost Creative Ltd is a company registered in England and Wales with company number 17376628. We are the controller for the personal information described in this notice. Our address is 167–169 Great Portland Street, London, W1W 5PF. Contact us at hello@belfrostcreative.com.
This notice covers this public website, direct enquiries and personal information processed when someone authorises a supported Belfrost Creative or Frostie OS provider integration. Contracted services may also be governed by additional terms or privacy information.
When we process personal information solely on a client's documented instructions, that client may be the controller and Belfrost Creative Ltd may act as its processor. Those arrangements require a separate written data-processing agreement; this public notice does not replace it.
2. Information we may process
- Contact details and correspondence you send to us.
- Business and project information you choose to provide during an enquiry.
- Security and delivery logs produced by our hosting providers, such as IP address, browser, requested URL and time.
- Where you authorise an integration: provider account and selected-resource identifiers, display names, permission state, encrypted access credentials, authorised operation records and the provider data needed to deliver the capability you request.
We receive information directly from you, automatically from our hosting and security services, or from a provider only after you authorise the relevant integration and select the resources involved. If information comes from another source, we will identify that source where required and will not treat provider or model output as authoritative merely because it was supplied automatically.
We do not ask for or store your Facebook, Instagram or other provider password. You enter it only in the provider's own authentication service.
3. Why we use information
Depending on the context, we use information to:
- respond to enquiries and take steps requested before entering a contract;
- provide and support agreed services or authorised integrations;
- keep systems, accounts and data secure and diagnose service problems;
- maintain necessary business, legal and audit records; and
- improve our operations using proportionate, aggregated or de-identified evidence where appropriate.
Our lawful basis depends on the purpose:
- Enquiries and requested pre-contract discussions: taking steps at your request before a contract and our legitimate interest in responding to genuine business enquiries.
- Agreed services and authorised integrations: performing a contract or taking requested pre-contract steps.
- Security, service diagnostics and proportionate operational improvement: our legitimate interests in operating, protecting and improving the service without overriding your rights.
- Accounting, legal and regulatory records: compliance with legal obligations or our legitimate interests in establishing and defending legal rights.
- Consent: only where a specific activity requires it; consent can be withdrawn at any time.
We do not currently make decisions through this public website based solely on automated processing that have legal or similarly significant effects on people. We do not use model output as authority for consequential decisions about people.
You are not legally required to provide information through this website. If you do not provide the contact or project information needed for an enquiry, or do not grant a provider permission needed for a requested integration, we may be unable to respond or provide that requested service.
6. Retention and security
We keep information only for as long as it is needed for the purpose collected, to support an active relationship, protect the service, or meet legal, accounting and dispute-resolution obligations. We review retention by record type rather than keeping everything indefinitely.
Depending on the service, our safeguards include access controls, tenant-scoped storage and authorisation, encryption for supported provider credentials, audit records and proportionate technical and organisational measures. We review these controls as services change. No system can guarantee absolute security.
7. Your rights
Depending on the circumstances, you may ask for access, correction, deletion, restriction, portability or object to our use of your information. You may withdraw consent where consent is the basis for processing.
Email hello@belfrostcreative.com. We may request proportionate information to verify identity. You may also complain to the Information Commissioner's Office.
Your right to object: where we rely on legitimate interests, you can object to that processing. We will stop unless we can demonstrate compelling legitimate grounds or need the information for legal claims. You can object to direct marketing at any time, although this MVP does not currently send marketing through the public website.
8. Changes
We will revise this notice when our processing changes. The date above shows the latest published revision. Material new uses will be explained before they begin where required.