Privacy Policy

Expression 37 Ltd. is committed to protecting your personal data and handling it responsibly. This policy explains what information we collect, why we collect it, how we use it, and your rights under UK data protection law.

This policy applies to the website at expression37.co.uk and any personal data you provide when contacting us or using our services.

Who we are

The data controller is:

Expression 37 Ltd.
196 Low Road
Thornhill
Dewsbury
West Yorkshire
WF12 0PU

Company No. 8762730, registered in England and Wales.
ICO Registration Reference: ZB406232.

Email: info@expression37.co.uk
Telephone: 07771 656 606

What personal data we collect

We only collect personal data that is necessary for providing our services or responding to enquiries. This includes:

• Contact enquiries: your name, email address, telephone number, and the content of your message when you submit a contact form or email us directly.
• Cookies: small text files placed on your device to support website functionality. See the cookies section below for detail.

We do not collect sensitive personal data, and we do not knowingly collect data from anyone under the age of 18.

Why we collect it and our lawful basis

We process your personal data on the following grounds:

• Legitimate interests (Article 6(1)(f) UK GDPR): responding to enquiries and communicating with existing and prospective clients about relevant services.
• Contractual necessity (Article 6(1)(b) UK GDPR): where you engage us for services, we process the data necessary to fulfil that agreement.

How we use your data

• To respond to your enquiry or support request.
• To deliver the services you have engaged us for.
• We do not sell, rent, or share your personal data with third parties for marketing purposes.

Who we share your data with

We use a small number of trusted third-party services to operate this website. These providers process data on our behalf and are bound by their own data protection obligations:

• Hosting provider: this website is hosted by Clook, whose servers are located in Manchester, UK. Your data does not leave the UK as part of normal website operation.

We will only disclose personal data to other parties where required by law or to protect the rights and safety of others.

Data security

Expression 37 Ltd. takes appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure.

• All client codebases and associated data are maintained in private, access-controlled git repositories.
• Personal data shared in the course of an engagement is not stored beyond what is necessary to fulfil the service.
• Expression 37 Ltd. holds cyber and data liability insurance with Hiscox (policy PL-PSC10001101952/11), covering data breach investigation, regulatory response, and business interruption caused by a cyber incident. Full insurance details are published on our Working with us page.

If you have concerns about how your data is protected, contact us at info@expression37.co.uk.

How long we keep your data

• Contact enquiries: retained for up to 3 years from the date of last contact, unless a longer retention period is required for contractual or legal reasons.
• Client project data: retained for the duration of the engagement and for up to 6 years thereafter in line with UK statutory requirements.

Cookies

Our website uses essential cookies. A cookie is a small file placed on your device that helps the website function correctly.

Essential cookies

These cookies are necessary for the website to function and cannot be switched off. They are set in response to actions you take, such as submitting a contact form.

Managing cookies

You can control cookies through your browser settings, though disabling essential cookies may affect how the website functions.

Your rights

Under UK data protection law, you have the following rights:

• Right of access: you can request a copy of the personal data we hold about you.
• Right to rectification: you can ask us to correct inaccurate or incomplete data.
• Right to erasure: you can ask us to delete your personal data where there is no legitimate reason to continue holding it.
• Right to restriction: you can ask us to restrict how we process your data in certain circumstances.
• Right to data portability: where processing is based on consent or contract, you can request a copy of your data in a commonly used, machine-readable format.
• Right to object: you can object to processing based on legitimate interests. We will stop unless we have compelling grounds to continue.
• Rights relating to automated decision-making: we do not use automated decision-making or profiling.

To exercise any of these rights, contact us at info@expression37.co.uk. We will respond within one calendar month.

How to complain

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK’s supervisory authority:

Information Commissioner’s Office (ICO)
ico.org.uk/make-a-complaint
Telephone: 0303 123 1113

We would, however, appreciate the opportunity to address your concerns before you contact the ICO, so please get in touch with us first.

Changes to this policy

We may update this policy from time to time. Any significant changes will be noted at the top of this page with a revised date. We encourage you to review it periodically.

Last updated: June 2026.