Creativity only works when it ...RESONATES
Being noticed isn’t enough. Resonance is relevance…to what customers feel and think. It’s how brands win fans and drive sales.
Privacy Statement
Privacy & cookie policy
Version 2.0 | Last revised: July 2026
This policy is currently under external data protection review. We expect to publish a further update by December 2026.
Who we are and how to contact us
This site (www.khws.co.uk) provides information about KHWS Limited (“KHWS”, “we”, “us” or “our”). Your privacy matters to us. This Privacy Policy explains how we collect, use, store and protect personal data when you visit our website, engage with us as a client, supplier or business contact, or otherwise interact with us.
KHWS is the data controller responsible for the personal data described in this policy. Our details are:
KHWS Limited, company registration number 2781801
Registered office: 20 Farringdon Street, London, EC4A 4AB, United Kingdom
VAT number: 626293139
Data protection enquiries: [email protected] | Telephone: +44 (0) 207 324 3340
If you have any questions about this policy or how we handle your personal data, or you wish to exercise your rights, please contact our data protection contact using the details above.
The law we work to
We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) as it forms part of UK law, and the Data Protection Act 2018 (DPA 2018). Where we send electronic marketing or use cookies and similar technologies, we also comply with the Privacy and Electronic Communications Regulations 2003 (PECR).
The Information Commissioner’s Office (ICO) is the UK’s data protection regulator and our supervisory authority.
The personal data we collect
Depending on how you interact with us, we may collect and process the following categories of personal data:
Contact and identity data – name, job title, employer, work email address, work postal address and work telephone number(s).
Business relationship data – records of enquiries, correspondence, proposals, contracts and the services we provide.
Communications data – the content of emails, telephone conversations, mobile messaging and other written or verbal communications with us.
Technical and usage data – IP address, device and browser information, and details of how you use our website, collected through cookies and similar technologies (see the Cookies section below).
Marketing and preferences data – your preferences in receiving marketing from us and your communication preferences.
Where we ask you to provide personal data, we will make clear at the point of collection what we need and why. We do not routinely seek to collect special category data through our website.
How and why we use your personal data
Under UK GDPR we must have a lawful basis for each purpose for which we process personal data. The table below sets out our main purposes and the lawful basis we rely on for each.
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and providing our products and services | Performance of a contract, or our legitimate interests in responding to business enquiries |
| Managing our client, supplier and business relationships and administration | Legitimate interests in running and administering our business |
| Website operation, security and analytics | Legitimate interests in maintaining a secure and effective website; consent for non-essential cookies |
| Direct marketing to business contacts | Legitimate interests, or consent where required by PECR |
| Meeting our legal, regulatory and tax obligations | Compliance with a legal obligation |
| Establishing, exercising or defending legal claims | Legitimate interests in protecting our legal position |
Where we rely on legitimate interests, we have carried out a balancing assessment to ensure our interests are not overridden by your interests or fundamental rights. You can ask us for more information about that assessment using the contact details above.
Where we rely on consent (for example, for certain marketing or non-essential cookies), you can withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of any processing carried out before you withdrew it.
If we intend to use your personal data for a new purpose that is not compatible with the purpose for which it was originally collected, we will notify you and explain the lawful basis before doing so.
Automated decision-making and profiling
We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.
Visitors to our website
When you visit our website we collect standard internet log information and details of visitor behaviour patterns, for example the number of visitors to different parts of the site. We use analytics to understand how the site is used and to improve it. Where analytics rely on non-essential cookies, we only set them with your consent. We do not attempt to identify individual visitors from this information.
Cookies and similar technologies
A cookie is a small text file that a website asks your browser to store on your device to remember information about you, such as your preferences. First-party cookies are set by us; third-party cookies are set by other domains, for example for advertising and analytics.
We use a cookie consent management tool, which appears on your first visit and lets you accept or reject non-essential cookies and change your preferences at any time. Strictly necessary cookies do not require consent; all other cookies (including analytics, functional and targeting cookies) are only set where you have given consent, in line with PECR and UK GDPR.
How does KHWS use cookies?
KHWS does not use cookies to collect personally identifiable information about any user of the website. A current, itemised list of the specific cookies we use, their providers and their lifespan is shown below and maintained through our cookie consent tool.
How do I change my cookie settings?
You can change your preferences at any time using our cookie preference centre. Most web browsers also allow some control of most cookies through the browser settings. To find out more about cookies, including how to see what cookies have been set, visit www.aboutcookies.org or www.allaboutcookies.org.
Find out how to manage cookies on popular browsers:
To find information relating to other browsers, visit the browser developer’s website.
To opt out of being tracked by Google Analytics across all websites, visit http://tools.google.com/dlpage/gaoptout.
Marketing
We may send you marketing communications about our services where you have asked us to, where you are an existing business contact and it is within your reasonable expectations, or where you have otherwise consented, as permitted by PECR. Every marketing message will include a simple way to opt out, and you can tell us at any time that you no longer wish to receive marketing by contacting us using the details in this policy.
Email and communications monitoring
Emails you send to us, including attachments, may be monitored and screened for security purposes and to check compliance with our policies, using email filtering and security software. Please ensure that any email you send us is lawful. Any monitoring we carry out is limited to what is necessary and proportionate for these purposes.
Who we share your personal data with
We do not sell your personal data. We may share it with:
Service providers and processors who support our business, for example IT, hosting, communications and analytics providers, who act on our instructions under written contracts.
Our professional advisers, such as auditors, lawyers and accountants, where necessary.
Clients and partners where this is part of providing or receiving services and is consistent with this policy.
Regulators, law enforcement and other authorities where we are required or permitted by law, for example to prevent or detect crime, or to establish, exercise or defend legal claims.
Where we share data with processors, we put contracts in place that require them to protect it and to use it only for the purposes we specify.
International transfers
Where possible, we host personal data within the UK or European Economic Area. Some of our service providers are established outside the UK or may process personal data internationally. Where personal data is transferred outside the UK, we ensure it is protected by an appropriate safeguard recognised under UK data protection law, such as UK adequacy regulations (including the adequacy decision covering the EEA), the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for further details of the safeguards that apply.
How long we keep your personal data
We keep personal data only for as long as we need it for the purposes set out in this policy, and to meet our legal, accounting, tax and regulatory obligations. When we no longer need it, we securely delete or anonymise it. The guide below shows our general approach; specific periods are set out in our internal retention schedule.
| Type of data | Typical retention period |
|---|---|
| Enquiry and prospect correspondence | Up to 24 months from last contact, then reviewed |
| Client and contract records | Duration of the relationship plus 6 years |
| Financial and tax records | 6 years, in line with legal requirements |
| Marketing preferences | Until you opt out or ask us to delete the data |
| Website analytics data | In line with our cookie tool settings and provider retention |
How we protect your personal data
We take the security of personal data seriously and use appropriate technical and organisational measures to protect it against unauthorised access, loss, misuse or alteration. These include access controls, secure storage and staff awareness. Where required, we will notify the ICO and affected individuals of a personal data breach in line with our legal obligations.
Your rights
Under UK GDPR and the DPA 2018 you have the following rights in relation to your personal data:
The right to be informed about how we use your personal data (this policy is part of how we meet that obligation).
The right of access – to obtain confirmation that we process your data and a copy of it.
The right to rectification of inaccurate or incomplete data.
The right to erasure of your data in certain circumstances.
The right to restrict processing in certain circumstances.
The right to data portability, allowing you to obtain and reuse certain data.
The right to object to processing based on our legitimate interests, and to object to direct marketing at any time.
Rights relating to automated decision-making and profiling.
The right to withdraw consent at any time where we rely on consent.
Some of these rights apply only in particular circumstances, and there are limited exemptions where we may not be able to act on a request, for example where doing so would adversely affect the rights and freedoms of others or where we are legally required to retain the data. If an exemption applies, we will explain this to you.
You can read more about your rights on the ICO website: ico.org.uk.
How to exercise your rights
This section explains, step by step, how you or someone acting on your behalf can exercise the rights above.
Making a request
You can make a request by contacting us using the data protection contact details at the start of this policy. To help us respond quickly and correctly, please:
Tell us which right or rights you wish to exercise (for example, access to your data or erasure).
Give us enough information to identify you and to locate the relevant data, such as the nature of your relationship with us and the likely date range of any correspondence.
Let us know your preferred way of receiving our response.
You do not have to use any particular form or wording to make a valid request, and there is normally no fee.
Confirming your identity
To protect your personal data, we may need to confirm your identity before we act on a request. We will only ask for information that is reasonable and necessary to do this. If we already know you well enough to be satisfied who you are, we will not ask for more.
Our response time
We will respond without undue delay and, in any event, within one month of receiving your request and any information we need to verify your identity. If your request is complex, or you have made a number of requests, we may extend this by up to a further two months. If we need to do so, we will let you know within the first month and explain why.
Fees
We do not usually charge a fee. However, if a request is manifestly unfounded or manifestly excessive, in particular because it is repetitive, we may charge a reasonable fee to cover our administrative costs or decline to act on the request. If either applies, we will explain our reasons and your options.
If we cannot fully meet your request
If we are unable to act on your request, or can only act in part, we will tell you why and let you know about your right to complain to the ICO and to seek a remedy through the courts.
Requests made by a representative
You can ask someone else to exercise your rights on your behalf, for example a solicitor, a family member, or another authorised representative. We treat requests from legal and other authorised representatives in the same way as requests from the individual, provided we are satisfied the representative is properly authorised to act.
If you are acting on behalf of someone else, please provide:
Written evidence of your authority to act, such as a signed letter of authority, a lasting power of attorney, or other appropriate documentation.
Enough information to identify the individual whose data is requested and to locate the relevant records.
Your own contact details so we can respond to you.
We may still contact the individual directly to confirm the request, and we will always consider our responsibility to protect their personal data. Where a request concerns a child, we will consider who is entitled to make the request and act in the best interests of the child.
Requests relating to someone who has died
UK data protection law applies to living individuals only. If you need information about a person who has died, please contact us and we will explain what, if anything, we are able to do and under what other duties, such as confidentiality, we may be bound.
How to complain
If you are unhappy with how we have handled your personal data or a request, please contact us first so we can try to put things right. You also have the right to complain to the ICO at any time.
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk
Trademarks, copyright and links to other websites
The display of any trade names or trademarks on this website does not imply that any licence has been granted to any third party. KHWS owns the copyright in the content published on this website except where indicated otherwise. You may print parts of the website for your own personal use, provided you keep any proprietary notices intact. All other use is prohibited without our permission.
This policy does not cover other websites we link to. We are not responsible for their content or availability, and we encourage you to read the privacy notices on any website you visit.
Changes to this policy
We may update this policy from time to time. When we do, we will publish the updated version on this page and change the version number and revision date at the top. Where changes are significant, we will take reasonable steps to bring them to your attention.
How to contact us
You can write to:
Data Privacy Officer
KHWS Ltd.
20 Farringdon Street
London, EC4A 4AB
United Kingdom