Privacy policy

Who we are

CRESCO is a trading name of Cresco Agency LLC, a limited liability company registered in the State of Wyoming, United States, operating at cresco.agency. We are the data controller for the personal data described in this policy.

If you need our full registration details or a postal address before sharing data with us, email derek@cresco.agency and we will provide them.

What we collect, and why

When you submit the contact form

We collect your first name, last name, email address, budget range, how you heard about us, and the content of your message. We use this for one purpose: to reply to your enquiry and, if it goes further, to scope and discuss a possible engagement.

Our lawful basis is legitimate interest. You contacted us about our services, and replying is the obvious expected outcome. You can ask us to delete the record at any time.

When you book a call

Our booking link takes you to Cal.com, a third-party scheduling service. Anything you enter there is collected by Cal.com under their own privacy policy, and shared with us so we can hold the meeting.

When you simply visit the site

Our hosting provider, Vercel, records standard server logs: IP address, browser type, the page requested, and a timestamp. These exist for security and to keep the service running, and we do not use them to build a profile of you.

We do not run analytics, advertising pixels, or tracking cookies on this site. There is no cookie banner because there is nothing to consent to. If that changes, this policy will be updated before the change goes live.

If we contact you first

We sometimes contact businesses directly about our services. Where we do, we rely on legitimate interest for business-to-business contact, we only ever use business contact details in a professional capacity, we say who we are, and every message carries a one-click way to opt out. We honour opt-outs permanently, and we do not send unsolicited email to business contacts in jurisdictions whose national law requires prior consent. If you would rather we never contact you again, reply to any message or email derek@cresco.agency and we will suppress your details.

Who we share it with

We do not sell personal data, and we do not share it for anyone else's marketing. We use a small number of processors to run the business:

• Vercel: hosting, delivery and server logs.
• Resend: delivers contact-form submissions to our inbox.
• Google Workspace: our email and documents.
• Cal.com: meeting scheduling.

Each is bound by its own data-processing terms. We are a United States company and these providers are US-based, so if you are in the UK or the EEA, the personal data you send us is transferred to the United States. Where safeguards are required we rely on those our providers maintain, such as standard contractual clauses, and on the transfer being necessary to respond to the enquiry you sent us.

How long we keep it

Enquiries that do not become engagements are kept for up to 24 months, in case you come back to us, and then deleted. Records relating to actual client work are kept for as long as the engagement runs plus the period our tax and accounting obligations require. Server logs are retained on our host's standard schedule.

Your rights

If you are in the UK or the EEA, you have the right to access the personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on legitimate interest, you can object. For marketing contact, we will always stop.

To exercise any of these, email derek@cresco.agency. We will respond within one month. You also have the right to complain to your national data protection authority. In the UK, that is the Information Commissioner's Office.

Security

The site is served over HTTPS. Access to enquiry data is limited to the people who need it to reply to you. No system is perfectly secure, but we do not collect special-category data, payment details, or passwords through this website, which keeps the exposure small by design.

Children

This is a business-to-business service. It is not directed at children, and we do not knowingly collect data from anyone under 16.

Changes to this policy

When we change this policy we update the date at the top. Material changes, such as a new processor, a new category of data, or any tracking added to the site, will be reflected here before they take effect.

Contact

Questions about this policy, or about any data we hold: derek@cresco.agency.