Privacy & Cookies Policy

The policy This policy explains how Rouge Media Ltd collects, uses, stores and protects personal data in connection with our website, enquiries, client and supplier relationships, marketing, complaints and general business activity. It also explains how we use cookies and similar technologies on rouge-media.com.

This policy is intended for public use. Rouge maintains separate internal procedures and records, including its Data Protection and Retention Policy, Article 30 Control Workbook, Complaints Policy and Procedure, Individual Rights Procedure and Personal Data Breach Procedure.

Rouge Media Ltd is a UK website design and development agency. Our registered office is Mortimer House, 49 Church Street, Theale, Reading, Berkshire, RG7 5BX.

For our own business data, including website enquiries, prospect data, client contact details, supplier data, marketing records and complaints, Rouge usually acts as data controller.

For personal data handled on behalf of clients through client websites, hosting, maintenance, support or development work, Rouge will usually act as data processor and the client will usually act as data controller. Those arrangements are governed by the relevant contract, MSA, PDD, data processing terms or client instructions.

Data protection contact: [email protected]. General enquiries: [email protected]

Depending on how you interact with Rouge, we may collect and process:

• Contact details, such as name, job title, company name, email address, phone number and postal address.
• Enquiry and project information, such as messages, requirements, proposal details, project correspondence, support tickets and meeting notes.
• Client and supplier relationship information, such as contracts, invoices, payment status, account management notes and service records.
• Website and technical information, such as IP address, browser type, device type, page visits, cookie identifiers and website usage data.
• Marketing preference information, such as newsletter preferences, consent records, unsubscribe status and campaign engagement.
• Complaint and rights request information, such as the issue raised, supporting evidence, correspondence, investigation notes and outcome.
• Recruitment information where you apply for a role or contact us about work opportunities.
• Any other personal data you choose to provide to us.

• Directly from you when you contact Rouge, complete a form, email us, call us, meet us, request a proposal or raise a support issue.
• From clients and suppliers as part of normal business and project delivery.
• From our website, cookies, analytics tools and security logs.
• From public business sources, professional networks, referrals or procurement portals where relevant to our services.
• From third-party systems used by Rouge to manage enquiries, projects, finance, hosting, support, marketing and compliance.

Cookies and similar technologies are small files, scripts, tags, pixels or other technologies that store information on, or access information from, your device. Rouge uses them to make the website work, understand website usage, improve our content and, where used, support marketing activity.

We will not use non-essential cookies or similar technologies unless we have an appropriate lawful basis and, where PECR requires it, your consent. You can manage cookie choices through the cookie banner or cookie settings made available on the website.

Website team note before publication: keep the live cookie table aligned with the actual cookies, tags, analytics tools and consent platform used on rouge-media.com. The policy text should not promise a tool or cookie position that the live site does not reflect.

We only share personal data where it is necessary and appropriate. This may include:

• IT, cloud, hosting, email, project management, finance, CRM, analytics, security and support providers.
• Professional advisers, such as accountants, insurers, legal advisers and auditors.
• Clients, where we are handling data as part of a client project or where a complaint/request relates to client-controlled data.
• Approved contractors, freelancers or partners working under appropriate confidentiality and data protection controls.
• Regulators, public authorities, courts or law enforcement where legally required or necessary.

Rouge uses cloud-based tools and suppliers. Some personal data may be processed outside the UK or EEA. Where this happens, Rouge will use appropriate safeguards where required, such as adequacy regulations, appropriate contractual safeguards, supplier data processing terms or other lawful transfer mechanisms.

We keep personal data only for as long as necessary for the purpose for which it was collected, including legal, accounting, contractual, support, security, insurance and dispute-resolution reasons. Retention is managed through Rouge’s internal Data Protection and Retention Policy and Article 30 Control Workbook.

Rouge uses appropriate technical and organisational measures to protect personal data. These include access controls, multi-factor authentication where appropriate, secure cloud systems, supplier checks, staff awareness, backup and recovery processes, security review activity, ISO 27001 alignment and Cyber Essentials controls.

Depending on the circumstances, you may have the right to:

• Ask for access to your personal data.
• Ask for inaccurate personal data to be corrected.
• Ask for personal data to be deleted.
• Ask us to restrict how we use your personal data.
• Object to certain uses of your personal data.
• Ask for a copy of certain personal data in a portable format.
• Withdraw consent where our processing relies on consent.
• Ask us to explain any solely automated decision-making with legal or similarly significant effects, where applicable.

To exercise your rights, contact [email protected] or [email protected]. We may need to verify your identity before responding. Where your request relates to a client website or client-controlled data, Rouge may need to pass the request to the relevant client as controller.

If you are unhappy with how Rouge has handled your personal data, or how Rouge has responded to a data protection request, you can raise a data protection complaint.

Contact: [email protected], or write to Rouge Media Ltd, Mortimer House, 49 Church Street, Theale, Reading, Berkshire, RG7 5BX. You may also use [email protected] and we will route the complaint internally.

Rouge will acknowledge a data protection complaint as soon as practical and in any event within 30 days. We will investigate without undue delay, keep you informed where needed and tell you the outcome once our investigation is complete.

You also have the right to complain to the Information Commissioner’s Office. Website: ico.org.uk. Telephone: 0303 123 1113.

Rouge may update this policy from time to time to reflect changes in our services, systems, suppliers, cookies, legal requirements or ICO guidance. The latest version should be published on rouge-media.com.