Legal

Privacy Policy

Last updated: 15 April 2026

1. Introduction

Yash Talent Ltd (“Yash Talent”, “we”, “us”, “our”) is committed to protecting the privacy of everyone who uses our platform — whether you are a Client, a Creative, or an Agency. This Privacy Policy explains how we collect, use, store, share, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Yash Talent Ltd is the data controller for personal data processed through the Platform. Our registered address is 1 Creative Quarter, Shoreditch, London, EC1A 1BB.

Please read this policy carefully. By using our Platform, you acknowledge that you have read and understood how we process your personal data.

2. Personal Data We Collect

2.1 All Users

When you register an account, we collect:

  • Name (first and last name)
  • Email address
  • Password (stored in encrypted form — we never store your plain-text password)
  • Role type (Client, Creative, or Agency)
  • IP address and browser/device information

2.2 Clients

In addition to the above, we collect:

  • Phone number
  • Home or billing address (including postcode)
  • Payment card information (processed and stored securely by Stripe — we do not store full card details)
  • Booking history and correspondence with Creatives and Agencies
  • Reviews you submit

2.3 Creatives

  • Trading name
  • Business address and postcode
  • Phone number
  • Professional categories and description
  • Portfolio images and video content
  • Pricing and availability information
  • Bank account details (held securely by Stripe for payouts)
  • Booking history and client correspondence

2.4 Agencies

In addition to the creative fields above:

  • Agency business name and registered details
  • Information about Agency Creatives on your roster (name, role, category, portfolio)
  • All correspondence and booking history

2.5 Contact Form Submissions

If you use our Contact page, we collect your name, email address, subject, and message content.

2.6 Automatically Collected Data

We automatically collect certain technical data when you use the Platform, including:

  • Log data (IP address, browser type, pages visited, time and date of access)
  • Device information
  • Cookies and similar tracking technologies (see Section 9)

3. How We Use Your Personal Data

We process your personal data on the following legal bases:

3.1 Performance of a Contract (Article 6(1)(b) UK GDPR)

  • Creating and managing your account
  • Processing bookings and payments
  • Facilitating messaging between users
  • Enabling Creatives and Agencies to publish listings

3.2 Legitimate Interests (Article 6(1)(f) UK GDPR)

  • Preventing fraud and ensuring platform security
  • Improving our Platform and user experience
  • Sending service-related notifications (e.g. booking confirmations, policy updates)
  • Resolving disputes between users
  • Internal analytics and reporting

3.3 Compliance with Legal Obligations (Article 6(1)(c) UK GDPR)

  • Maintaining financial records for tax purposes
  • Responding to lawful requests from courts or regulatory authorities

3.4 Consent (Article 6(1)(a) UK GDPR)

  • Sending optional marketing communications (you may opt out at any time)
  • Setting non-essential cookies (you may withdraw consent via our cookie settings)

4. Sharing Your Personal Data

We do not sell your personal data. We may share it with:

4.1 Other Platform Users

When a booking is confirmed, limited profile information (name, business name for Agencies and Creatives) is shared between the booking parties to facilitate the service. Clients' full addresses are not shared publicly but may be shared with a booked Creative or Agency where the service is to be delivered at the client's location.

4.2 Service Providers

  • Stripe — payment processing and payout management
  • Supabase — database hosting and authentication (servers located in the EU)
  • Google Cloud / Cloud Run — application hosting
  • Google reCAPTCHA — bot protection on public forms

All service providers are bound by data processing agreements and may only use your data as instructed by us.

4.3 Legal and Regulatory

We may disclose personal data to law enforcement, courts, or regulatory bodies where required by law or where necessary to protect the rights, property, or safety of Yash Talent, our users, or the public.

5. International Data Transfers

Your data is primarily stored and processed within the UK and the European Economic Area (EEA). Where data is transferred outside the UK/EEA (for example, to US-based service providers), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO).

6. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, and reporting obligations:

  • Account data: retained for the duration of your account and for 6 years after closure (in line with HMRC requirements).
  • Transaction records: retained for 6 years after the transaction date.
  • Messages and correspondence: retained for 3 years after account closure.
  • Contact form submissions: retained for 2 years.
  • Technical log data: retained for 90 days.

After the applicable retention period, your data is securely deleted or anonymised.

7. Your Rights

Under UK GDPR you have the following rights in relation to your personal data:

  • Right of access — to request a copy of the personal data we hold about you.
  • Right to rectification — to request correction of inaccurate or incomplete data.
  • Right to erasure — to request deletion of your personal data in certain circumstances.
  • Right to restriction — to request that we restrict processing of your data in certain circumstances.
  • Right to data portability — to receive your data in a structured, machine-readable format.
  • Right to object — to object to processing based on legitimate interests or for direct marketing.
  • Rights related to automated decision-making — we do not make solely automated decisions that have a legal or significant effect on you.

To exercise any of these rights, contact us at hello@yashtalent.co.uk. We will respond within 30 days. We may need to verify your identity before processing your request.

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk / 0303 123 1113.

8. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include:

  • Encrypted storage of all passwords
  • TLS encryption for all data in transit
  • Row-Level Security (RLS) on our database to prevent cross-user data access
  • Access controls limiting staff access to data on a need-to-know basis
  • Regular security reviews

No method of transmission or storage is 100% secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO in accordance with our legal obligations.

9. Cookies

9.1 What Are Cookies

Cookies are small text files stored on your device when you visit a website. We use cookies to make the Platform function correctly and to understand how it is used.

9.2 Cookies We Use

  • Essential cookies — required for authentication and core Platform functionality. Cannot be disabled.
  • Analytics cookies — help us understand how users navigate the Platform (e.g. pages visited, session duration). Set only with your consent.
  • reCAPTCHA cookies — set by Google on our public contact form to detect bot activity.

9.3 Managing Cookies

You can control and delete cookies through your browser settings. Disabling essential cookies will prevent you from logging in and using the Platform.

10. Children

The Platform is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately at hello@yashtalent.co.uk and we will delete it promptly.

11. Third-Party Links

The Platform may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites. We encourage you to read their privacy policies before providing any personal data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by displaying a prominent notice on the Platform at least 14 days before the changes take effect. The “Last updated” date at the top of this page indicates when the policy was last revised.

13. Contact

If you have any questions or concerns about this Privacy Policy or how we handle your personal data, please contact:

  • Data Controller: Yash Talent Ltd
  • Email: hello@yashtalent.co.uk
  • Post: 1 Creative Quarter, Shoreditch, London, EC1A 1BB
Terms of ServiceContact Us