Privacy Policy - folioandpin.com

Last updated: 21 September 2026

1. General Provisions

This Privacy Policy explains how PINK CIRCLE LIMITED, company number 15647366, collects, uses, stores, shares and otherwise processes personal data in connection with folioandpin.com and colophonrow.com, together with the relevant marketplace functionality made available through those websites.

For the purposes of this Privacy Policy, Company, we, us and our mean PINK CIRCLE LIMITED as the operator of the Platforms. Platform means the relevant online marketplace operated through folioandpin.com or colophonrow.com, as applicable.

You or User means an individual who visits or uses a Platform, creates an account, submits or participates in a Project, communicates through the Platform, uploads Project Materials, contacts support, applies to participate as an Independent Service Performer or otherwise interacts with the Platform. A User may act personally or as an authorised representative of a business or organisation. A legal entity does not itself become an account holder.

The Company processes personal data to operate and administer the Platforms, manage accounts, facilitate interactions between Users and Independent Service Performers, support Project-related communications and functionality, provide customer support, facilitate payment-related processes through authorised third-party payment service providers, maintain Platform security, prevent fraud and misuse, comply with legal obligations and improve Platform functionality.

The Platforms operate as online marketplaces for visual marketing Services. PINK CIRCLE LIMITED operates the Platforms but does not itself provide the underlying visual marketing Services. Those Services are provided independently by Independent Service Performers acting on their own behalf.

The Company may use service providers to support hosting, security, communications, payment-related functionality, technical operations and other Platform functions where necessary. Such providers may process personal data only to the extent required for the relevant purpose and subject to applicable contractual and data protection requirements.

The Company processes personal data in accordance with applicable data protection legislation, including the UK General Data Protection Regulation, the Data Protection Act 2018 and, where applicable, the EU General Data Protection Regulation.

For personal data for which PINK CIRCLE LIMITED determines the purposes and means of processing, the Company acts as the data controller. Other parties, including Independent Service Performers and third-party service providers, may have separate data protection responsibilities in relation to personal data they process for their own purposes.

Capitalised terms not defined in this Privacy Policy have the meanings given to them in the Terms & Conditions.

2. Information We Collect

We collect personal data that you provide directly, information generated through your use of the Platform and, where appropriate and lawful, limited information received from third parties supporting Platform operations.

When you create or use an account, we may process your name, email address, telephone number, account credentials, verification status and other information associated with your account.

If you use the Platform as a Business Representative, we may also process information reasonably necessary to understand the business or organisation you represent and your relationship with it. Your account remains associated with you as the individual User.

When you submit or participate in a Project, we may process Project descriptions, requirements, instructions, preferences, communications and Project Materials. Project Materials may include documents, text, images, brand materials, design assets and video files used solely as supporting or reference material. Consistent with the Terms & Conditions, video production and video editing are not final Services or Deliverables offered through the Platforms.

We may process communications between Users and Independent Service Performers to the extent those communications take place through Platform functionality or are otherwise provided to us for support, security, complaint handling or administration of Platform processes related to a Project.

When you contact us, we may process your contact details, the content of your enquiry, relevant account or Project information and any supporting materials you provide.

If you apply to participate as an Independent Service Performer, we may additionally process professional information, areas of expertise, portfolio materials, supporting documentation, application information, verification information and other data submitted as part of the application or participation process. Independent Service Performers are not employees or workers of PINK CIRCLE LIMITED.

When payments or refunds are processed through authorised third-party payment service providers, we may receive limited transaction-related information such as payment status, transaction identifiers, amounts, currency and information necessary for reconciliation, fraud prevention, support or compliance. We do not intend to receive or store full payment card details. The Company does not provide banking, payment, e-money, money transmission or escrow services and does not maintain User or Independent Service Performer balances.

When you use the Platform, certain technical and usage data may be collected automatically. This may include IP address, browser and device information, operating system, language settings, timestamps, referring pages, pages visited, features used and other technical information relating to your interaction with the Platform.

The Platforms do not require Users to provide special category personal data as part of ordinary use. However, Project Materials or communications submitted by Users may contain personal data relating to the User or other individuals. If you provide personal data relating to another person, you are responsible for ensuring that you have an appropriate lawful basis or other authority to provide that information for the relevant purpose.

We may receive limited personal data from third parties where necessary for Platform operations, such as payment service providers, fraud-prevention or security providers and other technical service providers. We will process such information only where an appropriate lawful basis applies.

Project Materials submitted through the Platform are not treated as publicly available merely because they are uploaded to the Platform. They are processed only as necessary for Platform operations, the relevant Project interaction, security, compliance and other purposes described in this Privacy Policy.

Where particular personal data is required to create an account, complete verification, process a transaction or use specific Project-related functionality, failure to provide that information may prevent you from using the relevant Platform feature or completing the relevant process.

3. How We Use Personal Data

We process personal data only for specified and legitimate purposes connected with the operation, security and administration of the Platforms.

We may use personal data to create and maintain accounts, authenticate Users, verify contact information, maintain account security and provide access to Platform functionality.

Where a User participates in a Project, we may process relevant personal data and Project Materials to enable Project requests, facilitate communications and interaction with the relevant Independent Service Performer, provide access to relevant Platform features and support the delivery and review processes made available through the Platform.

We may use personal data to provide customer support, respond to enquiries, investigate technical issues, administer complaints, communicate account or Project-related information and maintain Platform continuity.

We may process personal data to detect, investigate and prevent fraud, unauthorised access, misuse, security incidents, prohibited activities and other conduct that may threaten the security or lawful operation of the Platforms.

We may use transaction-related information for payment confirmation, reconciliation, refund administration, fraud prevention, accounting and compliance purposes. Payment card information is processed by authorised third-party payment service providers rather than by the Company.

We may process technical and usage information to operate, secure, maintain and improve the Platforms, understand how Platform functionality is used, diagnose technical issues and develop or improve features.

We may also process personal data where necessary to comply with legal, regulatory, accounting or reporting obligations, respond to lawful requests from competent authorities, establish or defend legal claims or enforce applicable Platform terms.

Personal data will not be used for purposes that are incompatible with the purposes described in this Privacy Policy unless permitted or required by applicable law.

4. Legal Bases for Processing

PINK CIRCLE LIMITED processes personal data only where a lawful basis applies under the UK GDPR and, where applicable, the EU GDPR.

Depending on the circumstances, processing may be necessary to perform our contract with you concerning your use of the Platform or to take steps at your request before entering into that contract. This may include creating and managing your account, providing Platform functionality, facilitating Project interactions, processing support requests and administering Platform-related transactions.

We may process personal data where necessary to comply with applicable legal obligations, including accounting, tax, regulatory, recordkeeping and lawful disclosure requirements.

We may also rely on our legitimate interests where those interests are not overridden by your rights and freedoms. Such interests may include operating and securing the Platforms, preventing fraud and misuse, administering accounts and Project interactions, resolving complaints and disputes, improving Platform functionality and protecting the legal rights of the Company, Users and relevant third parties.

Where consent is required by applicable law, we will request it before carrying out the relevant processing. You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Where an Independent Service Performer processes personal data for their own purposes in connection with Services they provide, they may have separate responsibilities and lawful bases under applicable data protection law.

5. Data Security

The Company implements appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, access or other unlawful processing.

Access to personal data is limited to persons and service providers who require it for legitimate Platform-related purposes and only to the extent reasonably necessary for their role.

Security measures are reviewed having regard to the nature of the personal data processed, the purposes of processing and the risks associated with Platform operations.

No electronic transmission or storage method can be guaranteed to be completely secure. Users are responsible for maintaining the confidentiality of their account credentials and for taking reasonable precautions when accessing their accounts.

If you believe that your account has been compromised or become aware of a suspected security incident affecting your personal data, you should contact us using the details provided in this Privacy Policy.

6. Cookies and Similar Technologies

The Platforms may use cookies and similar technologies where necessary to operate Website and account functionality, maintain security, remember preferences and understand Platform performance.

Strictly necessary cookies may be used for functions such as authentication, session management, account security, fraud prevention and other functionality required for the operation of the Platforms.

Where used, functionality cookies may remember settings or preferences in order to provide a more consistent Platform experience.

Where analytics, performance or other optional technologies are used, they may help us understand how the Platforms are used, identify technical issues and improve functionality. Such technologies will be used in accordance with applicable law and, where consent is required, will not be activated until the appropriate consent has been obtained.

Where applicable, you may manage or withdraw your cookie preferences through the available cookie controls. You may also manage cookies through your browser or device settings, although disabling strictly necessary technologies may affect Platform functionality.

We do not intentionally use cookies or similar technologies for the purpose of collecting special category personal data.

Further information about specific cookies or similar technologies may be provided through a separate Cookie Policy or cookie preference interface where applicable.

The Company does not sell personal data or disclose personal data to third parties for their independent direct marketing purposes.

Personal data may be shared with third parties where reasonably necessary to operate, secure and support the Platforms. Depending on the relevant functionality, such recipients may include hosting and infrastructure providers, communications providers, security and fraud-prevention providers, payment service providers, professional advisers, auditors, insurers and other technical or operational service providers.

Where a third-party provider processes personal data on behalf of the Company, the Company requires appropriate contractual and data protection safeguards. Certain third parties, including payment service providers, may process personal data as separate controllers for their own legal, compliance, fraud-prevention or transaction-related purposes and may provide their own privacy information.

Relevant Project information and Project Materials may be made available to the Independent Service Performer involved in the relevant Project to the extent reasonably necessary to facilitate the Project interaction and enable that Independent Service Performer to provide the agreed Services. An Independent Service Performer may have separate data protection responsibilities for personal data they process independently in connection with those Services.

The Company may disclose personal data where required by applicable law, court order, regulatory requirement or lawful request from a competent authority, or where reasonably necessary to investigate fraud or security incidents, enforce applicable Platform terms, protect legal rights or establish, exercise or defend legal claims.

Personal data may also be disclosed as part of a merger, acquisition, restructuring, financing or sale of all or part of the Company's business or assets, subject to applicable confidentiality and data protection requirements.

Where personal data is transferred outside the United Kingdom or, where relevant, the European Economic Area, the Company will use a lawful transfer mechanism where required. This may include an applicable adequacy decision or regulation, approved contractual safeguards or another mechanism recognised under applicable data protection law.

The Company takes reasonable steps to ensure that international transfers are subject to protections appropriate to the personal data involved and the applicable legal requirements.

You may contact the Company using the details provided in this Privacy Policy to request further information about the safeguards applicable to relevant international transfers.

Any disclosure of personal data will be limited to the information reasonably necessary for the relevant purpose and carried out in accordance with applicable data protection law.

8. Data Retention

PINK CIRCLE LIMITED retains personal data only for as long as reasonably necessary for the purposes for which it was collected and for any additional period required or permitted by applicable law.

Account-related personal data is generally retained while the relevant account remains active. Following account closure, certain information may be retained where necessary for legal, accounting, fraud-prevention, security, dispute-resolution or recordkeeping purposes.

Project-related personal data, including Project requests, communications, Project Materials and records relating to Deliverables, is retained for as long as reasonably necessary to support the relevant Project, address follow-up matters, resolve complaints or disputes, prevent fraud and protect legal rights.

Transaction and payment-related records may be retained for periods required by applicable accounting, tax, fraud-prevention or other legal obligations. Full payment card details are processed by authorised third-party payment service providers and are not intended to be retained by the Company.

Application and participation information relating to Independent Service Performers may be retained for as long as reasonably necessary to assess an application, administer participation in the marketplace, maintain relevant records, prevent fraud or resolve legal or compliance matters.

Technical, security and usage information is retained only for as long as reasonably necessary for security, fraud prevention, technical operations, Platform performance and related legitimate purposes.

Retention periods may vary according to the type of personal data, the purpose of processing, applicable legal requirements and whether the information is required in connection with an existing or anticipated legal claim. When personal data is no longer required, it will be deleted, anonymised or otherwise securely disposed of in accordance with applicable requirements.

9. Your Data Protection Rights and Requests

Subject to applicable data protection law and any relevant exemptions, you may have rights in relation to personal data processed by the Company.

These may include the right to obtain confirmation that your personal data is being processed and access to that data; request correction of inaccurate or incomplete information; request deletion of personal data in certain circumstances; request restriction of processing; receive certain personal data in a structured, commonly used and machine-readable format where the right to data portability applies; and object to processing based on legitimate interests.

Where personal data is processed for direct marketing purposes, you may object to that processing at any time. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

You may also have rights relating to decisions based solely on automated processing where such decisions produce legal or similarly significant effects, to the extent such rights apply under applicable law.

To exercise a data protection right or raise a privacy-related request, you may contact:

For folioandpin.com: support@folioandpin.com

For colophonrow.com: support@colophonrow.com

We may request additional information reasonably necessary to verify your identity and protect personal data against unauthorised disclosure.

Requests will be handled within the timeframes required by applicable data protection law. Certain rights are not absolute and may be restricted where a lawful exemption applies or where continued processing is necessary for purposes permitted by law.

If we are unable to comply with a request in whole or in part, we will provide information about the decision where required by applicable law.

If you have concerns about how your personal data is processed, you may first raise them with the Company using the contact details provided in this Privacy Policy. You may also have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the United Kingdom or another competent supervisory authority where applicable.

10. Use by Minors

The Platforms are intended for individuals who have reached the legal age of majority applicable to them and have the legal capacity to use the Platform in accordance with the Terms & Conditions.

The Company does not knowingly seek to collect personal data from individuals who do not meet the applicable eligibility requirements.

If we become aware that personal data has been submitted by or collected from an individual who is not eligible to use the Platform and there is no lawful basis for retaining that information, we will take reasonable steps to delete or otherwise appropriately restrict its processing.

A parent, legal guardian or other authorised representative who believes that personal data relating to an ineligible minor has been submitted through a Platform may contact the Company using the contact details provided in this Privacy Policy.

11. Changes to This Privacy Policy

The Company may update this Privacy Policy from time to time to reflect changes in Platform functionality, data processing practices, applicable law or regulatory requirements.

The current version of this Privacy Policy will be published on the relevant Website and will identify the date on which it was last updated.

Where required by applicable law, or where a change materially affects how personal data is processed, the Company may provide additional notice through the Platform, by email or by another appropriate communication method.

Changes will apply from the date stated in the updated Privacy Policy. Users are encouraged to review the current version periodically to remain informed about how their personal data is processed.

12. Contact Information

PINK CIRCLE LIMITED is the operator of folioandpin.com and colophonrow.com and acts as the data controller where it determines the purposes and means of processing personal data as described in this Privacy Policy.

Operator: PINK CIRCLE LIMITED

Company Number: 15647366

Registered Address: 3 Lombard Street, London, England, EC3V 9AA

For folioandpin.com: support@folioandpin.com

For colophonrow.com: support@colophonrow.com

Phone: +44 7867 288902

Questions about this Privacy Policy, requests concerning personal data or the exercise of applicable data protection rights may be submitted using the contact details above.