NM Creative Group
Get a Quote

Privacy Policy

PRIVACY POLICY

This Privacy Policy explains how NM Creative Group Limited collects and uses personal data in connection with the website https://nmcreativegroup.com/ and the services we provide to our clients, who we share it with, how long we keep it and what rights you have under the EU General Data Protection Regulation (GDPR) and the UK GDPR.

1. Who we are

1. The controller of your personal data is NM Creative Group Limited, 65-67 Bonham Strand East, Flat A, 15/F Hillier Commercial Building, Sheung Wan, Hong Kong, Certificate Number: 77062558 (“we”, “us”).

2. You can contact us about any data protection matter by email at info@nmcreativegroup.com or by post at the address above.

3. We have not appointed a Data Protection Officer.

4. Our representative in the European Union (Article 27 GDPR) is Agnieszka Bednarska, ul. Sągi 5D, 02-995 Warsaw, Poland, email: eu-representative@nmcreativegroup.com.

5. Our representative in the United Kingdom (Article 27 UK GDPR) is Henryka Przyimka, Flat 2/3, 64 Golspie Street, Glasgow, G51 3LU, United Kingdom, email: uk-representative@nmcreativegroup.com.

2. What data we process, why and for how long

Enquiries and the contact form

When you contact us through the contact form or by email, we process your name, email address and any information you include in your message, in order to reply and, where relevant, prepare an offer. The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR) or our legitimate interest in responding to enquiries (Article 6(1)(f) GDPR). We keep this data until the enquiry is handled and, if no contract follows, for no longer than 12 months.

Providing our services

We provide website design, Google Ads campaign management, search engine optimisation (SEO), website repairs and technical maintenance, and hosting. To do so, we process the names, business contact details and correspondence of our clients and their contact persons. The legal basis is the performance of a contract (Article 6(1)(b) GDPR) or, for contact persons of business clients, our legitimate interest in communicating with our clients (Article 6(1)(f) GDPR). We keep this data for the duration of the contract and then until the expiry of the limitation period for claims.

Invoicing and payments

We use client data to issue invoices and receive payments. The legal basis is the performance of a contract and our legitimate interest in keeping accounting records and establishing or defending legal claims (Article 6(1)(b) and (f) GDPR). We keep invoices and accounting records for the period required by the accounting and tax laws that apply to us.

Data of our clients’ customers

When we maintain or host a client’s website or online shop, or manage their advertising, we may have access to personal data of our client’s customers. In that case our client is the controller of that data and we act as a processor on the client’s behalf, only on their instructions and under a data processing agreement with that client.

When we act as a processor for a client:

  • the data stays on the client’s hosting and in the client’s own accounts, which we access remotely over encrypted connections with two-factor authentication;
  • we do not copy it to our own devices beyond what the work requires (for example replies to reviews), we keep it secure and delete it when our cooperation ends;
  • we do not pass it to anyone else without the client’s consent; hosting, Google, Microsoft Clarity or review tools such as Trustindex are the client’s own providers under their own terms;
  • we help the client with people’s requests about their data and tell the client about any personal data breach on our side within 48 hours;
  • we may access the data from Asia and Europe, depending on where we are working; for such access we use the standard International Data Transfer Agreement (IDTA), which forms part of our agreement with the client.

Google Ads API and Google user data

We use an internal tool, operated only by NM Creative Group staff, that connects to the Google Ads API to manage and report on Google Ads accounts our clients have authorised us to manage. It is not offered to the public or to third parties.

Through the Google Ads API the tool accesses advertising account data: campaign, ad group, keyword and ad settings, performance statistics (such as impressions, clicks, cost and conversions), search terms, and keyword planning data (keyword ideas and search volume estimates).

We use this data solely to analyse, report on and optimise our clients’ advertising campaigns. Changes to an account are made only after review and approval by our staff.

The data is stored on devices and systems controlled by NM Creative Group and is kept only for as long as we manage the relevant account. We do not sell Google user data and do not use it for our own advertising. We do not share it with third parties, except with the service providers listed in section 3 that process it for the purposes above, including the AI assistant we use for analysis. We do not submit our clients’ customer lists or their customers’ personal data to that assistant.

Access can be revoked at any time by removing our access to the Google Ads account or at https://myaccount.google.com/permissions.

Is providing data required?

Providing your data is voluntary, but without it we cannot respond to your enquiry, enter into a contract or provide our services.

Where we get data from

We usually receive personal data directly from you. If you are a contact person of one of our business clients, we may receive your name and business contact details from your employer or the company you represent, in connection with the services we provide to it.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.

3. Who we share data with

1. We do not sell personal data and we do not share it for marketing purposes.

2. The following service providers process data on our behalf, to the extent necessary to provide their services to us:

  • Hostinger Pte. Ltd., 16 Raffles Quay, #33-02, Hong Leong Building, Singapore 048581: hosting of the website and company email on servers in Germany
  • Fakturownia sp. z o.o., ul. Juliana Smulikowskiego 6/8, 00-389 Warsaw, Poland: issuing and storing invoices
  • Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, United States: provider of the AI assistant Claude, which we use to analyse advertising account data and prepare reports for our clients

3. Data may also be received by:

  • Wise, the payment service provider through which we receive payments: the data shown in the bank transfer, as an independent controller under its own terms and privacy policy
  • our accounting firm, our auditor and our company secretary in Hong Kong: to the extent necessary for bookkeeping, auditing our financial statements and corporate administration

4. We may disclose data to public authorities where required by law.

4. International transfers

1. Our website, company email and invoicing data are stored on servers in the European Economic Area (Germany and Poland).

2. We are established in Hong Kong, for which the European Commission has not issued an adequacy decision. This means that data stored in the EEA is also accessed from outside the EEA. Access is limited to persons authorised by us, over encrypted connections and with two-factor authentication. We are directly subject to the GDPR and the UK GDPR (Article 3(2)) and apply the same protection standards to this data as organisations established in the EEA and the UK.

3. Our hosting provider is a company established in Singapore, and our accounting firm, auditor and company secretary operate in Hong Kong. We share data with them only to the extent necessary for the purposes described above.

4. The AI assistant we use to analyse advertising account data is provided by Anthropic, PBC, a company established in the United States, and the data we submit to it is processed on servers outside the EEA and the UK. This data consists of advertising account settings and performance statistics. We do not submit our clients’ customer lists or their customers’ personal data.

5. Cookies

Our website uses only cookies that are necessary for it to function and for remembering your cookie preferences. We do not use analytics or advertising cookies. More details are provided in the section “Cookies” below.

6. Your rights

1. You have the right to:

  • access your personal data and receive a copy
  • have inaccurate data corrected or incomplete data completed
  • have your data erased
  • restrict processing
  • data portability
  • object to processing based on our legitimate interest
  • withdraw consent at any time, where processing is based on consent

2. You can exercise your rights by contacting us or our representatives at the addresses given in section 1. We will respond without undue delay and in any event within one month.

3. You also have the right to lodge a complaint with a data protection supervisory authority in the country of your habitual residence, place of work or place of the alleged infringement. In Poland this is the President of the Personal Data Protection Office (Urząd Ochrony Danych Osobowych, ul. Stanisława Moniuszki 1A, 00-014 Warsaw, uodo.gov.pl), and in the United Kingdom the Information Commissioner’s Office (ico.org.uk).

7. Security

We use technical and organisational measures appropriate to the risk, including encrypted connections, two-factor authentication and access limited to authorised persons.

8. Changes to this Privacy Policy

We may update this Privacy Policy, in particular when the law, our services or our service providers change. The current version is always published on this website with the date of the last update.

Last updated: 23 October 2026

WEBSITE INFORMATION

Who we are

Our website address is https://nmcreativegroup.com/

What personal data we collect and why we collect it

Comments

When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection.

An anonymized string created from your email address (also called a hash) may be provided to the Gravatar service to see if you are using it. The Gravatar service privacy policy is available here: https://automattic.com/privacy/. After approval of your comment, your profile picture is visible to the public in the context of your comment.

Media

If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

Contact forms

When you fill out a contact form on our site, we collect the information you provide, such as your name, email address, and any additional details you include. We use this data solely for the purpose of responding to your inquiries. We do not share your contact information with third parties unless necessary to fulfill your request. Information submitted through the contact form may be retained for customer service purposes but will not be used for marketing purposes unless explicit consent is given.

Cookies

If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.

If you visit our login page, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed.

If you edit or publish an article, an additional cookie will be saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after 1 day.

Embedded content from other websites

Articles on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

Analytics

How long we retain your data

If you leave a comment, the comment and its metadata are retained indefinitely. This is so we can recognize and approve any follow-up comments automatically instead of holding them in a moderation queue.

For users that register on our website (if any), we also store the personal information they provide in their user profile. All users can see, edit, or delete their personal information at any time (except they cannot change their username). Website administrators can also see and edit that information.

What rights you have over your data

If you have an account on this site or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes.

Where we send your data

Visitor comments may be checked through an automated spam detection service.

TERMS OF BUSINESS

Our Terms of Business are on a separate page: Terms of Business.