Privacy Policy

Last updated: 21/09/2026

​

1.  ABOUT THIS POLICY

1.1              This policy explains how The Commerce Engine Limited collects, uses, shares and protects personal information, and sets out your rights in relation to that information.

1.2              It applies to visitors to our website at thecommerceengine.com, people who contact us or make an enquiry, contacts at our clients, prospective clients and suppliers, creators who take part in programmes we operate, and people who apply to work with us.

1.3              It does not apply to personal data we process on behalf of our clients when delivering services to them. In those cases our client is the controller and we act as a processor under a written agreement with them. Our client’s own privacy policy will apply.

​

2.  WHO WE ARE

2.1              The Commerce Engine Limited is the controller of the personal information described in this policy. We are a company registered in England and Wales under company number 17239166, with our registered office at 57–61 Charterhouse Street, London EC1M 6HA.

2.2              We are registered with the Information Commissioner’s Office under registration number [ICO REGISTRATION NUMBER].

2.3              We are not required to appoint a Data Protection Officer. Questions about this policy or about how we handle personal information should be sent to [PRIVACY EMAIL], or to the registered office address marked for the attention of the Data Protection Lead.

​

3.  THE INFORMATION WE COLLECT AND WHY

We collect different information depending on your relationship with us. The table below sets out what we collect, why we use it, and the lawful basis we rely on under the UK GDPR.

 

Who you are

What we collect

Why we use it

Lawful basis

Website visitor

IP address, browser and device type, pages viewed, referring page, approximate location

To operate the site securely, prevent abuse and maintain a record of technical activity

Legitimate interests — running a secure and functional website

Enquirer

Name, email address, telephone number, company name, job title and the content of your message

To respond to your enquiry and, where relevant, to discuss whether we can work together

Legitimate interests — responding to a request you have made to us

Client and prospective client contact

Name, business contact details, job title, correspondence, meeting notes, contract and billing information

To provide our services, manage the relationship, keep accounting records and market related services

Contract; legitimate interests — managing and growing our business; legal obligation for accounting records

Creator or partner

Name, handle, contact details, audience and performance data, payment details, correspondence

To operate affiliate and creator programmes, brief and pay participants, and measure performance

Contract; legitimate interests — operating creator programmes on behalf of clients

Supplier contact

Name, business contact details, correspondence, payment details

To manage the supplier relationship and pay invoices

Contract; legal obligation

Job applicant

Name, contact details, CV, covering note, exercise responses, interview notes, right-to-work information, references

To assess your application, run our recruitment process and meet our employment obligations

Legitimate interests — assessing candidates; steps prior to entering a contract; legal obligation for right-to-work checks

 

3.1              We do not routinely collect special category data. Where you volunteer information about a disability or health condition so that we can make reasonable adjustments during recruitment, we process it on the basis of your explicit consent and for the purpose of meeting our obligations under the Equality Act 2010.

3.2              We do not carry out automated decision-making that produces legal or similarly significant effects, and we do not use profiling to make decisions about individuals.

3.3              Where we rely on legitimate interests, we have carried out a balancing assessment to confirm that our interests do not override your rights. You may request a summary of that assessment at any time.

​

4.  WHERE WE GET YOUR INFORMATION FROM

4.1              Most of the information we hold comes directly from you — through our contact form, by email, in meetings and calls, or through the recruitment process.

4.2              We also obtain business contact information from publicly available sources, including company websites, LinkedIn and industry directories, and from introductions made by mutual contacts, partner agencies and our founders’ professional networks.

4.3              Where we operate creator programmes, we may receive creator information from the relevant platform or from our client.

​

5.  MARKETING

5.1              We may send business-to-business marketing communications about our services to corporate contacts where we have a legitimate interest in doing so, in accordance with the Privacy and Electronic Communications Regulations 2003.

5.2              Every marketing message we send includes a clear and free way to opt out. You can also tell us to stop at any time by emailing [PRIVACY EMAIL]. We will act on your request promptly.

5.3              We do not sell personal information, and we do not share it with third parties for their own marketing purposes.

​

6.  WHO WE SHARE INFORMATION WITH

6.1              We share personal information with the following categories of recipient:

• service providers who support our business, including our email and productivity platform, website host, CRM, cloud storage, accounting software and payment providers;

• our professional advisers, including lawyers, accountants and insurers, where necessary;

• our clients, where we are delivering services to them and the information relates to that work;

• third-party platforms, including TikTok Shop, where this is necessary to operate a client’s shop or creator programme;

• our shareholders and group or affiliated companies, including The Pinball Collective LLC in the United States, where necessary for the operation and management of the business;

• law enforcement, regulators and other authorities where we are required or permitted to do so by law.

6.2              We put a written contract in place with every supplier who processes personal information on our behalf, requiring them to protect it and to act only on our instructions.

6.3              If our business is sold or reorganised, personal information may be disclosed to the prospective buyer and its advisers, subject to appropriate confidentiality protections.

​

7.  SENDING INFORMATION OUTSIDE THE UK

7.1              Some of our suppliers, and our affiliate The Pinball Collective LLC, are based outside the United Kingdom, principally in the United States and the European Economic Area.

7.2              Where we transfer personal information outside the UK, we rely on one of the following safeguards: an adequacy decision made by the UK government, the UK International Data Transfer Agreement, or the UK Addendum to the European Commission’s Standard Contractual Clauses, in each case supported by a transfer risk assessment where required.

7.3              You may request a copy of the safeguards we have put in place by contacting us at [PRIVACY EMAIL].

​

8.  HOW LONG WE KEEP INFORMATION

 

Information

Retention period

Website enquiries that do not lead to a relationship

12 months from the last contact

Client and supplier records, including contracts

7 years from the end of the relationship, to meet contractual, tax and limitation requirements

Accounting and tax records

6 years from the end of the accounting period, as required by the Companies Act 2006

Creator programme records

3 years from the end of the programme, or longer where required by our client contract

Unsuccessful job applications

6 months from the decision, unless you agree to us keeping your details on file for future roles

Marketing contact records

Until you opt out, or after 3 years of no engagement

Website server and security logs

[NUMBER] months

 

8.1              Where we no longer need personal information, we delete it securely or anonymise it so that it can no longer be associated with you.

​

9.  KEEPING INFORMATION SECURE

9.1              We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, alteration and disclosure. These include access controls, multi-factor authentication, encryption in transit, restricted administrative privileges, supplier due diligence and staff training.

9.2              We have procedures in place to deal with a suspected personal data breach. We will notify the Information Commissioner’s Office, and you where required, in accordance with our legal obligations.

​

10.  COOKIES

10.1            Our website uses only cookies that are strictly necessary for it to work. We do not use advertising cookies and we do not share cookie data with third parties for advertising purposes.

10.2            Full details are set out in our Cookie Policy.

​

11.  YOUR RIGHTS

11.1            Under data protection law you have the following rights:

• Access — to be told whether we hold personal information about you and to receive a copy of it.

• Rectification — to have inaccurate information corrected and incomplete information completed.

• Erasure — to ask us to delete personal information where there is no good reason for us to keep it.

• Restriction — to ask us to suspend our use of your information in certain circumstances.

• Portability — to receive information you gave us in a structured, commonly used and machine-readable format.

• Objection — to object to our use of your information where we rely on legitimate interests. You may object to direct marketing at any time and we must stop.

• Withdrawal of consent — where we rely on your consent, to withdraw it at any time. This does not affect the lawfulness of anything we did before you withdrew it.

11.2            To exercise any of these rights, contact us at [PRIVACY EMAIL]. We will respond within one month. If your request is complex, or you have made several requests, we may extend that period by up to two further months and will tell you if we do.

11.3            You do not have to pay a fee. We may charge a reasonable fee, or refuse to act, if a request is manifestly unfounded or excessive. We may need to ask you for information to confirm your identity before we act.

​

12.  HOW TO COMPLAIN

12.1            If you are unhappy with how we have handled your personal information, please tell us first at [PRIVACY EMAIL]. We will acknowledge your complaint within 30 days of receiving it, investigate it without undue delay, keep you informed of progress, and tell you the outcome.

12.2            You also have the right to complain to the Information Commissioner’s Office at any time. The ICO can be contacted at ico.org.uk, by telephone on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would be grateful for the chance to deal with your concerns first.

​

13.  CHANGES TO THIS POLICY

13.1            We keep this policy under review and may update it from time to time. The date at the top of this page shows when it was last updated. Where changes are significant, we will take reasonable steps to bring them to your attention.

​

14.  CONTACT US

The Commerce Engine Limited

57–61 Charterhouse Street, London EC1M 6HA

Email: [PRIVACY EMAIL]