Get in touch

Privacy & Policy

Document : Privacy Policy
Organisation:  Create Momentum Limited (Company No. 08097067)
Document owner : Julia Nelson, Director
Version : 1.0
Effective date : 1 January 2026
Review cycle : Annually, or sooner if legislation, services or working practices change materially
Approved by Julia Nelson, Director

1. Introduction

Create Momentum Limited (“Create Momentum”, “we”, “us”) provides executive virtual assistant and administrative support services to senior executives, SMEs and sole traders. We are committed to protecting the privacy of everyone whose personal data we handle, and to processing that data fairly, lawfully and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have in relation to it. It applies to our clients and prospective clients, visitors to our website (create-momentum.co.uk), people who contact us, and applicants who apply to join our team.

For the purposes of data protection law, the data controller is Create Momentum Limited, registered in England & Wales under company number 08097067, registered office: Pippins, Orchard Avenue, Windsor, Berkshire SL4 5AA. Questions about this policy should be directed to Julia Nelson, Director, at julia.nelson@create-momentum.co.uk or 07976 551567.

2. Personal data we collect

2.1 Clients and prospective clients

  • Identity and contact details — name, job title, organisation, business address, email address and telephone numbers.
  • Engagement information — details of the services requested, correspondence, meeting notes, and information you share with us so that we can deliver our services.
  • Billing and payment information — invoicing details, bank details for payment, and transaction history. We do not store card numbers.

We do not store card numbers.

2.2 Website visitors and enquirers

  • Information you submit through our contact form or by email or telephone — name, email address, phone number and the content of your message
  • Limited technical data generated by visiting our website (such as cookies), as described in section 10.

2.3 Team applicants

  • Information provided when applying to join our team of executive virtual assistants — name, contact details, CV, work history and references.

3. How we use your data and our lawful bases

We only process personal data where we have a lawful basis to do so under Article 6 UK GDPR:

  • Performance of a contract — to provide our services, manage the client relationship, and administer billing and payments.
  • Legitimate interests — to respond to enquiries, maintain business records, develop our services, and keep in touch with business contacts in a way they would reasonably expect. Where we rely on legitimate interests we balance them against your rights and interests.
  • Consent — where we send direct marketing to individuals who are not existing clients or business contacts, or where we are otherwise required to obtain consent. Consent can be withdrawn at any time.
  • Legal obligation — to comply with accounting, tax and other legal requirements.

4. Data we handle on behalf of our clients

In delivering virtual assistant services we routinely access and handle personal data contained in our clients’ own systems — for example inboxes, diaries, contact lists, CRM records and documents. In respect of that data, our client is the data controller and Create Momentum acts as a data processor.

We process client-controlled data only on the documented instructions of the client, solely for the purposes of delivering the agreed services, under obligations of confidentiality, and in line with our Data Protection Policy and Information Security Policy. We do not use client-controlled data for our own purposes, and we return or delete it in accordance with the client’s instructions when an engagement ends.

5. Who we share personal data with

  • Members of the Create Momentum team who need it to deliver services to you, all of whom are bound by confidentiality obligations.
  • Trusted service providers who support our business — such as IT, email, cloud storage, scheduling and accounting software providers — under contracts that protect your data.
  • Professional advisers, such as our accountants, insurers or legal advisers, where necessary.
  • Regulators, law enforcement or other authorities where we are legally required to do so.

6. International transfers

We aim to keep personal data within the UK or the European Economic Area. Some of the cloud services we use may process data in other countries; where that happens we ensure an adequate level of protection through UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or other safeguards recognised under UK GDPR.

7. How long we keep personal data

We keep personal data only for as long as it is needed for the purposes described in this policy, and then delete or anonymise it securely. As a guide:

  • Client records and correspondence — for the duration of the engagement and up to 6 years afterwards, in line with limitation periods and accounting requirements.
  • Financial and tax records — 6 years from the end of the relevant financial year.
  • Enquiries that do not become clients — up to 12 months from last contact.
  • Unsuccessful team applications — up to 6 months from the conclusion of the process, unless the applicant agrees to a longer period.

8. How we protect your data

We apply appropriate technical and organisational measures to protect personal data, including encrypted and password-protected devices, multi-factor authentication on business accounts, access on a need-to-know basis, secure cloud services and regular backups. These measures are set out in our Information Security Policy, and our response to any security incident is governed by our Data Breach Response Procedure.

9. Your rights

Under UK GDPR you have the following rights in relation to your personal data:

  • The right to be informed about how your data is used.
  • The right of access to the personal data we hold about you.
  • The right to rectification of inaccurate or incomplete data.
  • The right to erasure in certain circumstances.
  • The right to restrict processing in certain circumstances.
  • The right to data portability.
  • The right to object to processing based on legitimate interests, and to direct marketing at any time.
  • Rights in relation to automated decision-making and profiling (we do not make automated decisions that have legal or similarly significant effects).

To exercise any of these rights, contact julia.nelson@create-momentum.co.uk. We will respond within one month. There is normally no fee. Where a request relates to data we process on behalf of a client, we may need to refer it to the client as controller.

10. Cookies and our website

Our website may use a small number of cookies and similar technologies to make the site work and to understand how it is used. You can control cookies through your browser settings. Our website may contain links to other sites; we are not responsible for the privacy practices of those sites.

11. Complaints

If you have a concern about how we handle your personal data, please contact us first and we will do our best to resolve it. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk · 0303 123 1113 · Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

12. Changes to this policy

We keep this policy under review and will publish any updates on our website. This version is effective from 1 January 2026.