Privacy Policy
Last updated: 4th July 2026
1. Introduction
This privacy policy explains how Orca Social Limited (“Orca Social”, “we”, “us” or “our”) collects, uses and protects personal data when you use our website, contact us, or engage with us as a brand, creator, supplier or business contact.
We are committed to protecting your personal data and to handling it transparently, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This policy applies to our website and to the personal data we process in the course of providing influencer marketing and talent management services. It does not apply to third-party websites or platforms (such as YouTube, Instagram or TikTok), which have their own privacy policies.
2. Who we are
Orca Social Limited is a company registered in England and Wales under company number 17315873.
Registered office: 37 Church Brow, Bolton Le Sands, Carnforth, Lancashire, United Kingdom, LA5 8DY
Website: www.orcasocial.co.uk
Email: hello@orcasocial.co.uk
For the purposes of data protection law, Orca Social Limited is the controller of the personal data described in this policy.
[We are registered with the Information Commissioner's Office (ICO) under registration number [ICO NUMBER].]
3. The personal data we collect
Depending on your relationship with us, we may collect and process the following categories of personal data:
Identity data: name, job title, company name, social media handles and channel names.
Contact data: email address, telephone number, postal or business address.
Business data: information about your brand, products, marketing objectives, budgets and campaign requirements (for brands); or your content, niche and career objectives (for creators).
Channel and audience data (creators): channel statistics, subscriber and follower counts, engagement metrics, audience demographics, historical performance data and commercial rates. Audience demographic data is aggregated and does not identify individual audience members.
Financial data: bank account details, payment terms, invoicing information and transaction history, where needed to make or receive payments.
Contractual data: details of the agreements, campaigns and deliverables we manage on your behalf.
Correspondence data: records of emails, calls, messages and meetings between you and us.
Technical and usage data: IP address, browser type, device information and information about how you use our website, collected through cookies and similar technologies.
Marketing preferences: your preferences for receiving communications from us.
We do not intentionally collect special category data (such as data about health, ethnicity or political opinions) and ask that you do not send it to us.
4. How we collect your personal data
Directly from you: when you complete a form on our website, email us, apply to join our creator roster, enquire about a campaign, negotiate or enter into a contract with us, or otherwise correspond with us.
From publicly available sources: such as your public social media profiles, channels, websites and press coverage, where relevant to our services.
From third parties: such as brands who wish to work with a creator we represent, creators who refer other creators, platform analytics tools, and our professional advisers.
Automatically: through cookies and analytics when you use our website.
5. How and why we use your personal data
We will only use your personal data where the law allows us to. The table below sets out the purposes for which we use personal data and the lawful bases we rely on.
Purpose / activity
Type of data
Lawful basis
Responding to enquiries from brands or creators (including via our website contact forms or email)
Identity, contact, business information, correspondence
Legitimate interests (responding to enquiries and administering our business)
Onboarding a brand or creator as a client and providing our services (campaign management, representation, negotiation)
Identity, contact, business, financial, campaign and channel data
Performance of a contract with you, or steps taken at your request before entering a contract
Pitching creators to brands and brands to creators (sharing media kits, audience statistics and rates)
Identity, contact, channel and audience data, commercial rates
Legitimate interests (facilitating partnerships that our clients have engaged us to arrange), or performance of a contract
Processing payments, invoicing and payouts
Identity, contact, financial, transaction data
Performance of a contract; legal obligation (tax and accounting law)
Keeping accounting, tax and company records
Identity, contact, financial, transaction data
Legal obligation
Sending marketing and business development communications to corporate contacts
Identity, contact
Legitimate interests (promoting our services to relevant businesses), subject to the rules on electronic marketing
Operating, securing and improving our website
Technical and usage data
Legitimate interests (running our website and business securely); consent (for non-essential cookies)
Establishing, exercising or defending legal claims
All relevant categories
Legitimate interests (protecting our legal position)
Where we rely on legitimate interests, we have considered and balanced any potential impact on you and your rights. You can request further information about this assessment by contacting us.
6. Marketing
We may send business development and marketing communications to corporate contacts at brands and agencies where we believe our services are relevant to their role, in accordance with UK GDPR and the Privacy and Electronic Communications Regulations (PECR).
You can opt out of marketing communications at any time by using the unsubscribe link in any email or by contacting us directly. We will action opt-out requests promptly.
We do not sell personal data to third parties.
7. Cookies and analytics
Our website uses cookies and similar technologies to help it function and to understand how visitors use it.
Essential cookies: required for the website to operate. These are set on the basis of our legitimate interests.
Analytics cookies: help us understand how visitors use our website so we can improve it. These are only set with your consent.
We use Google Analytics 4 to collect aggregated usage statistics.
You can manage or withdraw cookie consent at any time through the cookie banner or your browser settings. Blocking essential cookies may affect the operation of the website.
8. Who we share your personal data with
We share personal data only where necessary and with appropriate safeguards:
Brands and creators: the core of our service involves introducing creators to brands and vice versa. We may share creator media kits, channel statistics, audience data and rates with prospective brand partners, and brand campaign requirements with prospective creators.
Service providers: trusted third parties who process data on our behalf under contract, such as providers of cloud hosting, email and productivity tools, customer relationship management, e-signature, accounting, payment processing and workflow automation.
Current key providers include: Google Workspace, Airtable, Docusign, n8n, Anthropic (Claude).
Professional advisers: accountants, lawyers, insurers and bankers, where necessary.
Authorities: HMRC, Companies House, regulators or law enforcement, where we are legally required to do so.
Business transfers: prospective buyers or investors in the event of a sale, merger or reorganisation of our business, under confidentiality obligations.
We require all third parties who process data on our behalf to respect the security of your personal data and to process it only on our instructions.
9. International transfers
Some of our service providers are located, or store data, outside the UK (for example, in the United States or the European Economic Area).
Where personal data is transferred outside the UK, we ensure a similar degree of protection by using one or more of the following safeguards: transfers to countries covered by UK adequacy regulations; the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; or other lawful transfer mechanisms.
You can contact us for further information about the safeguards applied to specific transfers.
10. Data security
We have put in place appropriate technical and organisational measures to prevent your personal data from being accidentally lost, used, accessed, altered or disclosed in an unauthorised way. These include access controls, encryption in transit, and limiting access to those with a genuine business need.
We have procedures in place to deal with any suspected personal data breach and will notify you and the ICO of a breach where we are legally required to do so.
11. Data retention
We keep personal data only for as long as necessary to fulfil the purposes we collected it for, including legal, accounting and reporting requirements. In general:
Contractual, invoicing and tax records are retained for at least six years after the end of the relevant financial year, in line with UK tax and company law.
Enquiry and correspondence records are retained for as long as reasonably necessary to manage our relationship with you and for a reasonable period afterwards.
Marketing contact data is retained until you opt out or the data is no longer relevant.
When personal data is no longer required, we delete or anonymise it securely.
12. Your rights
Under data protection law, you have the following rights in relation to your personal data:
Access: request a copy of the personal data we hold about you.
Rectification: request correction of inaccurate or incomplete data.
Erasure: request deletion of your data in certain circumstances.
Restriction: request that we limit how we use your data in certain circumstances.
Portability: request transfer of data you provided to us, in a structured, machine-readable format, in certain circumstances.
Objection: object to processing based on legitimate interests, and to direct marketing at any time.
Withdraw consent: where we rely on consent, withdraw it at any time (this does not affect processing carried out before withdrawal).
To exercise any of these rights, contact us using the details in section 2. We will respond within one month. We may need to verify your identity before acting on a request. There is normally no fee, although we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive.
13. Complaints
If you have a concern about how we handle your personal data, please contact us first so we can try to resolve it.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection: ico.org.uk or 0303 123 1113.
14. Third-party links
Our website may include links to third-party websites and platforms. Clicking those links may allow third parties to collect data about you. We do not control these websites and are not responsible for their privacy practices. We encourage you to read the privacy policy of every website you visit.
15. Changes to this policy
We may update this privacy policy from time to time. The latest version will always be available on our website, with the date of the most recent update shown at the top. Where changes are significant, we will take reasonable steps to bring them to your attention.
Follow us on Instagram @Orca.Social