Privacy policy

Bean Creative Marketing Ltd (Bean Creative, we, us or our) provides website, design, hosting and digital marketing services. This policy covers personal data handled through our website, enquiries, services and applications, including the planned TikTok Shop integrations described below.

We are registered in England and Wales under company number 15933045. Our Information Commissioner's Office (ICO) registration number is ZC118901. Our postal address is Suites 21–23, Storth House, 156 Cowlersley Lane, Huddersfield, England, HD4 5UX. For privacy enquiries, rights requests or deletion requests, email [email protected].

We are the controller of data used to manage our own website, business relationships and services. When we process customer, buyer or creator data solely on a business client's instructions, that client is the controller and we act as its processor under a data processing agreement. The client's privacy notice also applies. TikTok is responsible for its own processing under its applicable privacy notices.

We apply the UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018 and applicable privacy and electronic communications rules, as amended, and other data protection laws where they apply to our activities.

• Enquiries and business contacts: name, company, email address, telephone number, correspondence, service requirements and budget, provided through forms, email, telephone or our business relationship.
• Service and billing records: contracts, billing addresses, invoices, payment references and records of work. Payment providers handle payment credentials under their own notices; please do not send full card details through enquiry forms.
• Digital health checks: the email address and website URL you submit, publicly available information from that website, and the resulting technical, accessibility, performance and SEO report. The website URL is sent to Google PageSpeed Insights for performance analysis. Our enquiry and report workflows use n8n automation to route requests and follow up on your requested service.
• Technical and usage information: IP address, browser and device information, requested and referring pages, timestamps, security events and diagnostic logs from our website and hosting systems. With your consent, Google Analytics collects usage information and Meta Pixel collects page-view, device and advertising information.
• Preferences: cookie choices, consent records and communication preferences.
• Authorised platform data: data from TikTok or a client only where an integration is available and authorised, as described in section 3.

Sources include you, clients who instruct us, platforms you authorise, public websites you ask us to assess, and your use of our website. We do not ask for sensitive personal data in enquiry forms. Please include only information needed for your request.

Providing information is generally voluntary. We need your name, email and message for a website enquiry, and your email and website URL for a digital health check. Without required service or authorisation information, we may be unable to provide the requested feature. Optional cookies and marketing consent are not required to use our core website.

We are planning to develop applications and services for TikTok Shop Partner Center. This policy does not mean an integration is live or that TikTok has approved or endorsed us. These terms apply when you authorise a shop to connect to a service we make available. Before connection, we will identify the application, its purpose and requested permissions, and update this notice where a feature changes our data practices.

We request only permissions needed for your selected feature and access only data those permissions make available. Depending on the approved integration and your authorisation, this may include:

• Seller and shop connection: seller, shop and account identifiers, shop name, business contact details, region, permissions, authorisation timestamps, and access and refresh tokens needed to maintain the connection. You authenticate with TikTok Shop; we do not ask for your TikTok password.
• Products and operations: product listings, images, SKUs, prices, inventory and available sales or settlement reports, where necessary for the product management, stock synchronisation or reporting features you authorise.
• Orders and fulfilment: order identifiers, purchased items, amounts, order status, returns, refunds, shipment and tracking information. Buyer names, delivery addresses and contact details are accessed only where TikTok makes them available and they are needed for an authorised order, delivery, return or support task. Masked data remains masked unless access to additional information is specifically permitted and necessary.

We use this data solely to provide, maintain, secure and support the authorised service on the seller's instructions. Connecting a shop does not permit unrelated processing or use of buyer contact details for marketing. We do not collect more data than the feature needs, bypass TikTok's access restrictions, or scrape TikTok Shop data.

We do not sell or rent TikTok Shop data, aggregate it for our own purposes, use it for unrelated advertising or profiling, train general-purpose AI models on it, or disclose it to unrelated parties. The planned integrations do not seek private messages, contact lists or full payment card information. Additional data or permissions require an explanation and any necessary authorisation before access.

You can refuse permissions or revoke the application's authorisation through TikTok Shop Seller Center's app or service authorisation controls. Revocation stops future authorised access and may prevent the connected feature from working. To ask us to disconnect a service or delete data already held, use section 7. Revoking access does not itself delete stored data or records already transmitted to TikTok Shop.

TikTok is responsible for its processing under its applicable Privacy Policy and TikTok Shop privacy notices. Shop-specific policies and terms are available through TikTok Shop Partner Center.

Where we act as controller, we use the following lawful bases:

• Contract or requested pre-contract steps: respond to enquiries, provide requested quotes, reports and services, and administer authorised integrations. Where the client is a company, communications with its representatives rely on our legitimate interest in managing that business relationship.
• Legal obligation: maintain records and make disclosures required by applicable tax, accounting and other laws.
• Legitimate interests: secure our services, prevent abuse, investigate faults, manage client relationships and establish or defend legal claims. Our interests are protecting people and systems, providing reliable services and protecting legal rights; we balance these against your interests and rights.
• Consent: use optional analytics and advertising technologies, and send marketing where consent is required. Other permitted business marketing relies on our legitimate interest in promoting relevant services, subject to electronic marketing rules and your right to object.

A TikTok permission authorises platform access; it does not automatically establish a lawful basis for every use of personal data. As a processor, we follow the controller's documented lawful instructions.

We do not make decisions about individuals based solely on automated processing that produce legal or similarly significant effects. Automated website health scores assess websites and do not determine an individual's legal rights or eligibility for services.

We share only necessary information with hosting, infrastructure, email, business administration and automation providers; authorised staff and contractors; payment providers; and professional advisers. Google provides Analytics and PageSpeed Insights, Meta provides Pixel advertising measurement, and Cloudflare Turnstile provides spam protection. Google Maps embeds and GoodFirms review widgets may receive your IP address, browser information and the page visited when loaded.

For connected TikTok Shop services, data is exchanged with TikTok and, where needed, the client and fulfilment, support or other providers the client expressly authorises. We obtain required express permission before sharing TikTok Shop end-user data with third parties. Product or other information you instruct us to publish is sent to TikTok Shop and becomes visible according to the relevant service settings. We may disclose data when required by law, to protect legal rights, or for a business transfer subject to appropriate safeguards and notice.

Processors must protect data, keep it confidential and use it only for agreed purposes under appropriate contracts. Independent controllers, including regulators and some platform and payment providers, are responsible for their own processing under their privacy notices.

Some providers operate internationally, including in the United States, so processing may involve transfers outside the UK or European Economic Area. For transfers we are responsible for, we use an applicable adequacy decision or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, and EU Standard Contractual Clauses where EU law applies, with required risk assessments and supplementary protections. Contact our privacy email for relevant destinations or a copy of applicable safeguards, with confidential information redacted where necessary.

We keep data only as long as needed for its stated purpose, considering its type and sensitivity, whether a service or enquiry is ongoing, legal and contractual obligations, and dispute resolution. These criteria apply as follows:

• Enquiries and reports: for the time needed to respond, provide requested follow-up and resolve related questions. Relevant records become part of the client file if an enquiry becomes a project.
• Client and accounting records: for the relationship and applicable statutory period. Company accounting records are generally retained for six years from the end of the financial year they concern; this does not justify retaining all service or TikTok data for six years.
• TikTok tokens and operational data: only while needed for the authorised service and within any shorter platform limits. On disconnection, revocation, expiry of purpose or a valid deletion request, we stop further access and delete or irreversibly anonymise data no longer needed. If our API access or developer agreement ends, we immediately cease use of the developer services and permanently delete TikTok Shop user content and confidential data in our possession or control, including copies, as required by the applicable platform terms. Any limited record that law requires us to retain is isolated and used only for that obligation; we explain its basis and period on request.
• Security logs and backups: for the period needed to investigate incidents, maintain resilience and complete scheduled backup rotation. Data awaiting backup deletion is restricted from routine use; if restored for recovery, the deletion must be reapplied. Any stricter TikTok Shop deletion requirement takes priority over ordinary backup rotation.
• Preferences: cookie choices are valid for up to one year before we ask again. Cookie lifetimes appear in section 8. Minimal records of marketing objections may be kept to respect your choices.

We use appropriate technical and organisational measures against unauthorised access, alteration, disclosure and loss, and restrict access to people who need it for their work. For planned TikTok Shop integrations, protected token storage, encrypted transmission and storage, access controls, deletion processes and incident handling must be in place before personal data is processed. No online service can guarantee absolute security. We investigate suspected breaches and notify authorities and affected individuals where required by law, and report relevant compromises to TikTok immediately where required by its developer terms.

Subject to applicable legal conditions and exceptions, you may request access, correction, erasure, restriction of processing or a portable copy of personal data. You may withdraw consent at any time without affecting processing that was lawful before withdrawal.

Your right to object: you can object to processing based on legitimate interests for reasons relating to your situation. You can object to direct marketing, including related profiling, at any time and we will stop that marketing.

To exercise a right, disconnect a service or request deletion of TikTok-sourced data, email [email protected], or write to the address in section 1. Identify the service and account or shop, and whether you want all associated data or specific records deleted. You do not need a special form or subject line. Never send passwords, access tokens or full payment details.

We may request proportionate information to verify identity or authority over an account. We acknowledge requests, stop relevant processing where required, arrange deletion with processors where applicable, and confirm completion or explain lawful retention or refusal. We normally respond within one month; if law permits an extension for a complex or multiple request, we explain the reason within the initial period. Requests are normally free of charge.

If we hold data solely for a client, we assist that controller with your request and identify the appropriate contact where possible. Deleting our data does not delete your TikTok account, a seller's independently held records or already published content; use the relevant platform or controller's controls for those records.

You can complain directly to the Information Commissioner's Office (ICO), telephone 0303 123 1113, or write to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You do not have to contact us first. Where EU GDPR applies, you may also complain to the authority where you live, work or believe an infringement occurred.

We use browser storage to remember your choices. Google Analytics and Meta Pixel load only after you opt into their respective analytics or marketing categories. You can reject both optional categories and use the website.

Cloudflare Turnstile processes technical signals to distinguish genuine requests from abuse. Maps and review widgets connect your browser to their providers when loaded. See the privacy policies of Google, Meta, Cloudflare and GoodFirms for their practices.

Change or withdraw optional consent below or through Cookie preferences in the footer. Saving a withdrawal reloads the page to stop previously loaded analytics or marketing scripts. You can also clear cookies and site data in your browser; this does not delete information already received by a provider. Our lawful basis for optional analytics and marketing technologies is consent.

Our business services and planned integrations are intended for adults and authorised business representatives, not children under 18. We do not knowingly collect children's data through those services. Contact our privacy email if you believe a child has provided data so we can investigate and delete it where appropriate. Clients must have a lawful basis for customer data they instruct us to process.

External websites, platforms and services have their own privacy notices. This policy covers our processing and does not replace the notices of TikTok, clients or other independent providers.

This revision has an effective date of 1 November 2026. We keep this policy under review and display the effective date of further revisions here. Material changes will receive appropriate notice, and fresh consent where required before changed processing begins.

Privacy and deletion contact: [email protected]. Our Terms & Conditions are also publicly available.