Anything Privacy Policy

This policy explains how By Anything Limited ("Anything", "we", "us" or "our") collects and uses personal data when you visit anything.agency, contact us, subscribe to our communications or apply for a role with us.

Where we process personal data solely on behalf of a client, the client is normally the controller and its privacy notice will apply. In those circumstances, we process the information under the client's documented instructions and the applicable data processing terms.

Who we are and how to contact us

By Anything Limited is the controller of the personal data described in this notice.
Registered office: 1st Floor, Cubo The Lincoln, Brazennose Street, Manchester, England, M2 5AD
Email: business@anything.agency

Please mark privacy enquiries for the attention of the Data Protection Lead.

Personal data we collect

We may collect the following categories of personal data:

Identity and professional information, such as your name, job title, employer and role.
Contact information, including your email address, telephone number and postal address where relevant.
Enquiry and relationship information, including messages, project requirements, correspondence and records of our interactions.
Marketing information, including newsletter subscriptions, consent choices, preferences and engagement with our emails.
Technical and usage information, such as IP address, browser and device information, pages viewed, referring pages and interaction data.
Cookie and consent information, including the choices recorded through Cookiebot.
Recruitment information that you choose to provide, such as a CV, portfolio, work history and
application correspondence.
Records relating to requests, complaints, security events and our compliance obligations.
We do not ask you to send special category or criminal offence information unless it is necessary for a stated purpose.

How we collect personal data

We collect personal data directly from you when you complete a form, contact us, subscribe, apply for a role or otherwise communicate with us. We also collect limited technical and usage information automatically through our website, cookies and similar technologies. In a business context, we may receive professional contact information from your organisation, business contacts or publicly available professional sources.

How and why we use personal data

We use personal data only where we have a lawful basis. Depending on the circumstances, this may be consent, steps taken at your request before entering into a contract, performance of a contract, compliance with a legal obligation, or our legitimate interests where those interests are not overridden by your rights.

To respond to enquiries and discuss potential work. Our bases are steps taken at your request before a contract and our legitimate interest in responding to business enquiries.
To manage client, supplier and business relationships. Our bases are contract and our legitimate interests in administering and developing those relationships.
To send our newsletter and other requested marketing communications. We rely on consent where PECR requires it. You can withdraw consent or unsubscribe at any time.
To understand and improve our website. We use consent for non-essential analytics cookies and similar technologies.
To operate, protect and troubleshoot our website and systems. We rely on our legitimate interests in maintaining secure and reliable services and, where applicable, legal obligations.
To manage recruitment. Depending on the stage and circumstances, our bases are steps taken at your request before a contract and our legitimate interests in recruiting staff.
To comply with law and protect legal rights. We rely on legal obligations and our legitimate interests in establishing, exercising or defending legal claims.

Cookies, Consent and Google Analytics

We use cookies and similar technologies to operate the website and, where you consent, to understand how visitors use it. Strictly necessary technologies may operate without consent where the law permits because they are required to provide or secure the website.

We use Google Analytics to collect aggregated information about website visits and interactions. Analytics is treated as non-essential and is enabled only in accordance with the consent choices managed through Cookiebot.

Cookiebot presents available cookie choices, records consent and enables you to change or withdraw your choices. Withdrawing consent does not affect the lawfulness of processing that took place before withdrawal. More information, including cookie categories, providers and durations, is available in our Cookie Policy and through the cookie settings control on our website.

Email marketing and newsletter subscriptions

If you subscribe to our newsletter, we use your email address and related preferences to send the communications you requested. We use HubSpot to manage relevant contact and consent records, distribute emails and record delivery, opening and link-click information to help us understand and improve our communications.

We do not sell or rent mailing lists. You can unsubscribe at any time using the link in any marketing email or by contacting us. We may retain the minimum information needed to record an opt-out and ensure that we do not send further marketing against your wishes.

Who we share personal data with

We share personal data only where necessary for the purposes described in this notice. Recipients may include:

website hosting, content management and technical service providers, including Netlify and Storyblok;
analytics and consent-management providers, including Google Analytics and Cookiebot;
customer relationship management and email communication providers, including HubSpot;
regulators, courts, law-enforcement bodies or other authorities where disclosure is required or permitted by law.
Providers processing personal data for us are required to protect it and use it only for the agreed purposes.

International transfers

We do not routinely transfer personal data outside the UK directly. However, some third-party services we use operate global infrastructure, which may involve personal data being processed or accessed from outside the UK, including in the United States.

Where this constitutes a restricted transfer, we ensure that an appropriate legal safeguard is in place, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any required risk assessment and supplementary measures.

How long we keep personal data

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including applicable legal, accounting, security and dispute-resolution requirements. In applying our retention schedule, we consider the nature and sensitivity of the information, the relationship and correspondence concerned, legal limitation periods and whether the information can be securely deleted or anonymised.

General enquiries are normally retained for up to 24 months after the last meaningful contact, unless they lead to an ongoing client or business relationship or a longer period is reasonably required.
Contractual and core business records may be retained for up to six years after the end of the relevant relationship or transaction, where required for accounting, legal or claims purposes.
Newsletter subscription information is retained while you remain subscribed. A minimal suppression record may be kept after you opt out.
Cookie, consent and analytics information is retained according to the durations stated in our Cookie Policy and the relevant service configuration.
Unsuccessful recruitment information is normally retained for no more than six months after the recruitment process ends, unless you agree to a longer period or a longer period is required for a legal reason.

Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, misuse, alteration, disclosure or access. Access is limited to people and providers who need the information for authorised purposes and who are subject to appropriate confidentiality and security requirements.

Your data protection rights

Depending on the circumstances and the lawful basis, you may have the right to:

request access to your personal data and information about how we use it;
ask us to correct inaccurate or incomplete personal data;
ask us to erase personal data;
ask us to restrict the use of personal data;
receive certain personal data in a portable format;
object to processing based on legitimate interests;
withdraw consent at any time where processing is based on consent; and
complain to the Information Commissioner's Office.

These rights are not absolute and may be subject to legal conditions or exemptions. We may need to verify your identity before acting on a request. We will normally respond within one month, although the law permits an extension in certain circumstances.

Your right to object to direct marketing

You have the right to object to direct marketing at any time. If you object or unsubscribe, we will stop using your personal data for that purpose.

Complaints

Please contact us first if you have concerns so that we can try to resolve them. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority:

Website: ico.org.uk | Telephone: 0303 123 1113

Last Updated: 6th February 2026