GDPR & Data Protection

Last updated: September 2026

1. Our commitment to data protection

CHI Agency is committed to protecting personal information and respecting the privacy of our clients, prospective clients, suppliers, business contacts, website visitors and others whose personal information we process.

We handle personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and subsequent applicable amendments to UK data protection law, including those introduced by the Data (Use and Access) Act 2025.

This page explains our general approach to data protection. More detailed information about the personal information we collect and how we use it can be found in our Privacy Notice.

Information about cookies and similar technologies used on our website can be found in our Cookie Policy.

2. Who we are

CHI Agency is a partnership providing creative, marketing, branding, digital, web and related consultancy services.

For personal information that we determine the purposes and means of processing, CHI Agency acts as the data controller.

Our contact details are:

CHI Agency
124 City Road
London
EC1V 2NX
United Kingdom

Email: hello@chi.agency

3. Our data protection principles

When we process personal information, we aim to follow the fundamental principles of UK data protection law.

This means that personal information should be:

  • processed lawfully, fairly and transparently;
  • collected for specified, explicit and legitimate purposes;
  • adequate, relevant and limited to what is necessary;
  • accurate and, where necessary, kept up to date;
  • retained only for as long as necessary;
  • appropriately protected against unauthorised or unlawful processing, accidental loss, destruction or damage; and
  • managed in a way that enables us to demonstrate compliance with our data protection responsibilities.

4. The personal information we process

The information we process depends on the nature of our relationship with you.

It may include:

  • names and contact details;
  • company and job information;
  • correspondence and enquiries;
  • project and client information;
  • quotations, proposals and contractual information;
  • supplier and subcontractor information;
  • billing, accounting and payment information;
  • website and technical information;
  • marketing preferences;
  • information relating to the delivery and administration of our services; and
  • other information provided to us during a legitimate business relationship.

We aim to collect and retain only the personal information reasonably necessary for the relevant purpose.

5. Why we process personal information

We may process personal information in order to:

  • respond to enquiries;
  • prepare quotations and proposals;
  • enter into and administer contracts;
  • provide our services;
  • communicate with clients, prospective clients, suppliers and business contacts;
  • manage projects and business relationships;
  • administer invoices, payments and financial records;
  • operate, maintain, analyse and secure our website and digital services;
  • manage appropriate marketing and business development activities;
  • prevent fraud, spam and misuse;
  • comply with legal, regulatory and contractual requirements; and
  • establish, exercise or defend legal rights.

More detailed information about these purposes is contained in our Privacy Notice.

6. Lawful bases

We only process personal information where we have an appropriate lawful basis.

Depending on the circumstances, this may include:

Contract
Where processing is necessary to enter into or perform a contract.

Legitimate interests
Where processing is necessary for a legitimate business or other interest and the relevant requirements for relying upon that basis are satisfied.

This may include appropriate business administration, managing client and supplier relationships, network and information security, responding to business enquiries and ce

Back To Top