Privacy & Cookie Policy
Formidable Media Ltd
Last updated: 31 July 2026
 
1. Who we are
Formidable Media Ltd (“we”, “us”, “our”) is the controller responsible for your personal data for the purposes of the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection law. This policy explains how we collect, use and protect your personal data when you visit our website or otherwise interact with us.
Our contact details are:
Formidable Media Ltd
Dunns Hat Factory, 106–110 Kentish Town Road
London, NW1 9PX, United Kingdom
Website: https://formidable.agency
Email: info@formidable.media
2. How to contact us about data protection
If you have any questions about this policy, about how we handle your personal data, or if you wish to exercise any of your rights, please contact us at:
Formidable Media Ltd – Data Protection
Email: privacy@formidable.media
Postal: Dunns Hat Factory, 106–110 Kentish Town Road, London, NW1 9PX, United Kingdom
3. General information on data processing
How we collect and use your personal data depends on how you interact with us and which of our services you use. We only collect, use or share your personal data where we have a legitimate purpose and a lawful basis for doing so.
Where your data is processed to perform a contract or to meet a legal obligation, and you choose not to provide the data we request, we may be unable to provide you with the relevant service.
4. What we mean by “lawful basis”
Consent (Art. 6(1)(a) UK GDPR) – You have given us your consent to process your personal data for a specific purpose we have explained to you. You have the right to withdraw your consent at any time (see the “Exercising your rights” notes throughout this policy).
Contract (Art. 6(1)(b) UK GDPR) – We need to use your data to perform a contract we have with you, or to take steps at your request before entering into a contract.
Legal obligation (Art. 6(1)(c) UK GDPR) – We need to use your data to comply with the law.
Vital interests (Art. 6(1)(d) UK GDPR) – We need to use your data to protect your vital interests or those of another person, for example to prevent serious physical harm.
Public task (Art. 6(1)(e) UK GDPR) – We need to use your data to perform a task carried out in the public interest or in the exercise of official authority.
Legitimate interests (Art. 6(1)(f) UK GDPR) – Processing is necessary to support a legitimate interest of ours or of a third party, provided this is not outweighed by your interests, rights and freedoms.
5. Data sharing and international transfers
To deliver our services we use a number of service providers (processors), and it is sometimes necessary for us to share your personal data with them. We have written agreements in place with these providers that require them to protect your data and to process it only on our instructions.
Some of our providers are based outside the UK, in particular in the United States. Where we transfer your personal data outside the UK, we ensure an equivalent level of protection by relying on one or more of the following safeguards:
•    a transfer to a country that the UK Government has deemed to provide an “adequate” level of data protection;
•    the UK Extension to the EU–US Data Privacy Framework (the “UK–US Data Bridge”), where the recipient is certified under it; or
•    the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, together with appropriate additional safeguards.
You can request a copy of the relevant safeguards by emailing us at the address in section 2.
6. Your rights
Where your personal data is processed, you are a “data subject” under the UK GDPR and have the following rights.
6.1 Right of access (Art. 15 UK GDPR)
You may ask us to confirm whether we are processing your personal data and, if so, to provide a copy of that data together with the following information:
•    the purposes of the processing;
•    the categories of personal data being processed;
•    the recipients or categories of recipient to whom the data has been or will be disclosed;
•    the planned retention period, or the criteria used to determine it;
•    your rights to rectification, erasure, restriction and objection;
•    your right to lodge a complaint with a supervisory authority;
•    where the data was not collected from you, its source;
•    the existence of any automated decision-making, including profiling, and meaningful information about the logic involved and the likely consequences; and
•    where applicable, details of any transfer of your data to a third country or international organisation.
6.2 Right to rectification (Art. 16 UK GDPR)
If the personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected or completed without undue delay.
6.3 Right to restriction of processing (Art. 18 UK GDPR)
You may ask us to restrict the processing of your personal data where:
•    you contest the accuracy of the data, for a period allowing us to verify it;
•    the processing is unlawful and you ask us to restrict its use instead of erasing it;
•    we no longer need the data, but you need it to establish, exercise or defend legal claims; or
•    you have objected to the processing and we are verifying whether our legitimate grounds override yours.
6.4 Right to erasure (“right to be forgotten”) (Art. 17 UK GDPR)
You may ask us to delete your personal data without undue delay where one of the following applies:
•    the data is no longer necessary for the purposes for which it was collected;
•    you withdraw your consent and there is no other lawful basis for the processing;
•    you object to the processing and there are no overriding legitimate grounds, or you object to direct marketing;
•    the data has been processed unlawfully; or
•    the data must be erased to comply with a legal obligation.
This right does not apply where processing is necessary to exercise the right to freedom of expression and information; to comply with a legal obligation or perform a public-interest task; for reasons of public interest in public health; for archiving, scientific or historical research or statistical purposes; or to establish, exercise or defend legal claims.
6.5 Right to data portability (Art. 20 UK GDPR)
Where processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive the personal data you provided to us in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.
6.6 Right to object (Art. 21 UK GDPR)
On grounds relating to your particular situation, you may object at any time to processing based on Art. 6(1)(e) or (f) UK GDPR, including profiling. Where your data is processed for direct marketing, you may object at any time, after which we will stop processing your data for that purpose.
6.7 Right to withdraw consent (Art. 7 UK GDPR)
Where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
7. How to complain
We would always prefer the chance to resolve any concern directly, so please contact us first using the details in section 2. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe our processing of your personal data does not comply with the law:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: https://ico.org.uk
8. Data we process when you visit our website
Description and scope
Each time our website is accessed, our hosting provider’s systems automatically collect certain technical information from your device and store it in server log files, including:
•    your browser type and version;
•    your operating system;
•    the date and time of access;
•    the website from which you reached us (referrer URL); and
•    your (in some cases abbreviated) IP address.
Purpose and lawful basis
This data is necessary to deliver the website to your device, to ensure its stability and security, and to help us optimise it. It is not used for marketing analysis and is not combined with other data sources. The lawful basis is our legitimate interest in the secure, error-free presentation of our website (Art. 6(1)(f) UK GDPR).
Retention
Log-file data is deleted as soon as it is no longer required for these purposes. Where it is retained, it is typically deleted or anonymised so that the calling device can no longer be identified.
9. Hosting
Our website is built and hosted using Webflow, provided by Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, California 94103, USA (“Webflow”). Webflow acts as our processor for the personal data collected through our website and stores and processes data on infrastructure that may be located in the United States.
When you visit our website, Webflow’s servers automatically process the server log-file data described in section 8 in order to deliver and secure the site. Transfers to the United States are protected by the safeguards described in section 5. The lawful basis for this processing is our legitimate interest in providing a secure and reliable website (Art. 6(1)(f) UK GDPR).
For more information on how Webflow processes personal data, see: https://webflow.com/legal/privacy
10. Cookies and similar technologies
Description and scope
Our website uses cookies and similar technologies. Cookies are small text files stored on your device that allow certain information to be recognised by the party that set the cookie. When you first visit our website, and at any time afterwards, you can choose which categories of cookie you allow using our cookie consent banner. You can change your choices at any time via the cookie/consent settings on the website, and you can also manage cookies through your browser settings.
We use both essential and non-essential cookies:
•    Essential cookies are necessary for the basic operation and security of the website and do not require consent.
•    Non-essential cookies (for example analytics, marketing and certain embedded-content cookies) are only set once you have given consent.
Non-essential cookies may process data such as your approximate location, the date and time of your request, your interaction and browsing behaviour on the site, and links between your visit and third-party platforms.
Purpose
Non-essential cookies help us understand how our website is used so we can improve its content, performance and relevance.
Lawful basis
The lawful basis for non-essential cookies is your consent (Art. 6(1)(a) UK GDPR) together with Regulation 6 of the Privacy and Electronic Communications Regulations (PECR). The lawful basis for strictly necessary (essential) cookies is our legitimate interest in operating a secure, functioning website (Art. 6(1)(f) UK GDPR).
11. Contact and enquiry forms
Description and scope
You can contact us using the enquiry forms on our website or by email. When you do, we process the personal data you provide (such as your name, email address and the content of your message) in order to respond to and handle your enquiry.
Purpose and lawful basis
Where your enquiry relates to a possible or existing contract, the lawful basis is the performance of a contract or taking steps at your request before entering into one (Art. 6(1)(b) UK GDPR). Otherwise, the lawful basis is our legitimate interest in responding to enquiries and communicating with you (Art. 6(1)(f) UK GDPR).
Retention
We delete this data once your enquiry has been dealt with and there is no further business or legal reason to keep it, unless a longer retention period is required by law.
Exercising your rights
You can ask us to delete the personal data associated with your enquiry at any time by emailing privacy@formidable.media, unless we are required to retain it.
12. Newsletter
Description and scope
If we offer a newsletter, you can subscribe using the sign-up form on our website. We collect the data you enter (such as your email address and, where requested, your name) together with the date and time of registration. We use this data solely to send you the newsletter and do not share it with third parties for their own purposes.
Purpose and lawful basis
We collect your email address to deliver the newsletter, and any additional data to help prevent misuse of the service. The lawful basis is your consent (Art. 6(1)(a) UK GDPR).
Retention and withdrawal
We store your data for as long as your subscription is active. You can unsubscribe at any time using the opt-out link in every newsletter, which also withdraws your consent. On unsubscribing, we delete the personal data collected for this purpose.
13. Job applications
Description and scope
If you send us a job application by email, we process your email address and the information contained in your application. You will receive confirmation that we have received your documents.
Purpose and lawful basis
We use this data solely to process your application. The lawful basis is taking steps at your request prior to entering into a potential employment contract (Art. 6(1)(b) UK GDPR).
Retention
If your application is unsuccessful, we store your data for up to six months after the process concludes and then delete it, unless a longer period is required by law or you have agreed to us keeping it on file.
14. Our social media profiles
We maintain company profiles on the social networks listed below to share information about our business and services and to communicate with current and prospective clients. If you interact with our profiles (for example by commenting, posting or liking), you may make personal data — such as your username or profile photo — public. As the platforms largely determine how they process your data, we cannot make binding statements about the purpose and scope of that processing; please refer to each platform’s own privacy policy.
Where we process your personal data to communicate with you, the lawful basis is our legitimate interest in responding to enquiries (Art. 6(1)(f) UK GDPR); where the aim is to enter into a contract, Art. 6(1)(b) UK GDPR also applies. Where we process your data to analyse your behaviour, run competitions or conduct lead campaigns, the lawful basis is your consent (Art. 6(1)(a) and Art. 7 UK GDPR). Data generated on these profiles is not stored in our own systems.
You can object at any time to our processing of your personal data in connection with our profiles by emailing privacy@formidable.media, and can exercise your other rights as set out in section 6. Further information and objection options are available from each platform:
Instagram / Meta: https://help.instagram.com/519522125107875
YouTube / Google: https://policies.google.com/privacy
X (formerly Twitter): https://x.com/en/privacy
LinkedIn: https://www.linkedin.com/legal/privacy-policy
15. Third-party services and tools
We use the third-party services described below to operate and improve our website. Unless stated otherwise, services that are not strictly necessary are only activated once you have given consent through our cookie consent banner, and you can withdraw that consent at any time.
15.1 Google Analytics 4
We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google sets cookies on your device and records your interactions with our website as “events”. This may involve processing data such as: your first visit and return visits; your usage path and interactions; clicks on external links; video usage and file downloads; scroll behaviour; on-site searches; language selection; pages visited; approximate location (region); your (abbreviated) IP address; technical information about your browser and device; your internet provider; and the referrer URL.
We use Google Signals, which collects additional information (such as interests and demographics) about users who have ads personalisation enabled and can enable cross-device remarketing. Google Analytics 4 anonymises IP addresses by default, so your IP address is shortened within the UK/EEA before any transfer; only in rare cases is a full IP address transmitted to a Google server in the USA and shortened there.
Purpose: to analyse how our website is used and to generate reports that help us improve its performance and target relevant advertising.
Lawful basis: your consent (Art. 6(1)(a) UK GDPR).
Retention: your data is retained in line with our Google Analytics settings (currently deleted after 2 months) and then automatically removed.
More information: https://policies.google.com/privacy
You may withdraw your consent at any time, with effect for the future, via the cookie/consent settings on our website. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. You can also block or delete cookies in your browser settings, and can object to or opt out of the relevant provider's processing using the links above.
15.2 Meta (Facebook) Pixel
We use the Meta Pixel provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Meta”). The pixel allows us to track actions taken by users who have seen or clicked one of our ads. This may involve processing your on-site activity, device and browser information (including IP address and operating system), and data about the ads displayed. This helps us measure the effectiveness of our advertising for statistical and market-research purposes. Meta may link this information to your Meta account and use it for its own advertising purposes in accordance with its data policy.
Purpose: analysis and optimisation of our advertising.
Lawful basis: your consent (Art. 6(1)(a) UK GDPR).
More information: https://www.facebook.com/privacy/policy
You may withdraw your consent at any time, with effect for the future, via the cookie/consent settings on our website. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. You can also block or delete cookies in your browser settings, and can object to or opt out of the relevant provider's processing using the links above.
15.3 Google Maps
We use Google Maps, provided by Google Ireland Limited (address above) and Google LLC (USA), to display geographic information. When Google Maps loads, information about your use of our website, your IP address and any addresses entered into the route planner may be transmitted to and stored by Google.
Purpose: to present location information in a user-friendly way.
Lawful basis: your consent (Art. 6(1)(a) UK GDPR).
More information: https://policies.google.com/privacy
You may withdraw your consent at any time, with effect for the future, via the cookie/consent settings on our website. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. You can also block or delete cookies in your browser settings, and can object to or opt out of the relevant provider's processing using the links above.
15.4 Google reCAPTCHA
We use Google reCAPTCHA, provided by Google Ireland Limited (address above) and Google LLC (USA), to distinguish human input from automated input and protect our forms from misuse. reCAPTCHA analyses various signals (such as mouse movements, elements clicked, time, IP address, browser and operating system). This data is not associated with any authenticated Google services (such as Gmail) you may use in parallel.
Purpose: to protect our website and forms from spam and abuse.
Lawful basis: your consent (Art. 6(1)(a) UK GDPR).
More information: https://policies.google.com/privacy
You may withdraw your consent at any time, with effect for the future, via the cookie/consent settings on our website. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. You can also block or delete cookies in your browser settings, and can object to or opt out of the relevant provider's processing using the links above.
15.5 Google Fonts
We may use Google Fonts, provided by Google Ireland Limited (address above) and Google LLC (USA), to display text consistently. Where fonts are loaded from Google’s servers, your browser transmits data (including your IP address and browser/operating-system information) to Google in order to retrieve them. If your browser does not support the fonts, a standard font is used.
Purpose: consistent and appealing presentation of our text.
Lawful basis: your consent (Art. 6(1)(a) UK GDPR).
More information: https://policies.google.com/privacy
You may withdraw your consent at any time, with effect for the future, via the cookie/consent settings on our website. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. You can also block or delete cookies in your browser settings, and can object to or opt out of the relevant provider's processing using the links above.
15.6 Adobe Fonts
We may use Adobe Fonts, provided by Adobe Systems Software Ireland Limited, 4–6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland (“Adobe”). Fonts are loaded from Adobe’s servers when a page is called up. Adobe may process data including your IP address, operating system and browser version, along with technical details about the web project delivering the fonts. If your browser does not support the fonts, a standard font is used.
Purpose: consistent and appealing presentation of our text.
Lawful basis: your consent (Art. 6(1)(a) UK GDPR).
More information: https://www.adobe.com/privacy/policy.html
You may withdraw your consent at any time, with effect for the future, via the cookie/consent settings on our website. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. You can also block or delete cookies in your browser settings, and can object to or opt out of the relevant provider's processing using the links above.
15.7 Font Awesome
We may use icons from Font Awesome, a service of Fonticons, Inc., 6 Porter Road, Apartment 3R, Cambridge, MA 02140, USA (“Font Awesome”). When icons are loaded from Font Awesome’s servers, data (including your IP address and browser/operating-system information) may be transmitted to Font Awesome.
Purpose: consistent display of icons on our website.
Lawful basis: your consent (Art. 6(1)(a) UK GDPR).
More information: https://fontawesome.com/privacy
You may withdraw your consent at any time, with effect for the future, via the cookie/consent settings on our website. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. You can also block or delete cookies in your browser settings, and can object to or opt out of the relevant provider's processing using the links above.
15.8 Vimeo
We may embed videos using Vimeo, provided by Vimeo, Inc., 330 West 34th Street, New York, NY 10001, USA (“Vimeo”). When a page with an embedded Vimeo video is loaded, your browser connects to Vimeo’s servers and information about your visit and your IP address is transmitted to Vimeo. This happens whether or not you have a Vimeo account; if you are logged in, Vimeo may link the data to your account.
Purpose: to embed and play videos on our website.
Lawful basis: your consent (Art. 6(1)(a) UK GDPR).
More information: https://vimeo.com/privacy
You may withdraw your consent at any time, with effect for the future, via the cookie/consent settings on our website. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. You can also block or delete cookies in your browser settings, and can object to or opt out of the relevant provider's processing using the links above.
15.9 LinkedIn plugins and Insight Tag
We may use functions of LinkedIn, provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (“LinkedIn”). When you load a page containing LinkedIn functions, or where our LinkedIn Insight Tag is active, a connection is made to LinkedIn’s servers and data such as your IP address, device and browser information and on-site activity may be processed. The LinkedIn Insight Tag creates pseudonymised profiles used to analyse usage and measure campaigns. If you are logged into LinkedIn, it may associate your visit with your account.
Purpose: to improve the usability of our website and to analyse and measure the performance of our LinkedIn campaigns.
Lawful basis: your consent (Art. 6(1)(a) UK GDPR).
More information and ad settings: https://www.linkedin.com/legal/privacy-policy
You may withdraw your consent at any time, with effect for the future, via the cookie/consent settings on our website. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. You can also block or delete cookies in your browser settings, and can object to or opt out of the relevant provider's processing using the links above.
16. Changes to this policy
We may update this policy from time to time to reflect changes in our services, technology or legal requirements. The current version is always available on our website, and the “Last updated” date at the top shows when it was most recently revised.

‍