Privacy Policy

Last Updated: August 20, 2026

At Crush, your privacy matters to us. This Privacy Policy explains how Palwon Group LTD, trading as Crush ("Crush", "we", "us", or "our"), collects, uses, stores, shares, and protects personal information when you visit our website, purchase our services, submit a project brief, request information, or otherwise interact with us.

Palwon Group LTD is a company registered in the Republic of Cyprus and acts as the data controller for the personal information described in this Privacy Policy.

Registered Address: [PALWON GROUP LTD REGISTERED ADDRESS]

Company Registration Number: [COMPANY NUMBER]

Privacy Contact: [CRUSH PRIVACY EMAIL]

This Privacy Policy should be read together with our Terms of Use and any applicable Cookie Policy.

1. Information We Collect

The information we collect depends on how you interact with Crush.

1.1 Information You Give Us

When you purchase a service, request information, complete a project brief, request a Brand Audit, or communicate with our team, we may collect information such as:

• Your name
• Email address
• Company or brand name
• Billing and order information
• Project requirements and creative preferences
• Brand materials, files, images, references, and other content you submit
• Feedback, approvals, and revision requests
• Messages and other communications with our team
• Information submitted through contact, project, or lead-generation forms

Please avoid submitting personal information that is not reasonably necessary for us to complete your project.

1.2 Payment Information

Payments are processed through third-party payment providers.

Depending on the payment method available at checkout, these providers may collect payment-card details, billing information, transaction information, and other information necessary to process your payment.

Crush does not directly store complete payment-card details, such as your full card number or security code.

We may receive limited transaction information from payment providers, including payment status, transaction identifiers, billing details, and amounts paid.

1.3 Information Collected When You Use Our Website

When you visit the Crush website, certain technical information may be collected automatically, including:

• IP address
• Browser and device type
• Operating system
• Pages visited
• Referral source
• Approximate location derived from your IP address
• Time spent on pages and interactions with the Website
• Cookie identifiers and similar technical information

We use this information to operate our Website, understand how visitors interact with it, improve performance, and measure our marketing.

1.4 Marketing Information

If you subscribe to our emails, request a Brand Audit, submit a lead form, or otherwise consent to receiving marketing communications, we may process your name, email address, marketing preferences, and engagement with our communications.

You can unsubscribe from marketing communications at any time.

2. How We Use Your Information

Depending on the circumstances, we may use your information to:

• Process and manage your order
• Deliver our logo, branding, website, advertising, and other creative services
• Review project briefs and submitted materials
• Communicate with you about concepts, revisions, approvals, and final delivery
• Provide customer support
• Process and verify payments
• Maintain appropriate records of orders and client projects
• Prevent fraud, abuse, and payment disputes
• Operate, secure, and improve our Website
• Understand Website performance and visitor behaviour
• Measure advertising and marketing performance
• Send marketing communications where permitted
• Comply with accounting, tax, legal, and regulatory obligations
• Establish, exercise, or defend legal claims

3. Legal Bases for Processing

Under applicable data-protection law, including the General Data Protection Regulation (GDPR), we generally rely on one or more of the following legal bases:

• Contract: Where processing is necessary to provide services you have purchased or requested.
• Consent: Where you have given us permission for a particular activity, including certain marketing activities or the use of non-essential cookies and tracking technologies.
• Legitimate Interests: Where processing is reasonably necessary to operate and improve Crush, provide customer support, prevent fraud, protect our business, or understand how our services are used, provided those interests do not override your rights and freedoms.
• Legal Obligation: Where we are required to process or retain information to comply with applicable laws, accounting requirements, tax obligations, or lawful requests.

Where we rely on consent, you may withdraw that consent at any time.

4. Cookies, Google Analytics & Meta Pixel

Crush uses cookies and similar technologies to operate our Website, understand how visitors use it, measure performance, and evaluate our marketing campaigns.

We currently use:

• Google Analytics to understand Website traffic, visitor behaviour, page performance, and how users interact with our Website.
• Meta Pixel to measure the effectiveness of advertising campaigns, understand actions visitors take after interacting with our advertisements, and improve advertising performance on Meta platforms such as Facebook and Instagram.
• Essential cookies and technologies required for the Website and its core functionality.

Google Analytics and Meta Pixel may collect information such as:

• IP address
• Browser and device information
• Website activity
• Pages visited
• Referral information
• Cookie and device identifiers
• Interactions and actions taken on our Website

Where required by applicable law, Google Analytics, Meta Pixel, and other non-essential tracking technologies will only be activated after you provide consent through our cookie consent system.

You can accept, reject, or manage non-essential cookies through the cookie controls available on our Website. Where applicable, you may also withdraw or change your consent at any time.

Google and Meta may process information collected through these technologies in accordance with their own privacy policies and may process certain information outside the European Economic Area ("EEA").

Where required by applicable law, appropriate safeguards are used for international data transfers.

We may add, remove, or change analytics and advertising technologies as our Website develops. Where necessary, this Privacy Policy and our cookie controls will be updated accordingly.

5. How We Share Information

Crush does not sell or rent your personal information.

We may share limited personal information with third parties where reasonably necessary to operate our business and provide our services.

These may include:

• Payment and transaction providers
• Website and e-commerce providers
• Email and customer-communication platforms
• Cloud storage and file-management providers
• Analytics and advertising providers, including Google and Meta
• Designers, contractors, and service providers involved in delivering your project
• Accounting, legal, and professional advisers
• Authorities, regulators, or other parties where disclosure is legally required

These parties may only receive information reasonably necessary for their role and are expected to process personal information in accordance with applicable privacy and data-protection requirements.

6. Designers & Creative Partners

Crush may work with employees, freelance designers, contractors, or other creative professionals to deliver client projects.

Where necessary to complete your project, relevant project information and materials may be shared with the individuals assigned to your project.

We aim to limit access to information that is reasonably necessary for them to perform their work.

Our designers and contractors are required to handle client information and project materials appropriately and confidentially.

7. International Data Transfers

Some of the technology providers, contractors, or service providers used by Crush may operate or process personal information outside Cyprus or the European Economic Area ("EEA").

Where personal information is transferred outside the EEA, we take appropriate steps where required to ensure that the information receives an adequate level of protection.

This may include relying on:

• An adequacy decision adopted by the European Commission
• Standard Contractual Clauses approved by the European Commission
• Other lawful transfer mechanisms permitted under applicable data-protection law

8. How Long We Keep Information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable legal, accounting, tax, contractual, and dispute-resolution requirements.

Retention periods may vary depending on the type of information. For example:

• Order and transaction records may be retained for the period required by applicable accounting and tax laws.
• Client communications may be retained while reasonably necessary for project support, record keeping, and dispute resolution.
• Project files may be retained for a reasonable period after completion to provide support, retrieve deliverables, maintain appropriate business records, and manage our portfolio.
• Marketing information may be retained until you unsubscribe, withdraw consent where applicable, or we determine that it is no longer necessary.

When information is no longer required, we may delete or securely anonymise it.

9. Your Data Protection Rights

If the GDPR or other applicable data-protection laws apply to you, you may have the right to:

• Request access to personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal information in certain circumstances
• Request restriction of certain processing
• Object to processing based on legitimate interests
• Withdraw consent where processing is based on consent
• Request portability of certain personal information
• Opt out of marketing communications
• Lodge a complaint with an appropriate data-protection authority

These rights are not absolute and may be subject to exceptions under applicable law.

To exercise a privacy right, contact us at hello@crush-studio.com

We may need to verify your identity before completing certain requests.

10. Marketing Communications

Where permitted by law, Crush may send you emails about our services, offers, branding insights, project updates, Brand Audits, or other relevant content.

Marketing communications are separate from essential transactional communications relating to an active order or project.

You can unsubscribe from marketing emails at any time by using the unsubscribe option included in our emails or by contacting us.

Unsubscribing from marketing communications does not prevent us from sending necessary service-related communications regarding an active order or project.

11. Security

We use reasonable technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration, loss, destruction, or misuse.

Payment information is processed through third-party payment providers, and Crush does not directly store your complete payment-card details.

However, no internet-based service or electronic storage method can guarantee absolute security.

Clients are also responsible for using appropriate security measures when sending sensitive project information and for protecting access to their own accounts and communications.

12. Third-Party Websites & Services

Our Website may contain links to third-party websites, services, social platforms, or other external resources.

Crush is not responsible for the privacy practices, content, or security of independent third parties.

When you interact directly with another provider, its own privacy policy and terms may apply.

We encourage you to review the privacy information provided by those services where appropriate.

13. Children's Privacy

Crush's services are intended for businesses and individuals aged 18 or older.

We do not knowingly collect personal information from children through our services.

If we become aware that personal information from a child has been collected inappropriately, we will take reasonable steps to remove it.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology, business operations, or legal requirements.

When changes are made, we will update the "Last Updated" date at the top of this page.

Where required by law, we will provide additional notice or obtain consent before materially changing how personal information is processed.

15. Contact & Privacy Requests

If you have questions about this Privacy Policy, how Crush processes your personal information, or wish to exercise a data-protection right, please contact:

Palwon Group LTD

Trading as Crush

[PALWON GROUP LTD REGISTERED ADDRESS]

Republic of Cyprus

Company Registration Number: [COMPANY NUMBER]

Email: [CRUSH PRIVACY EMAIL]

If you believe your personal information has been processed in violation of applicable data-protection law, you may also have the right to submit a complaint to the relevant supervisory authority.