Thank you to everyone who replied (I'm the OP of this thread).
I removed the work, reasoning it was old and not essential for my business. However, I wanted to know if Company A's legal threats were justified, so I requested the contract - which I strongly suspected didn't exist - and other information with a SAR. Company A's director then:
posted abusive messages on social media, along with abusive emails (I didn't respond)
refused to provide contract details
threatened to discredit me with my employer and industry peers
Eventually, after much discussion, Company A's director admitted:
there was no contract or NDA
there was no transferral of ownership, or waiver of my right to be identified as author
involving a solicitor was unnecessary
his abusive emails/ social media posts were unreasonable, untrue and unprovoked
Finally the director apologised... then asked if I'd like to continue displaying the work on my website. That was roughly the moment my jaw hit the floor. No thanks.
I'm left with one question:
If there was no contract between us, what basis exists for Company A to make legal threats?
Company A's director claimed his solicitor 'found a way' — but couldn't/ wouldn't explain what this was. Something doesn't add up.