Privacy Policy

1. Who we are

Talk To Media Ltd is a limited company registered in England under company number 05193262, at Unit 19, Jetstream Drive, Fountain Court, Auckley, Doncaster, DN9 3QS. We are a digital marketing and web services agency.

Our data protection contact is Paul Gregory, datacontroller@talktomedia.co.uk, 01302 613000.

2. What this policy covers

This policy covers Talk To Media Portal, our internal business system. It explains what data the application holds, why, and how long for.

It does not cover our public website. Visitors to talktomedia.co.uk are covered by the privacy policy published there.

3. Who uses the application

Talk To Media Portal is used only by Talk To Media Ltd staff. Accounts are created by invitation from an administrator. There is no public registration and the application is not made available to third parties.

4. Personal data we process

Staff records

For each member of staff we hold a name, work email address, role, department, reporting line, working pattern, holiday entitlement and balances, start date, date of birth, and records of time logged against client work. We process this to operate the business — scheduling, time recording, billing and holiday administration — on the basis of our legitimate interests in running the company and of our employment relationship with each member of staff.

Client contacts

For each client we hold the organisation's name and the name, email address and telephone number of our contacts there, together with notes and records of work carried out. We process this to manage and deliver our services, on the basis of our legitimate interests and of our contract with the client.

5. Data we retrieve from Google

Where a client's advertising account is connected, Talk To Media Portal uses the Google Ads API to retrieve reporting data for that account: impressions, clicks, cost, conversions and conversion values, together with breakdowns of those figures by campaign, ad group, keyword, device, location and conversion action. We may connect Google Analytics for the same reporting purpose.

This is aggregate performance data about advertising accounts. It is not a record of identifiable individuals, and we do not use the Google Ads API to retrieve information about individual people.

Access is read-only. We retrieve reporting data only. The application does not create, modify, pause or delete campaigns, budgets, keywords or any other advertising entity, and makes no automated changes to any account.

Access is authorised by a Google account belonging to Talk To Media Ltdwhich has been granted access to the relevant Google Ads manager account. That authorisation can be withdrawn at any time from the Google account's security settings, which stops all further retrieval.

Limited use. Our use of data received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use this data only to provide reporting within Talk To Media Portal. We do not use it for advertising, we do not sell it, we do not transfer it to others except as necessary to provide and secure the application or where required by law, and we do not allow humans to read it except our own authorised staff for the purposes described here.

6. Our role

We are the data controller for staff records and for the contact details of our clients' personnel. Advertising account data belonging to a client is processed on that client's behalf, under the service agreement we hold with them.

7. How long we keep data

Advertising performance data is retained at daily detail for 25 months, so that a reporting period can always be compared with the same period a year earlier. Monthly summaries are retained beyond that for longer-term trend reporting. Data for an account is deleted when that account is disconnected from the application.

Staff and client records are retained for the duration of the relationship and for as long afterwards as we are required to keep business records, then deleted.

8. Where data is held, and who processes it

Application data is held in a database hosted by Supabase in the London region of Amazon Web Services (eu-west-2). The application itself is hosted by Vercel. Staff sign-in is handled by Microsoft Entra ID where a company Microsoft account is used. Advertising data originates from Google.

These providers process data on our behalf under their respective terms. We do not sell data to anyone, and we do not share it with third parties for their own purposes.

9. Security

Access requires an individual account and is limited to authorised staff. Database access is restricted by row-level security policies, credentials for third-party services are held as encrypted environment variables rather than in the database, and all traffic is encrypted in transit.

10. Your rights

If we hold personal data about you, you have the right to ask for a copy of it, to have it corrected or erased, to restrict or object to how we use it, and to ask us to transfer it. To exercise any of these, contact datacontroller@talktomedia.co.uk.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk.

11. Changes

If we change how the application handles data we will update this policy and the date shown at the top. Use of the application is also subject to our terms of use.