1. Who we are

Duma Media Ltd is an online advertising agency registered in England and Wales with company number 17332762. Our registered office is 167-169 Great Portland Street, 5th Floor, London W1W 5PF.

We are the controller of the personal data described in this notice, which means we decide how and why it is used.

Contact us about anything in this notice at privacy@dumamedia.co.uk or by post to our registered office.

2. Who this notice covers

This notice explains how we use personal data about:

• people who visit our website, dumamedia.co.uk;

• people who contact us, request our price list, book a call or subscribe to our emails;

• contacts at our clients, including people who use our client portal at portal.dumamedia.co.uk;

• contacts at our partners, referrers, advertisers and suppliers.

Work we do for clients. When we work in a client’s ad accounts, analytics or customer lists, the client is the controller of that data and we act as their processor under a data processing agreement. If your data is in one of our clients’ accounts, please contact that business about it. We will help them answer your request.

3. The data we collect

• Contact and identity details: your name, job title, business name, work email address and phone number.

• Enquiry details: your website, monthly ad budget, the services you are interested in, and anything you write in a form, email, message or call booking.

• Account and billing details: your billing address, company number, order and payment history, credit balance, requests, files and messages in the client portal. Card payments are handled by Stripe. We never see or store your full card details.

• Call details: the time and details of calls you book with us, and our notes of the call. We do not record calls unless we ask you first.

• Marketing preferences: whether you subscribed to our emails, when and how, and any changes you make.

• Website usage data: your IP address, device and browser type, pages visited and how you found us. Analytics and marketing cookies are only used if you agree. See section 8.

• Partner details: for partners and advertisers, your business details, the referrals or placements we agree, and payment details for fees we pay or receive.

We do not ask for special category data, such as health information, and we ask you not to send it to us.

4. Where we get it

Most data comes from you, when you fill in a form, email us, book a call, buy from us or use the client portal. We also receive data from:

• Stripe, which confirms your payments;

• partners who refer you to us, who share your contact details with your agreement;

• public sources, such as Companies House, your company website and professional networking sites, when we research a business before contacting it;

• analytics and advertising providers, if you agree to cookies, which tell us how people use our site and respond to our ads.

5. How we use it, and our lawful basis

Data protection law requires a lawful basis for each use of personal data. Ours are:

Reply to enquiries, send the price list you asked for and hold calls you book: Our legitimate interest in responding to people who contact us

Provide the services you buy, run your portal account, take payment and send service messages: Performing our contract with your business, or our legitimate interest where you are a contact at a client

Keep accounting, tax and company records: Legal obligation

Send our monthly email and occasional offers: Your consent. For contacts at limited companies, we may rely on our legitimate interest in marketing similar services to businesses, and you can opt out at any time

Contact businesses we think could benefit from our services: Our legitimate interest in growing our business, using work contact details only and always with an easy way to opt out

Manage partner referrals, advertising placements and supplier relationships: Performing our contract with the partner, or our legitimate interest

Measure and improve our website and our own advertising: Your consent, given through our cookie banner

Keep our systems secure and prevent fraud: Our legitimate interest in protecting our business and clients

Deal with complaints and legal claims: Our legitimate interest, or legal obligation

Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can ask us for details of that assessment.

6. Marketing emails

We only send marketing emails to individuals and sole traders who have agreed, or who are existing customers buying similar services. For contacts at companies, we may send relevant business emails without prior consent, as the law allows.

Every marketing email has an unsubscribe link. You can also email privacy@dumamedia.co.uk or use the email preferences page on our website. Once you opt out, we keep only what we need to make sure we do not email you again.

7. Automated decisions

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

8. Cookies

We use strictly necessary cookies to run our website and remember your choices. Analytics cookies (Google Analytics and Microsoft Clarity, loaded through Google Tag Manager) and marketing cookies (from Google Ads, Microsoft Advertising, Meta (Facebook and Instagram), Reddit, X, OpenAI (ads in ChatGPT), LinkedIn and TikTok, when we advertise with them) are only set if you agree. Until you agree, nothing is sent to Google Analytics or Clarity. You can change your choice at any time from Cookie settings at the bottom of every page. Our cookie policy gives full details.

9. Who we share it with

We never sell your personal data. We share it only with:

Squarespace: Hosts our website and receives website form submissions

ManyRequests: Runs our client portal, where you make requests and share files

Stripe: Processes card payments and subscriptions

Microsoft: Email, calendar, call booking (Microsoft Bookings), Teams calls, file storage and website analytics (Microsoft Clarity), Clarity only if you accept analytics cookies

Zapier: Automates tasks between our portal and other tools

Google: Website analytics (Google Analytics and Google Tag Manager) and Search Console, analytics only if you accept analytics cookies

Google Ads, Microsoft Advertising, Meta (Facebook and Instagram), Reddit, X, OpenAI (ads in ChatGPT), LinkedIn and TikTok: Measuring our own advertising when we advertise with them, only if you accept marketing cookies

Our bank and accountant: Payments, bookkeeping and tax

Squarespace Email Campaigns: Sends our monthly email to subscribers

Each supplier acts on our instructions under a contract that protects your data, except where it acts as a separate controller for its own legal duties, such as Stripe for fraud prevention and financial regulation. The advertising platforms also use what their tracking code collects for their own purposes, as their privacy notices explain. If you accept marketing cookies and fill in a form on our website, some of their tracking code (such as OpenAI’s) may also read the email address or phone number you enter and send it in a scrambled form that can’t be read, so the platform can match your visit to an account you have with them.

We may also share data with professional advisers, such as lawyers and insurers, with authorities where the law requires it, and with a buyer if our business is sold, in which case your data would stay protected by this notice.

If a partner referred you, we tell them only whether you became a client and the amounts needed to calculate their fee.

10. Data outside the UK

Some of our suppliers store or access data outside the UK, including in the European Economic Area and the United States. When they do, we make sure the transfer is protected, by relying on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Contact us for details.

11. How long we keep it

Enquiries that do not lead to work: 2 years from our last contact

Client account, contract and billing records: 6 years after the end of the financial year they relate to

Client portal requests, files and messages: While you are a client, then 2 years, unless you ask us to delete them sooner

Call notes: 2 years, or as long as you remain a client

Email subscribers: Until you unsubscribe, then a suppression record only

Website analytics: 14 months

Partner and supplier records: 6 years after the relationship ends

We may keep data longer if we need it for a legal claim or the law requires it.

12. How we keep it safe

We use well-known, secure suppliers, two-step sign-in on our accounts, encryption whenever data is sent, and access limited to the people who need it. If a personal data breach is likely to put your rights at risk, we will report it to the Information Commissioner’s Office (ICO) within 72 hours and tell you without undue delay where the law requires it.

13. Your rights

You have the right to:

• access the personal data we hold about you;

• correct data that is wrong or incomplete;

• delete your data, where there is no good reason for us to keep it;

• restrict how we use your data while a concern is looked into;

• object to our use of your data based on legitimate interests, and to direct marketing at any time;

• move data you gave us to another provider, where we use it based on consent or contract;

• withdraw consent at any time, where we rely on consent.

Email privacy@dumamedia.co.uk to use any of these rights. We will reply within one month. We may need to confirm your identity first. There is no charge unless a request is clearly unfounded or excessive.

14. Complaints

If you are unhappy with how we have handled your data, please tell us first at privacy@dumamedia.co.uk. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay.

You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

15. Children

Our services are for businesses. Our website is not aimed at children, and we do not knowingly collect data about anyone under 18.

16. Links to other websites

Our website links to other sites, such as partners and tools we recommend. We are not responsible for their privacy practices, so please read their own policies.

17. Changes to this notice

We will update this notice when our practices or the law change, and show the date of the latest version at the top. If a change is significant, we will tell clients and subscribers by email.