01Introduction
This privacy policy explains how Advertising 4 Trades ("A4T", "we", "us", "our") collects, uses, shares and protects your personal data when you visit advertising4trades.co.uk or use any of our services.
We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
Plain English summaryWe only collect what we need, only use it to deliver the services you've asked for, never sell it, and you can get it back or wipe it any time.
02Who we are
For the purposes of UK GDPR, the data controller is:
03Data we collect
Information you give us directly
- Contact details — name, business name, email, phone, postal address (when you fill in a contact, demo or ticket form)
- Account information — username, password (hashed), billing details for subscriptions
- Business information — trade, service area, monthly enquiry volume, pricing rules, branding assets you upload
- Communications — emails, chat messages, support tickets, reviews you submit
Information we collect automatically
- Usage data — pages visited, time on page, click paths, referring URLs
- Device data — IP address, browser type, operating system, screen size
- Cookies and similar technologies — see our cookie policy for details
Information from third parties
We may receive data about you from third-party services we integrate with (such as HubSpot, Google or Stripe) where you've authorised the connection.
04How we use your data
We use your personal data to:
- Deliver, maintain and improve our services
- Process payments and manage your subscription
- Communicate with you about your account, demos, support and service updates
- Send marketing communications you've consented to (you can unsubscribe at any time)
- Detect, prevent and respond to fraud, security incidents and policy violations
- Comply with our legal obligations
- Analyse how our services are used so we can make them better
05Legal basis for processing
Under UK GDPR, we must have a lawful basis for processing your personal data. The bases we rely on are:
- Contract — to deliver the services you've asked us to provide
- Legitimate interest — to run, secure and improve our business (you can object to this at any time)
- Consent — for marketing communications and non-essential cookies (you can withdraw at any time)
- Legal obligation — to comply with UK tax, accounting and other regulatory requirements
06Sharing & third parties
We never sell your personal data. We only share it with third parties when necessary to deliver our services, and only under strict data-processing agreements.
Service providers we use
- Hosting & infrastructure — Amazon Web Services (UK), Cloudflare
- Payments — Stripe, GoCardless
- Email delivery — Postmark, SendGrid
- Analytics — Google Analytics (anonymised)
- CRM integration — HubSpot (only if you've connected it)
- AI services — OpenAI / Anthropic (for AI quoting and design previews; no personal data is retained by the AI provider for training)
We may also disclose your data if required by law, court order, or to protect our or others' rights, property or safety.
07How long we keep your data
We only keep your personal data for as long as we need to:
- Active customer data — for the duration of your subscription, plus 90 days after cancellation (for re-activation grace)
- Billing records — 7 years (UK accounting law requirement)
- Leads and prospects — 24 months from last contact, then deleted automatically
- Support tickets — 3 years for audit purposes
- Marketing list subscribers — until you unsubscribe, plus 30 days for proof of opt-out
08Your rights
Under UK GDPR you have the following rights:
- Access — get a copy of the personal data we hold about you
- Rectification — correct inaccurate or incomplete data
- Erasure ("right to be forgotten") — ask us to delete your data, subject to legal exceptions
- Restriction — limit how we process your data
- Portability — receive your data in a machine-readable format
- Object — to processing based on legitimate interest, including direct marketing
- Withdraw consent — for any processing based on consent
- Automated decision-making — we don't make decisions about you using automated processing alone
To exercise any of these rights, email privacy@advertising4trades.co.uk. We respond within 30 days.
09International data transfers
Most of your data stays in the UK. Where we transfer data to providers outside the UK (e.g. US-based email services), we ensure adequate protection through one or more of:
- UK International Data Transfer Agreement (IDTA)
- EU Standard Contractual Clauses (SCCs)
- Adequacy decisions by the UK government
10Security
We use industry-standard measures to protect your data, including:
- TLS/SSL encryption in transit
- Encryption at rest for all stored personal data
- Role-based access controls (only authorised staff see sensitive data)
- Regular security patching and vulnerability scanning
- Two-factor authentication available on all user accounts
- Daily backups with 30-day retention
No system is 100% secure. If we ever experience a breach affecting your data, we'll notify you and the ICO within 72 hours as required by law.
11Children
Our services are not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we'll delete it.
12Cookies
We use cookies and similar technologies on our website. For full details of what cookies we set and how to control them, see our cookie policy.
13Third-party links
Our website may link to third-party websites (e.g. Calendly, customer platforms, social media). Those sites have their own privacy policies — we recommend you review them. We're not responsible for the content or practices of third-party sites.
14Changes to this policy
We may update this policy from time to time. The "last updated" date at the top reflects the most recent change. Material changes will be notified to you by email or via a prominent notice on the website at least 14 days before they take effect.
