View Categories

GDPR at PPC Geeks

17 min read

Table of Contents

Downloadable PDF here: GDPR at PPC Geeks Ltd

GDPR at PPC Geeks Ltd #

Personal data usage in the UK is protected by law. The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 set out the principles that organisations, public sector bodies and businesses must follow when collecting, using, storing and sharing personal data.

This policy provides an overarching overview of how PPC Geeks Ltd manages and protects personal data relating to our clients, employees, sales leads and other individuals we interact with in the course of our business.

To ensure that we adhere to UK data protection requirements, we have created the following policies, notices and forms, which outline how our business protects personal data and demonstrate our commitment to complying with data protection legislation:

  • PPC Geeks Ltd Privacy Notice
  • UK GDPR Consent Form
  • UK GDPR Record of Processing Activities
  • UK GDPR Data Request Form
  • UK GDPR Written Verification of Identity Form
  • UK GDPR Right of Erasure Policy

Key documents can be found within our GDPR space on the knowledge base.

It is our responsibility to provide our clients, team members, sales leads and other relevant individuals with clear information about how we collect, use, store and share their personal data.

We must ensure that personal data is processed lawfully, fairly and transparently, only collected and used for appropriate purposes, kept accurate and secure, and retained only for as long as necessary. Where consent is the appropriate lawful basis for processing, we will obtain and record that consent.

We will also advise individuals where personal data is being shared, explain their applicable data protection rights, respond to data subject requests and amend or delete information where legally required.

PPC Geeks does not sell personal data.

We have appointed a Data Protection Administrator, Lee Sinclair, who is the first point of contact for any matters relating to personal data held or processed by PPC Geeks, including personal data relating to clients, employees and sales leads.

Our Lawful Bases for Processing Personal Data #

PPC Geeks will only process personal data where there is an appropriate lawful basis for doing so.

Depending on the circumstances and the purpose of the processing, the lawful bases we may rely on include:

  • Consent – where an individual has given consent for us to process their personal data for a specific purpose. Where processing is based on consent, the individual can withdraw their consent at any time.
  • Contractual necessity – where processing is necessary to enter into or perform a contract with an individual or their organisation.
  • Legal obligation – where we are required to process personal data to comply with a legal or regulatory obligation.
  • Legitimate interests – where processing is necessary for our legitimate business interests, or those of a third party, provided those interests are not overridden by the individual’s rights and freedoms.

The appropriate lawful basis will depend on the specific purpose for which the information is being processed.

Where we rely on legitimate interests, individuals may have the right to object to that processing. If an individual objects, we will stop processing unless we have compelling legitimate grounds that override their interests, rights and freedoms, or we need to continue processing the information for the establishment, exercise or defence of legal claims.

For direct marketing and related profiling or audience matching, we will respect applicable objections and opt-outs.

Client Implications #

In the course of providing our services, we may collect, use and store personal data relating to our clients and their representatives.

This may include:

  • Identity Data
  • Contact Data
  • Financial Data
  • Transaction Data
  • Technical Data
  • Profile Data
  • Usage Data
  • Marketing and Communications Data

The specific personal data we process will depend on our relationship with the client and the services we provide.

We may use client personal data for purposes including:

  • To provide and manage our services
  • To communicate with clients and manage client relationships
  • To provide reports, proposals, recommendations and follow-up communications
  • To process payments and manage financial administration
  • To provide customer and account support
  • To improve our services, systems, marketing and customer relationships
  • To maintain appropriate business, financial, tax and compliance records
  • To protect the security of our systems and information
  • To comply with legal and regulatory obligations
  • To manage our business operations

Client Data Stored Internally #

Some client information is stored internally within our Google Drive and other PPC Geeks systems.

To ensure that we adhere to UK data security requirements, access to this information is restricted to authorised personnel only.

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

Where appropriate, these measures include:

  • Secure hosting and encryption where appropriate
  • Access controls so that only authorised personnel can access personal data
  • Appropriate authentication and account security measures
  • Restricting access to personal data based on legitimate business requirements
  • Regular review and updating of our systems, tools and security measures
  • Appropriate security measures when sharing information with third-party providers
  • Staff awareness and procedures relating to the secure handling of personal data

No system can be guaranteed to be completely secure. However, we take appropriate steps to protect the personal data we hold and to reduce security risks as far as reasonably possible.

Where PPC Geeks processes personal data on behalf of a client as a Data Processor, we will process that data only in accordance with the client’s documented instructions and the terms of the relevant Data Processing Agreement.

In the normal course of our business, PPC Geeks does not seek to access, identify or otherwise use our clients’ customers’ personal data unless this is necessary to provide the agreed services, comply with our legal obligations or is otherwise authorised by the client.

Client Data Shared Externally #

We do not share personal data indiscriminately.

Where necessary to provide our services or operate our business, we may share personal data with trusted third-party service providers and processors where there is an appropriate lawful basis and where the sharing is necessary for a legitimate business, contractual, operational or legal purpose.

Depending on the circumstances, these organisations may process personal data on our behalf as Data Processors, or may process information independently where they act as separate Data Controllers.

Where PPC Geeks processes personal data on behalf of a client as a Data Processor, we will process that data in accordance with the client’s documented instructions and the terms of the relevant Data Processing Agreement.

We may also share personal data where:

  • We are required to do so by law or regulation
  • It is necessary to protect our rights, property, systems or safety, or that of others
  • It is necessary to enforce our terms, policies or agreements
  • We are involved in a merger, acquisition, sale or similar corporate event, where personal data may be transferred as part of the business in accordance with applicable data protection requirements

Third-Party Service Providers #

The third-party organisations we currently use to process or support the processing of personal data include:

This list may be updated from time to time as we introduce, remove or change service providers. Where appropriate, our internal GDPR documentation and Records of Processing Activities will be updated accordingly.

Information Received from Third Parties #

PPC Geeks may receive personal data about individuals from third parties where there is an appropriate lawful basis to do so.

This may include information received from:

  • Advertising platforms such as Google, Meta, Microsoft and LinkedIn
  • Analytics, call tracking and scheduling tools
  • Partners and referrers
  • Publicly available sources such as LinkedIn and Companies House
  • Other third parties where they are lawfully entitled to provide us with the information

This information may be used to support our business activities, including responding to enquiries, managing client and prospect relationships, improving our marketing and services, and carrying out appropriate advertising and audience-matching activities.

Targeted Advertising & Audience Matching #

We may use personal information, such as email addresses and telephone numbers, for targeted advertising and audience matching.

This may involve providing identifiers, including hashed identifiers, to third-party advertising platforms to create, match or manage advertising audiences.

These platforms may include:

  • Google
  • Meta (Facebook and Instagram)
  • Microsoft
  • LinkedIn
  • OpenAI, including advertising services associated with ChatGPT
  • Other similar advertising platforms we may work with from time to time

This activity may involve:

  • Uploading email addresses or telephone numbers directly to an advertising platform
  • Providing hashed identifiers that an advertising platform can attempt to match against its own users
  • Creating or managing audiences based on individuals who have previously interacted with us
  • Showing advertising to existing or prospective customers and other relevant audiences
  • Excluding existing clients or other individuals from particular advertising campaigns where appropriate
  • Creating similar, lookalike or otherwise comparable audiences based on people who have interacted with our business

For example, we may use audience matching to show relevant advertising to individuals who have previously engaged with PPC Geeks, or to exclude existing clients from campaigns intended specifically to acquire new clients.

We only carry out this activity where we have an appropriate lawful basis under data protection law.

Where PPC Geeks carries out audience matching on behalf of a client, we will do so in accordance with the client’s documented instructions and the applicable contractual and data protection requirements.

We will respect applicable opt-outs and objections. Individuals may also request removal from PPC Geeks’ own advertising audiences by contacting our Data Protection Administrator or using the unsubscribe option in our marketing communications where available.

Where an advertising platform processes personal data for its own purposes, its own privacy policy and controls will also apply.

Cookies and Similar Technologies #

Our website may use cookies and similar technologies to:

  • Make the website function properly
  • Remember preferences
  • Understand how visitors use our website
  • Measure and improve our marketing
  • Monitor website performance
  • Support advertising and audience measurement
  • Show more relevant advertising on other websites and platforms, where applicable

Some cookies may be necessary for the website to function.

Where consent is required for optional cookies or similar technologies, we will seek consent through our cookie controls.

Further information about the cookies and similar technologies used on our website is available in our separate Cookie Policy.

Third-party platforms, including Google and Meta, may also use cookies, pixels or similar technologies in connection with advertising and audience measurement. Their own privacy policies and controls apply to their processing of personal data.

International Data Transfers #

Some of our third-party service providers and advertising platforms are based outside the UK and the European Economic Area (EEA), or may process personal data in those locations.

Where personal data is transferred outside the UK, PPC Geeks will take appropriate steps to ensure that the transfer is lawful and that appropriate safeguards are in place in accordance with applicable UK data protection legislation.

These safeguards may include:

  • An adequacy decision made by the UK Government or, where relevant, the European Commission for the destination country
  • Standard Contractual Clauses or other approved contractual protections
  • Other lawful transfer mechanisms or safeguards recognised under applicable data protection legislation

Information about international transfers and the relevant safeguards may also be available within the privacy documentation of the individual service providers.

Employee Implications #

As an employer, we collect, use and store personal data relating to our employees and, where applicable, contractors and other members of our team.

This may include:

  • Identity Data
  • Contact Data
  • Employment Data
  • Financial and Payroll Data
  • Bank and Payment Data
  • Records relating to employment, performance, absence, holidays and benefits
  • Marketing and Communications Data, where applicable

We only collect and process employee personal data where there is an appropriate lawful basis for doing so.

This may include:

  • Fulfilling our employment contract
  • Complying with legal obligations
  • Pursuing legitimate business interests
  • Obtaining consent where appropriate

Employee personal data may be used for purposes including managing employment, payroll and benefits, administering holidays and absence, meeting legal and regulatory requirements, maintaining employment records, managing performance and supporting the operation of the business.

Employee Data Stored Internally #

Employee information is stored internally within our Google Drive and other PPC Geeks systems.

To ensure that we adhere to UK data security requirements, access to employee information is restricted to authorised personnel only.

We use appropriate technical and organisational measures to protect employee personal data against unauthorised access, loss, misuse, alteration or disclosure.

Employee personal data will be retained only for as long as necessary for the purpose for which it was collected, or where we are required to retain it to meet legal, regulatory, accounting or other legitimate business requirements.

Employees can request access to their personal data and can request that inaccurate or incomplete information is corrected. They may also have other rights under applicable data protection legislation.

Employee Data Stored Externally #

Some employee information is processed or stored by external service providers where this is necessary for the operation of our business.

This may include payroll, accounting, pension, HR and other employment-related services.

For example, financial and payroll information may be processed through Xero, which is based in New Zealand.

Here is the Xero privacy policy.

Sales Lead Implications #

We may collect personal data relating to individuals who contact PPC Geeks to enquire about our services.

Inbound sales leads may come through telephone enquiries, email, our website contact forms, referrals or other marketing channels.

Depending on the nature of the enquiry, information provided may include:

  • Name
  • Telephone number
  • Email address
  • Website address
  • Business information
  • Job title
  • The advertising platform they are interested in
  • Current or anticipated monthly advertising spend
  • Information about their current marketing activity
  • Any other information voluntarily provided as part of the enquiry

We may use sales lead information to:

  • Respond to enquiries and requests for information
  • Provide audits, consultations, proposals and recommendations
  • Follow up on potential business opportunities
  • Communicate with prospective clients
  • Improve our services and marketing
  • Manage our sales processes and records

Sales Lead Data Stored Internally #

Sales lead information may be stored within restricted-access PPC Geeks systems, including our secure Google Drive environment.

Access is limited to authorised personnel who require the information for legitimate business purposes.

Sales Lead Data Stored Externally #

Where an enquiry develops into a sales opportunity, relevant information may be uploaded to Pipedrive, our CRM system.

If an audit is required, relevant information may also be added to Asana to enable the audit process to be managed.

These providers are included within our GDPR documentation and Privacy Notice.

We will retain sales lead information only for as long as reasonably necessary for the purposes for which it was collected, including managing the enquiry, following up on potential business opportunities and meeting applicable legal or regulatory requirements.

Data Retention #

PPC Geeks retains personal data only for as long as reasonably necessary for the purposes for which it was collected, unless a longer period is required or permitted by law.

The length of time information is retained will depend on factors including:

  • The purpose for which the information was collected
  • Our ongoing relationship with the individual or their organisation
  • Our contractual obligations
  • Legal, regulatory, accounting or reporting requirements
  • Our legitimate business requirements
  • Whether there is an ongoing need to retain the information for the establishment, exercise or defence of legal claims

When personal data is no longer required, we will securely delete it or anonymise it so that the individual can no longer be identified.

Marketing Communications #

Where we have consent, or where we are otherwise permitted to contact individuals on the basis of legitimate interests, we may send marketing communications including:

  • Newsletters and blog content
  • Invitations to webinars, events and podcasts
  • Offers, updates and information about our services
  • Other relevant information about PPC Geeks and our services

We will respect applicable marketing preferences, opt-outs and objections.

Individuals can unsubscribe from marketing communications at any time by using the unsubscribe link included in our emails or by contacting our Data Protection Administrator.

If an individual unsubscribes from marketing communications, we may still send non-marketing communications that are necessary for service communications, account information, contractual matters or legal notices.

Data Breaches #

Should any personal data that we control be lost, stolen or otherwise subject to a personal data breach, we will assess the breach and take appropriate action in accordance with applicable data protection legislation.

Where a breach is likely to result in a high risk to an individual’s rights and freedoms, we will contact the affected client, lead, employee or other relevant individual without undue delay where required by law.

We will provide appropriate information about the nature of the breach, the steps we are taking to address it and any actions individuals should take to protect themselves.

Data Protection Rights #

Depending on the circumstances and the applicable lawful basis for processing, individuals may have rights in relation to their personal data, including:

  • The right of access – to request a copy of their personal data
  • The right to rectification – to request correction of inaccurate or incomplete data
  • The right to erasure – to request deletion of personal data in certain circumstances
  • The right to restrict processing – to request restriction of processing in certain circumstances
  • The right to object – to object to certain types of processing, including processing based on legitimate interests and certain direct marketing activities
  • The right to data portability – to request transfer of personal data in certain circumstances
  • The right to withdraw consent – where processing is based on consent

These rights are not absolute and may not apply in every circumstance. Where an exemption applies, or where PPC Geeks has another lawful reason to continue processing personal data, this will be explained when responding to a request.

Requests should be directed to our Data Protection Administrator.

We may need to request additional information to confirm an individual’s identity before acting on a request.

Complaints #

If a client, employee, sales lead or other individual has concerns about the way PPC Geeks collects, processes, stores or uses personal data, they should initially contact our Data Protection Administrator so that we can investigate and respond to the concern.

Individuals also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent supervisory authority for data protection.

The ICO can be contacted via:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom

ICO website – www.ico.org.uk

Our Approach to Data Protection #

Data protection is an ongoing responsibility for PPC Geeks.

We regularly review our processes, systems and suppliers to ensure that personal data is handled appropriately and securely.

Everyone within PPC Geeks who has access to personal data is responsible for ensuring that it is handled in accordance with our policies, procedures and applicable data protection legislation.

Our Privacy Notice provides individuals with further information about how PPC Geeks collects, uses, stores and shares personal data and should be read alongside this overarching policy.

What are your Feelings

Powered by BetterDocs