Privacy Policy
Last updated: 25 June 2026
Odd Duck Digital Ltd ("we", "us", "our", "the Company") is a digital marketing agency registered in England and Wales. This policy explains how we collect, use, store, and protect personal data when you use our website (oddduck.digital), engage us for marketing services, or otherwise interact with us.
We take your privacy seriously. We process personal data only as described in this policy and only on lawful bases under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
Data Controller: Odd Duck Digital Ltd
Registered office: 125 Kestrel Park, Skelmersdale, WN8 6TA, United Kingdom
Company number: [pending — insert once issued by Companies House]
ICO registration: Registration pending; certificate expected. ICO reference number will be added here once issued.
Contact: tom@oddduck.digital
For any privacy-related questions or to exercise your rights under section 8 below, contact us at tom@oddduck.digital.
2. What personal data we collect
We collect personal data in three contexts:
2.1 Data you give us directly
When you contact us, become a client, or otherwise communicate with us, you may provide:
- Your name
- Your email address
- Your phone number (if you call or message us)
- Your business name, job title, and company address
- Project briefs, brand assets, and other information you share to enable our services
- Payment and invoicing information (bank details, billing address)
2.2 Data we collect through providing services to you
When we run digital advertising, search engine optimisation, or other marketing services on your behalf, we necessarily process:
- Your advertising account identifiers (Meta Ad Account ID, Google Ads Customer ID, etc.)
- Your business pages, social profiles, and connected platforms (page IDs, IG business account IDs, Google Business Profile IDs, Shopify store URLs, etc.)
- Your customers' behavioural data as observed through ad platforms (impressions, clicks, conversions, audience signals) — see section 4 on sub-processors
- Performance data for the campaigns we run on your behalf
- Authentication tokens and API access credentials needed to operate ad accounts and connected platforms on your authorisation
2.3 Data collected automatically when you visit oddduck.digital
Our website does not use cookies and does not deploy third-party analytics or tracking scripts. We do not collect IP addresses, browser fingerprints, or any other data through automated means on our website. If this changes in future, we will update this policy and obtain consent where required.
3. How we use your data and why
Under UK GDPR, we must have a lawful basis for each use of your personal data. The bases we rely on are:
| Purpose | Lawful basis | Data categories |
|---|---|---|
| Responding to enquiries you send us | Legitimate interest (responding to your request) | Name, email, message content |
| Providing marketing services to clients | Contract performance | All data described in 2.2 above |
| Invoicing and payment | Contract performance / legal obligation (tax records) | Name, business address, payment details |
| Tax and accounting record-keeping | Legal obligation (HMRC requirements) | Invoices, payment records — kept 6 years minimum |
| Operating and securing our IT systems | Legitimate interest (running our business securely) | Email content, file metadata |
| Defending or bringing legal claims | Legal obligation / legitimate interest | Relevant records, retained per limitation periods |
We do not sell personal data to third parties. We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.
4. Who we share your data with (sub-processors)
To deliver our services, we share data with the following categories of third parties. Each acts on our documented instructions under a data processing agreement (or equivalent contractual safeguards):
| Sub-processor | Purpose | Data shared |
|---|---|---|
| Google LLC (Gmail, Google Workspace, Google Ads, Google Analytics, Google Search Console, Google Tag Manager) | Email, document storage, advertising platforms, analytics | Email content, file content, ad account data, audience signals |
| Meta Platforms, Inc. (Facebook, Instagram, WhatsApp, Marketing API) | Social media advertising, page management, customer messaging | Ad account data, page IDs, audience signals, conversion events |
| LinkedIn Corporation (LinkedIn Ads, LinkedIn Pages) | B2B advertising and page management | Ad account data, page IDs, audience signals |
| Hetzner Online GmbH | Server hosting for our internal tools and infrastructure | Server logs, stored data |
| SendFox | Email list management for our newsletter | Email address |
Some of these sub-processors are based outside the UK. Where personal data is transferred outside the UK, we rely on the relevant adequacy decision, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, as applicable. Specifically:
- Google, Meta, and LinkedIn operate under their respective UK GDPR adequacy arrangements and the EU-US Data Privacy Framework where applicable.
- Hetzner is based in the EU/EEA — transfers are intra-EEA, treated as equivalent to UK transfers.
A current list of sub-processors is maintained on request; email tom@oddduck.digital.
5. How long we keep your data
| Data category | Retention period | Reason |
|---|---|---|
| Enquiry emails and contact form submissions | 12 months from last contact | Reasonable period to handle enquiries and re-engagement |
| Client project files, briefs, creative assets | 7 years after project completion | Defending legal claims; tax record obligations overlap |
| Invoicing and payment records | 7 years from transaction date | HMRC legal requirement |
| Advertising account authentication tokens | Duration of engagement + 30 days for client offboarding | Operational necessity; auto-revoked where platform supports it |
| Campaign performance data and analytics | 26 months (default Google Analytics retention; Meta equivalent) | Trend analysis and reporting cycles |
| Email correspondence with clients | 7 years from end of engagement | Defending legal claims; business record continuity |
When the retention period expires, we delete or anonymise the data. Anonymised data (e.g., aggregated campaign benchmarks that cannot identify any individual) may be retained indefinitely.
6. How we protect your data
We take appropriate technical and organisational measures to protect personal data, including:
- Encryption of devices and storage at rest
- Two-factor authentication on all business-critical accounts
- Password manager with unique, generated passwords per service
- Access controls limiting personal data access to staff who need it for their role
- Regular review of sub-processor security posture
- Incident response process — any breach is reported to the ICO and affected individuals within statutory timeframes (72 hours to ICO; without undue delay to individuals where there is a high risk to their rights)
No system is perfectly secure. If you have reason to believe your data has been compromised through our systems, please contact tom@oddduck.digital immediately.
7. Where your data is stored
Your data is primarily stored:
- On Google Workspace servers (UK / EEA regions where configured; otherwise US)
- On our local secure infrastructure hosted by Hetzner (Germany / Finland)
- On the servers of our sub-processors as detailed in section 4
Where data is transferred outside the UK, we rely on the safeguards detailed in section 4.
8. Your rights
Under UK GDPR, you have the following rights in relation to your personal data:
- Right of access — request a copy of the personal data we hold about you
- Right to rectification — ask us to correct inaccurate or incomplete data
- Right to erasure ("right to be forgotten") — ask us to delete your data in certain circumstances
- Right to restrict processing — ask us to suspend processing in certain circumstances
- Right to data portability — receive your data in a structured, machine-readable format
- Right to object — object to processing based on legitimate interest, and object to direct marketing at any time
- Right to withdraw consent — where we rely on consent as our lawful basis
- Right to lodge a complaint with the ICO — if you believe we have not handled your data lawfully
To exercise any of these rights, email tom@oddduck.digital. We will respond within one month (extendable to three months for complex requests, with notice).
You can also complain directly to the Information Commissioner's Office (ICO):
- Website: https://ico.org.uk/make-a-complaint/
- Phone: 0303 123 1113
9. Children's data
Our services are designed for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe we have collected data from a child under 16, please contact tom@oddduck.digital and we will delete it.
10. Changes to this policy
We may update this policy from time to time. The "last updated" date at the top reflects when changes were made. Material changes will be communicated to active clients by email.
11. Contact
Odd Duck Digital Ltd
125 Kestrel Park
Skelmersdale, WN8 6TA
United Kingdom
Email: tom@oddduck.digital