Privacy Policy

1. Who we are and what this policy covers

This policy explains how Vizz Ads Ltd ("Vizz Ads", "we", "us", "our") collects and uses personal data. It applies to our website at vizzads.com, to people who contact us or enquire about our services, to our clients and their staff, and to our suppliers and contractors.

We are the controller of the personal data described in this policy, except where we say otherwise in section 3.

We are not required to appoint a Data Protection Officer, and we have not appointed one. Ainesh Bose is responsible for data protection at Vizz Ads and is the point of contact for all matters in this policy.

2. Summary

If you only read one section, read this one.

• If you fill in the form on our website, we use your details to contact you about working together, and we keep them for up to 24 months if you do not become a client.

• Our website uses cookies. Analytics and advertising cookies are only set in line with the choices you make in our cookie banner. See our Cookie Policy.

• We do not sell your personal data, and we do not share it for targeted advertising unless you switch advertising cookies on — see section 18.

• When we run campaigns for a client, any personal data in that campaign belongs to the client. We only handle it on their instructions.

• You have rights over your data, including access, correction and deletion. Section 14 explains how to use them, and section 15 explains how to complain.

3. Our two roles: controller and processor

We handle two very different kinds of personal data, and the law treats them differently. It matters that you know which is which.

Where we act as a processor, this policy does not apply to that data. If you are a customer of one of our clients and you want to exercise your rights over data held in their campaigns, please contact that business directly — they are the controller. If you contact us instead, we will pass your request on to them and tell you we have done so.

Two points worth spelling out

• Tags on our clients’ websites. We may install and configure measurement tags such as the Meta Pixel, Google Ads conversion tags or server-side tracking on a client’s site, to that client’s instructions. The client is responsible for obtaining consent from its own visitors and for its own privacy notice. We are not the controller of that data. The advertising platform also processes data in its own right, and for some of that activity platforms such as Meta act as an independent or joint controller under their own terms.

• Customer lists. A client may ask us to upload a list of their customers to a platform to build a matched or "lookalike" audience. We only do this on written instruction, we require the client to confirm it has a lawful basis and has told its customers, and we do not reuse a client’s list for any other client or for ourselves.

4. The personal data we collect

We group personal data into the categories below and refer to them by these names throughout this policy.

Data we do not collect

We do not seek to collect special category data about you — that means data about race or ethnicity, religious or philosophical beliefs, political opinions, trade union membership, health, sex life or sexual orientation, genetic data or biometric data. We also do not knowingly collect data about criminal convictions or offences.

Our services are aimed at businesses. Our website is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us their data, please contact us and we will delete it.

5. How we collect your data

• Directly from you. You give us Identity and Contact Data and Business Data when you complete the "Book Strategy Call" form on our contact page, email us, speak to us on a call, or enter into a contract with us. The form asks for your full name, work email, company name, target region and your goals.

• Automatically. As you use our website we collect Technical and Usage Data through cookies and similar technologies, in line with the preferences you set in our cookie banner. Our Cookie Policy has the detail.

• From third parties and public sources. We may obtain business contact details from public sources such as company websites, Companies House and professional networking sites, and from business contact databases, in order to contact organisations we believe may benefit from our services. Where we obtain your details this way rather than from you, we will tell you where we got them the first time we contact you, as the law requires.

6. Why we use your data, and our lawful basis for doing so

We only use your personal data where the law allows. Most commonly that is because we need it to perform a contract with you, because we have a legitimate interest in using it and that interest is not overridden by your rights, because we have a legal obligation, or because you have consented.

Where we rely on legitimate interests, we have considered whether our interest is overridden by your interests and rights, and we have concluded it is not. You can ask us to explain that assessment at any time using the contact details in section 21.

7. Cookies and similar technologies

Our website uses cookies and similar technologies. At present these are Google Tag Manager and Google Analytics. Where we are running paid advertising for our own business, we may also use advertising tags from platforms such as Google Ads, Meta and TikTok. Full details — including what each cookie does and how long it lasts — are in our Cookie Policy, which is generated from an automated scan of our website and is therefore always current.

Advertising and targeting cookies are only set where you have given consent. Cookies used solely for statistical purposes, and cookies that remember your display preferences, may be set without consent under the Privacy and Electronic Communications Regulations as amended by the Data (Use and Access) Act 2025, but we still tell you about them and give you a simple way to turn them off. You can change your choices at any time through the cookie preferences link in our website footer.

8. Marketing

We may send you information about our services where you have asked us to, where you have given us your details in the course of enquiring about or buying our services, or where you are a business contact and we believe our services are relevant to your organisation.

Every marketing email we send includes a clear way to unsubscribe. You can also tell us to stop at any time by emailing ainesh@vizzads.com. This is an absolute right — we do not need a reason and we will not ask you for one. Opting out of marketing does not affect data we hold for other purposes, such as an existing contract.

Where the law requires your consent before we can send you marketing — which includes individuals, sole traders and unincorporated partnerships in the UK — we will obtain it before we contact you.

9. Automated decision-making and profiling

We do not make decisions about you that produce legal effects or similarly significant effects for you based solely on automated processing.

We do use profiling in a limited, ordinary marketing sense: advertising platforms may use Technical and Usage Data to decide which of our adverts to show you, and we may segment our marketing list so that the content we send is relevant. You can object to this at any time, and you can withdraw consent for advertising cookies through our cookie preferences.

10. Who we share your data with

We do not sell your personal data. We share it with the following categories of recipient, and only as far as necessary.

We require everyone who processes personal data on our behalf to keep it secure, to use it only for the purposes we specify, and to be bound by a written contract that meets the requirements of Article 28 of the UK GDPR.

Where advertising or measurement technologies are concerned, the authoritative and current list is the cookie declaration in our Cookie Policy. That declaration is generated automatically from a monthly scan of our website, so it reflects what is actually running rather than what was true when this policy was last edited.

11. Sending data outside the UK

Some of the organisations we work with are based outside the United Kingdom, and some of our data is therefore transferred internationally. Whenever we transfer personal data out of the UK, we make sure it is protected to a standard that is not materially lower than it would receive in the UK, by relying on one of the following:

• A decision by the UK Government that the destination country provides an adequate level of protection; or

• The UK International Data Transfer Agreement, or the UK Addendum to the European Commission’s Standard Contractual Clauses, entered into with the recipient. We complete a transfer risk assessment before relying on these.

You can ask us for a copy of the safeguards we rely on by emailing ainesh@vizzads.com. We will provide them, with commercially sensitive terms removed.

12. Security

We take appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include access controls and multi-factor authentication on the systems we use, limiting access to personal data to those who need it, encryption of data in transit, written confidentiality and security obligations on our contractor, and keeping our software up to date.

No system is completely secure. If a personal data breach occurs and it is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours of becoming aware of it, and we will tell you directly where the law requires us to.

13. How long we keep your data

We keep personal data only for as long as we need it for the purposes we collected it for, including to meet legal, accounting or reporting requirements.

In some circumstances we will anonymise your data so that it can no longer be associated with you, in which case we may use it indefinitely without further notice.

14. Your rights

Under UK data protection law you have the following rights. They are free to exercise.

• Access — ask for a copy of the personal data we hold about you.

• Rectification — ask us to correct data that is inaccurate or incomplete.

• Erasure — ask us to delete your data where there is no good reason for us to keep it.

• Restriction — ask us to pause our use of your data, for example while we check whether it is accurate.

• Portability — ask us to transfer the data you gave us to you or another organisation, in a machine-readable format.

• Objection — object to our use of your data where we rely on legitimate interests. Where you object to direct marketing, we will always stop.

• Withdraw consent — where we rely on your consent, withdraw it at any time. This does not affect anything we did beforehand.

• Automated decisions — ask for human involvement in a decision made solely by automated means. As set out in section 9, we do not make such decisions.

How to exercise them

Email ainesh@vizzads.com. We will respond within one month. If your request is complex, or if you have made several requests, we may extend that by up to two further months and we will tell you if we do. We may need to confirm your identity before we act, which helps make sure your data is not disclosed to someone else.

15. Complaints

If you are unhappy with how we have handled your personal data, please tell us first. Email ainesh@vizzads.com with "Data protection complaint" in the subject line.

We will acknowledge your complaint within 30 days of receiving it, and we will investigate and respond to it without undue delay.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection, at any time. We would appreciate the chance to deal with your concerns first, but you do not have to come to us before going to the ICO.

16. If our business changes hands

If we sell or transfer all or part of our business, or if we merge with or are acquired by another organisation, personal data we hold may be transferred as part of that transaction. We will make sure the recipient is bound to use it in a way that is consistent with this policy, and we will tell you if the change affects how your data is used.

17. Additional information for individuals in the European Economic Area

We are established in the United Kingdom and we have no establishment in the European Union. Where we offer our services to people in the EEA, or monitor the behaviour of people in the EEA, the EU General Data Protection Regulation applies to that processing in addition to UK law, and this section tells you what that means for you.

Your rights under the EU GDPR are equivalent to those set out in section 14. You also have the right to lodge a complaint with the supervisory authority in the EU or EEA country where you live, where you work, or where you believe an infringement took place.

Where we transfer personal data out of the EEA, we rely on European Commission adequacy decisions or on the European Commission’s Standard Contractual Clauses.

We have not appointed a representative in the European Union. If the scale and regularity of our processing of EEA residents’ data reaches the point at which Article 27 of the EU GDPR requires us to appoint one, we will do so and publish their details here. Until then, you can reach us using the contact details in section 21.

18. Additional information for residents of the United States

This section applies if you live in California or in another US state with a comprehensive privacy law, including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and Montana.

Our status and what we collect

Vizz Ads is a UK company and does not meet the revenue or volume thresholds that make an organisation a "business" under the California Consumer Privacy Act. We offer the rights below to US residents as a matter of policy regardless, and we will honour them. Where we deliver services to a US client we act as that client’s "service provider" or "processor": we do not retain, use or disclose personal information received from a client for any purpose other than performing the services, we do not sell or share it, and we do not combine it with personal information from any other source except as permitted by law.

In the twelve months before the date of this policy we have collected identifiers, commercial information, internet or electronic network activity information, and professional or employment-related information, as those categories are defined in California law. We collect these from you directly and automatically through cookies. The purposes are set out in section 6 and the recipients in section 10. We do not collect sensitive personal information, and we do not knowingly sell or share the personal information of anyone under 16.

Sale and sharing

We do not sell personal information for money. Our use of advertising and analytics cookies could otherwise amount to "sharing" personal information for cross-context behavioural advertising under California law, and to a "sale" or "targeted advertising" under some other state laws.

We apply the same consent standard to every visitor, wherever in the world they are. Advertising and analytics cookies are switched off by default for everyone, and are only set if you actively turn them on. In practice this means we do not sell, share, or use your personal information for targeted advertising unless you have affirmatively opted in — a stricter standard than US state law requires.

You can change or withdraw that choice at any time using the "Cookie preferences" link in the footer of every page. That link is our mechanism for the right to opt out of the sale or sharing of personal information.

Because advertising cookies require your opt-in regardless of your location, a Global Privacy Control signal sent by your browser has the same practical effect as declining them: nothing is shared unless you choose to enable it.

Your rights

• The right to know what personal information we collect, use and disclose, and to request a copy of it.

• The right to request deletion of your personal information.

• The right to request correction of inaccurate personal information.

• The right to opt out of the sale or sharing of your personal information, and of targeted advertising.

• The right not to be discriminated against for exercising any of these rights. We will not deny you services, charge you a different price, or give you a lower quality of service because you exercised a privacy right.

• The right to appeal a refusal, where the law of your state provides one. If we refuse your request, we will tell you why and how to appeal, and we will respond to an appeal within 45 days.

To exercise any of these rights, email ainesh@vizzads.com. We will verify your identity and respond within 45 days. You may use an authorised agent, and we may ask them for proof that you gave permission. You also have the right to limit the use of sensitive personal information, though we do not collect any.

19. Other websites

Our website may contain links to third-party websites, plug-ins and applications. Clicking on those links may allow third parties to collect or share data about you. We do not control those websites and we are not responsible for their privacy practices. When you leave our website, we encourage you to read the privacy policy of every website you visit.

20. Changes to this policy

We keep this policy under review and will update it when our practices change or when the law changes. The version number and date at the top of this document tell you when it was last updated. Where a change is significant, we will bring it to your attention directly.

This policy is reviewed at least once every 12 months.

21. How to contact us

For anything in this policy, including exercising your rights or making a complaint: