Privacy Policy

Who I am

Ad Spec runs Facebook and Instagram advertising for local service businesses in the UK. It is run by Christopher Holden, as a sole trader trading as Ad Spec. I am the data controller for the personal data described below, which means I decide how and why it is used.

You can reach me about anything on this page at christopherholden@adsspec.com.

There is no separate privacy team and no call centre. Your message comes straight to me.

What I collect, and why

If you fill in the application form

The form asks for your name, email, phone number, business name, business type, service area, marketing budget, capacity, previous experience with agencies, when you want to start, and anything you choose to add in the free-text box.

I use it to work out whether I can realistically get results for your business, and to reply to you. You don't have to fill it in, but I can't assess an enquiry without it. Please don't put anything sensitive in the free-text box. I don't need health, financial or similar details, and I'd rather not hold them.

If you book a call

The booking page uses Calendly, which collects your name, email, chosen time, time zone and any notes you add, and passes them to me so I can hold the call. Calendly also sets its own cookies, so it is not loaded until you have accepted them. Decline and the calendar is never loaded.

If you email, call or message me

I keep the conversation and your contact details so I can deal with your query and remember what was said.

If you become a client

I hold your contact and business details, billing records, the access you grant me on your Meta advertising account, campaign performance data, and our correspondence, so I can run your campaigns, invoice you, and keep proper accounts.

If you enquired through an advert I run for a client

Then the business you were trying to contact is the data controller, not me. I only pass your enquiry to them, on their instructions. I don't use it for my own marketing and I don't sell or share it. To exercise your rights over that data, contact that business, or contact me and I'll tell you who they are and pass your request straight on.

If you just visit the website

There are no analytics, no advertising pixels and no tracking cookies on this site. I am not building a profile of your browsing. The only cookies in play anywhere are Calendly's on the booking page, and those are only set if you accept them; your answer is stored in your own browser rather than in a cookie. My hosting provider records standard server logs, which may include your IP address, as a technical necessity of serving the site. There is more detail on the legal information page.

My lawful basis

UK data protection law requires a valid reason for using personal data. Mine are:

• Taking steps at your request before entering a contract: assessing and replying to your enquiry, and holding a call.
• Performing our contract: delivering the service if you become a client.
• Legal obligation: keeping accounting and tax records.
• Legitimate interests: keeping accurate business records, keeping the site secure, and defending against disputes. I've weighed these against your rights and consider them proportionate; ask if you'd like the reasoning.

Who else sees it

Only the suppliers I need to run the business. Each acts on my instructions and none may use your data for their own purposes. I do not sell your personal data, and I never will.

It is worth splitting this into two stages, because they are very different. Most of the tools below are only involved while you are enquiring. Once you are actually a client, the picture gets much simpler.

Stage one: while you are enquiring

These are the tools that carry your enquiry to me and let us arrange a call. They see your contact details, not your campaign.

Stage two: once you are a client

I work through Meta partner access on your own advertising account, so you keep ownership of it and can remove my access at any time. The enquiries your campaigns generate come to you, and I do not pass them anywhere else.

The stage one tools carry on being used for the ordinary business of dealing with you, so I can still email you and you can still book a call. They are not part of running your campaigns.

The unavoidable few

Beyond that, I may share data with an accountant for bookkeeping, or with authorities where the law requires it. Nothing else.

Ad Spec is a UK business and your data is handled under UK law. Several of the tools above are run by companies based abroad, which is normal for software of this kind, and the tables show where each one processes data. Where data goes outside the UK, I rely on the safeguards UK law recognises: the UK Extension to the EU–US Data Privacy Framework where the supplier is certified under it, or the International Data Transfer Agreement. Ask and I'll tell you which applies to a particular supplier.

How long I keep it

• Enquiries that don't become clients: 12 months from our last contact.
• Client records and correspondence: 6 years after we stop working together, which is the period for contract claims.
• Invoices and accounting records: 6 years, as HMRC requires.
• If you ask me not to contact you: I keep the bare minimum needed to honour that, and use it for nothing else.

After that it's deleted.

Keeping it safe

The site runs over HTTPS. Accounts holding personal data use strong, unique passwords with two-factor authentication where available, and the devices I work on are encrypted and password protected. Access is limited to me.

No system is perfectly secure and I won't pretend otherwise. If a breach happens that is likely to put your rights at risk, I'll report it to the ICO within 72 hours of becoming aware, and tell you directly if the risk to you is high.

Your rights

You can ask me to:

• give you a copy of the personal data I hold about you;
• correct anything inaccurate, or complete anything missing;
• delete it, where I have no good reason to keep it;
• pause using it while a dispute about it is sorted out;
• send it to you, or someone else, in a portable format;
• stop using it where I've relied on legitimate interests.

Where I've relied on your consent for anything, you can withdraw it at any time, as easily as you gave it. If you object to marketing, that's absolute. I stop, immediately and permanently.

If you're unhappy

Please tell me first. I'd rather hear about it and put it right. But you can complain to the UK regulator at any time, and you don't have to come to me first.

Changes

I'll update this page as the business changes. The date at the top always shows the current version. Ad Spec is currently run as a sole trader; if it becomes a limited company, this notice will be replaced and the company named as controller.

If a change materially affects how I use your data, I'll tell you directly where I reasonably can.