Legal & Privacy

Privacy Policy

Effective Date: October 10, 2026

1. Data Controller and Scope of Notice

The Smart Creator operates as a performance advertising and growth marketing consultancy situated at 64 Lakeside Ave, Bolton BL3 2HY, United Kingdom (contactable via telephone at +44 7832 619878). This Privacy Policy explains our practices regarding the collection, processing, transfer, and safeguarding of personal data gathered when you visit our website, submit commercial inquiries, or contract our paid media management services. We conduct all processing activities in full adherence to the United Kingdom General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Statutory Context:

The Smart Creator serves as the Data Controller for visitor and prospective client data collected via website contact forms and direct communications.
Where we manage ad campaigns using client-provided customer lists or custom audience identifiers, we operate as a Data Processor under defined client instructions.
Our data practices are monitored and registered under the guidance of the UK Information Commissioner's Office (ICO).

2. Categories of Information Collected

We collect and process personal data required to conduct agency onboarding, performance ad campaign development, and account administration. We do not gather non-essential personal information or sensitive category data.

Collected Data Points:

Identity and Contact Details: Full name, business email address, corporate telephone number, commercial trading name, and business address.
Advertising Platform Identifiers: Meta Business Manager account IDs, Google Ads Customer IDs, TikTok Ads Manager IDs, and associated campaign tracking parameters.
Commercial and Billing Records: Transaction histories, invoice records, and verified payment confirmation data.
Technical Web Telemetry: IP addresses, browser specifications, operating system versions, and referral URLs recorded automatically via server logs.

3. Lawful Grounds for Processing

Under Article 6 of the UK GDPR, every processing operation conducted by The Smart Creator relies upon an established legal foundation.

Applicable Legal Bases:

Contractual Performance (Article 6(1)(b)): Processing required to execute proposals, deliver advertising campaign strategy, configure conversion tags, and supply ongoing performance reports.
Legitimate Interests (Article 6(1)(f)): Processing conducted to secure agency infrastructure, protect against fraudulent inquiries, optimize advertising delivery, and maintain commercial records.
Legal Compliance (Article 6(1)(c)): Retaining invoicing and taxation records to satisfy statutory United Kingdom accounting obligations under HM Revenue & Customs (HMRC).
Consent (Article 6(1)(a)): Where you voluntarily authorize non-essential performance cookies or opt into specialized industry briefings.

4. Operational Purposes of Data Processing

The personal and business data collected is utilized solely to deliver high-converting advertising campaigns and fulfill agency obligations.

Primary Operational Uses:

Developing and optimizing paid ad campaigns across Meta (Facebook and Instagram), Google Ads, TikTok, and YouTube.
Implementing server-side tracking, Conversion APIs (CAPI), and analytics pixels to measure authentic return on ad spend (ROAS).
Issuing verified performance audits, weekly reporting dashboards, and campaign strategy recommendations.
Managing invoicing, credit control, and administrative communications.

5. Advertising Platforms and Third-Party Processors

To deliver paid media services, The Smart Creator interacts with authorized enterprise third-party ad networks and cloud service providers. We enforce written Data Processing Agreements with all sub-processors.

Primary Sub-Processors and Platforms:

Meta Platforms Ireland Limited: Managing Facebook and Instagram advertising campaigns and conversion tracking.
Google Ireland Limited: Administering Google Search, Display, and YouTube advertising infrastructure.
TikTok Technology Limited: Running short-form video advertising and pixel event verification.
Cloud Infrastructure and Workspace Providers: Secure UK and EEA hosting environments adhering to ISO/IEC 27001 standards.
International transfers outside the UK are executed under approved UK International Data Transfer Agreements (IDTAs) or European Commission Standard Contractual Clauses.

6. Data Retention Protocols

We enforce strict data retention schedules to ensure personal data is preserved only as long as necessary for operational or statutory requirements.

Retention Windows:

Client Commercial Agreements and Invoicing: Preserved for seven (7) years following contract conclusion to satisfy UK tax and accounting compliance.
Ad Account Campaign Records: Retained for the duration of the active agency retainer plus ninety (90) calendar days to facilitate orderly account transition.
Prospective Client Inquiries: Retained for twenty-four (24) months from date of last substantive communication prior to permanent deletion.
Website Analytics and Server Logs: Retained for an aggregate period not exceeding fourteen (14) months.

7. Technical and Organizational Security Controls

We maintain robust security controls designed to safeguard agency and client data against unauthorized access, loss, or alteration.

Implemented Defenses:

Mandatory Multi-Factor Authentication (MFA) across all agency business managers, client portals, and administrative accounts.
TLS 1.3 encryption in transit across all web interfaces and AES-256 bit encryption for stationary digital records.
Role-based access privileges restricting campaign data access exclusively to personnel actively working on designated accounts.
Regular audit reviews of platform partner access permissions and credential revocation upon project conclusion.

8. Individual Statutory Rights

In accordance with Chapter 3 of the UK GDPR, individuals residing in the United Kingdom and EEA possess enforceable rights regarding their personal data.

Your Recognized Rights:

Right of Access: You may request a formal Subject Access Request (SAR) copy of the personal information held about you.
Right to Rectification: You may request correction of inaccurate, obsolete, or incomplete personal data.
Right to Erasure: You may request deletion of your personal records where no statutory retention obligations apply.
Right to Restriction and Objection: You may contest processing based on legitimate interests or request temporary processing suspension.
Right to Data Portability: You may request transfer of provided data in a structured, machine-readable format.
To exercise any statutory right, contact our Data Protection Officer at 64 Lakeside Ave, Bolton BL3 2HY, United Kingdom or phone +44 7832 619878.

9. Supervisory Authority Complaints

You retain the right to lodge a complaint with the statutory supervisory authority if you believe our data handling practices violate applicable data protection law.

Supervisory Contact Details:

Supervisory Authority: Information Commissioner's Office (ICO).
Postal Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom.
Helpline: +44 303 123 1113 | Website: ico.org.uk.

10. Amendments and Contact Details

We review and update this Privacy Policy periodically to reflect changes in legal mandates, advertising network policies, or agency practices. All updates take effect immediately upon publication on this page.

Direct Contact Information:

Agency Name: The Smart Creator
Physical Office: 64 Lakeside Ave, Bolton BL3 2HY, United Kingdom
Telephone: +44 7832 619878