Privacy Policy

Alderstone Media Ltd ("Alderstone Media", "we", "us", "our") respects the privacy of everyone who visits this website, contacts us about our services, or works with us as a client, supplier or candidate. This policy sets out what personal data we handle, why, for how long, and what you can require of us.

For the purposes of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, Alderstone Media Ltd is the data controller for the processing described here.

1. Who we are

Alderstone Media Ltd is registered in England and Wales under company number 00000000. Our registered office and principal place of business is Second Floor, 41 Corn Street, Bristol, BS1 1HT, United Kingdom.

We are a media planning and buying agency. When we build advertising audiences from data supplied by a client, we act as that client's data processor under a written agreement meeting Article 28 of the UK GDPR; the client remains the controller and its own privacy notice applies. Everything else described in this policy is processing we carry out as controller.

2. The personal data we collect

2.1 Data you provide

• Enquiries — name, organisation, work email, telephone number, indicative budget, the nature of your brief and anything else you choose to write.
• Client and supplier records — contact details, contractual terms, purchase orders, invoices and correspondence.
• Platform and vendor contacts — the business contact details of representatives at Google and at the tool vendors we work with.
• Recruitment — CV, employment history, references and interview notes.
• Events and mailing list — name, organisation and email address where you have asked to receive our effectiveness briefings.

2.2 Data collected automatically

• Technical data — IP address, browser and device type, operating system, screen dimensions and approximate region.
• Usage data — pages viewed, referring page, links followed and time on page.

Automatic collection beyond what is strictly necessary happens only if you consent through our cookie banner. See section 9 and our Cookie Policy.

2.3 Data from other sources

We may obtain business contact details from professional networks, public registers such as Companies House, industry bodies, event organisers where you consented to sponsor contact, and referrals from mutual contacts.

We do not seek special category data through this website. Please do not include health, ethnicity, political, religious or similar information in an enquiry form.

3. Purposes and lawful bases

Where we rely on legitimate interests we have completed a documented balancing test. You may request a summary of the relevant assessment.

4. Disclosure to others

We never sell personal data. We disclose it only to:

• Processors providing our website hosting, email, CRM, planning tools, media reconciliation systems and file storage, each bound by written contract;
• Google, where administering a client advertising account requires a named contact;
• Auditors appointed by a client to verify our disclosures, under confidentiality;
• Advertising and analytics providers, only where you have consented to the relevant cookies;
• Professional advisers — accountants, auditors, insurers and solicitors;
• Regulators, courts and law enforcement where legally required; and
• A successor in the event of a reorganisation or sale of the business, subject to confidentiality undertakings.

5. International transfers

Most of our systems are hosted in the United Kingdom or European Economic Area. Where a provider processes data elsewhere — principally the United States — we rely on a UK adequacy regulation (including the UK Extension to the EU–US Data Privacy Framework), the International Data Transfer Agreement, or the UK Addendum to the European Commission's Standard Contractual Clauses, each supported by a transfer risk assessment. A copy of the relevant mechanism is available on request.

6. Retention

We then delete or irreversibly anonymise the records.

7. Security

Our measures include TLS encryption in transit and encryption at rest, role-based access with least privilege, mandatory multi-factor authentication, centrally managed devices with full-disk encryption, quarterly access reviews, annual penetration testing of internet-facing systems, documented supplier due diligence and annual staff training. We operate a written incident response plan and will report a notifiable personal data breach to the Information Commissioner's Office within 72 hours of becoming aware of it, notifying affected individuals directly where the risk to them is high.

8. Your rights

You have the right to be informed, and to request access, rectification, erasure, restriction of processing, or portability of your data. You may object to processing based on legitimate interests, object to direct marketing at any time, and withdraw consent where consent is the basis we rely on. We do not carry out solely automated decision-making with legal or similarly significant effects.

If we have not handled your data properly, please raise it with us first. You may also complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF — 0303 123 1113, ico.org.uk.

9. Cookies

We use a small number of cookies. Only strictly necessary cookies are set without consent. Full details, including durations and providers, are in our Cookie Policy.

10. Marketing preferences

We send our effectiveness briefing only to people who have asked for it, or to existing business contacts in reliance on the soft opt-in permitted by the Privacy and Electronic Communications Regulations 2003 for closely related services. Every message includes a one-click unsubscribe link that we honour immediately.

11. Children

This is a business-to-business website and is not directed at children. We do not knowingly collect data about anyone under 18. Where a client campaign involves audiences that may include minors, we apply the ICO's Age Appropriate Design Code and the CAP Code restrictions in our planning.

12. Changes and how to contact us

We review this policy annually and whenever our processing changes materially. The date at the head of the page shows the current version.