Privacy policy

ADSRUNNER GLOBAL MARKETING – FZCO (trade license no. 38096) is a performance marketing company — a Free Zone Company incorporated in the Dubai Integrated Economic Zones Authority (DIEZ), Dubai Silicon Oasis, United Arab Emirates. We are the data controller for personal data collected via this website and our managed services platform. Where we process the personal data of individuals in the United Kingdom or European Economic Area, we do so in accordance with the UK GDPR and the EU GDPR; we also comply with the UAE Personal Data Protection Law (PDPL).

We collect personal data that you provide directly, data we collect automatically when you use our services, and data we receive from third parties (such as ad platforms when you authorise integration with our platform).

• Contact information you provide via forms — name, email, company, role
• Account data when you sign up to our platform — login credentials, usage logs
• Audit data — when you connect your ad accounts, we receive read-only access to advertising performance data
• Communication data — emails, support messages, scheduling information
• Device and usage data — IP address, browser, operating system, pages visited
• Cookies and similar technologies — see our separate Cookies Policy for details

We process personal data only for purposes that are lawful and necessary. Our legal bases under applicable data protection law are:

• Performance of contract — to deliver services you have engaged us for
• Legitimate interests — to operate our business, communicate with prospects, and improve our services, where this does not override your rights
• Consent — for non-essential cookies, marketing emails, and audit access (revocable at any time)
• Legal obligation — to comply with tax, accounting, and regulatory requirements

Specifically, we use your data to: provide and improve our services; communicate with you about your account or audit; respond to inquiries; analyze website usage to improve our content; comply with legal obligations; and protect against fraud and abuse.

We do not sell your personal data. We share it only with trusted sub-processors who help us deliver our services, and with regulators or legal authorities where required by law.

We describe the categories of sub-processors we use at /sub-processors. The full list of named sub-processors is available to active clients on request under our Data Processing Agreement, and we notify clients in advance of material changes.

When you authorise us to access your ad platform accounts (Google Ads, Meta, etc.), we read data from those platforms via official APIs. We do not share your data with those platforms beyond what is necessary to operate your campaigns under your direction.

We retain personal data only as long as necessary for the purposes for which it was collected, including legal, accounting, or reporting requirements. Specifically:

• Audit data — retained for 90 days unless you become a client or request earlier deletion
• Active client data — retained for the duration of the engagement plus 7 years to comply with applicable record-keeping requirements
• Marketing contact data — retained until you unsubscribe or 24 months after last interaction, whichever is sooner
• Website analytics — retained for 26 months in line with GA4 default

Subject to applicable data protection law, you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct data that is inaccurate or incomplete
• Erasure — ask us to delete your data, subject to legal retention requirements
• Restriction — ask us to pause processing while a query is resolved
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — for processing based on consent, at any time

To exercise any of these rights, contact us at support@adsrunner.com. We will respond within 30 days. If you are in the UK or EEA, you also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office at ico.org.uk).

We take data security seriously. OAuth tokens and API credentials are encrypted at rest using AES-256. All data transmission is encrypted in transit using TLS. Access to client data is restricted to authorised personnel with documented business need. We maintain audit logs of all data access.

Despite our best efforts, no internet-based service is 100% secure. We cannot guarantee absolute security but commit to notifying affected individuals and the ICO where appropriate within 72 hours of becoming aware of any data breach.

We and some of our sub-processors operate across multiple jurisdictions, so personal data may be transferred internationally. Where we transfer personal data, we rely on appropriate safeguards — such as adequacy decisions or standard contractual clauses (SCCs) — to ensure an equivalent level of protection.

We may update this policy from time to time. The "last updated" date at the top reflects when changes took effect. For material changes that affect how we process your data, we will notify you directly via email or through prominent notice on our website.