Privacy Policy

Addesu Ltd

Last updated 21 August 2026.

1. Who we are and what this policy covers

Addesu Ltd (“Addesu”, “we”, “us”, “our”) is a UK paid media agency. We plan, run and report on paid advertising campaigns for our clients, primarily on Google Ads, Meta and other paid media platforms. We also provide a reporting platform and a small number of free analysis tools.

This policy explains what personal data we collect, why, what we do with it, how long we keep it and what rights you have. It applies to visitors to addesu.com, users of our free tools, users of our reporting platform at app.addesu.com (the “Platform”), individuals at our clients, prospective clients, suppliers and partners, and anyone who subscribes to our marketing.

Section 5 covers client advertising data separately, because our role there is different.

We handle personal data in line with the UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025 and the Privacy and Electronic Communications Regulations 2003 (“PECR”).

Legal entity	Addesu Ltd, registered in England and Wales, company number 12887528
Registered office	59 Ardfillan Road, London, SE6 1ST
Office address	Sandbox Workspace City, 37 Houndsditch, London, EC3A 7DB
Data protection contact	[email protected]
ICO registration	ZB309417

We are not required to appoint a statutory Data Protection Officer and have not appointed one. Data protection questions are handled by Jack Carr.

2. Our two roles: controller and processor

We handle personal data in two capacities, and your rights work differently in each.

We are the controller for data we collect for our own purposes: website visitors, enquiries, marketing subscribers, Platform account holders, client and supplier contacts, people who use our free tools, and job applicants. Sections 3, 4 and 6 to 12 describe that processing, and you can exercise your rights with us directly.

We are a processor for personal data held inside our clients’ advertising and analytics accounts, which we access only on the client’s instructions. The client is the controller. Section 5 describes it. If your data sits inside one of those accounts, your rights are against the client, not us. If you contact us instead, we will pass your request to the relevant client without undue delay and help them respond.

Our processing as a processor is governed by the Data Processing Agreement in our client contracts. Where this policy and a client DPA differ, the DPA governs that processing.

3. What personal data we collect

“Personal data” means information from which you can be identified. It does not include data that has been anonymised.

Not all of this will apply to you.

Category	What it includes
Identity and contact data	Name, job title, employer, business email address, telephone number, business address, professional profile details
Account data	Platform username, hashed password, settings, alert rules, linked advertising account identifiers, team membership
Usage and technical data	IP address, browser and device details, pages viewed, features used, session duration, referral source, log and error data
Marketing data	Your preferences, whether you have opted in or out, and records of the emails we have sent you and your engagement with them
Correspondence data	The content of your enquiry, emails, meeting notes, call notes and support requests, and our replies
Transactional data	Billing contacts, purchase orders, invoices and payment references
Uploaded file data	Advertising exports you upload to our free tools, which can contain personal data if the export includes it. See section 6
Recruitment data	CV, cover letter, work history, right to work information, interview notes

Most of this comes from you. We also collect business contact details from public business sources, from referrals and introductions, and from recruiters where you have applied through one. Where we obtain your details that way we will tell you within one month, or when we first contact you if that is sooner.

We do not seek special category data or criminal offence data. Please do not send it to us. If you do, we will delete it unless we are legally required to keep it.

We also produce aggregated and anonymised statistics. That is not personal data, because it cannot identify anyone.

4. How we use your data and our legal basis

We only use personal data where the law allows. The examples below are indicative, and one activity may rely on more than one basis.

What we do	Legal basis
Respond to your enquiry and discuss whether we can help	Legitimate interests, and steps preparatory to a contract
Research and maintain a list of prospective client contacts from public business sources	Legitimate interests
Provide our services to a client and manage the relationship	Performance of a contract
Create and run a Platform account, including free trials	Performance of a contract, or legitimate interests during a trial
Operate and secure our website and Platform, diagnose faults and prevent abuse	Legitimate interests
Measure how our website and Platform are used	Consent, or legitimate interests where a cookie falls within the PECR statistical exception. See section 7
Send service and administrative messages, including alerts you have configured	Performance of a contract, or legal obligation
Market to a business contact at a company, LLP or other corporate subscriber	Legitimate interests. The PECR consent rule applies to individual subscribers, not corporate ones
Market to an individual subscriber, including a sole trader or a partnership that is not an LLP	Consent, or the PECR soft opt-in where you gave us your address while enquiring about our services and were offered an opt-out then
Run our free tools, process the file you upload and email you the result	Legitimate interests
Market to you after you have used a free tool	Consent, given separately. Using the tool does not require it
Record and honour your marketing preferences	Legitimate interests, and our accountability obligation
Invoice, collect payment and keep accounting records	Performance of a contract, legal obligation
Prevent, detect and investigate fraud, misuse and security incidents	Legitimate interests, legal obligation
Establish, exercise or defend legal claims, and respond to regulators	Legitimate interests, legal obligation
Assess a job application	Legitimate interests
Carry out right to work and pre-employment checks on someone we are hiring	Legal obligation. This applies on hire, not at application stage
Keep an unsuccessful applicant on file for future roles	Consent

Where we rely on legitimate interests, we have weighed our interest against your rights and are satisfied the processing is not unfair, unexpected or unduly intrusive. You can ask us to explain our reasoning. Where we rely on consent, you can withdraw it at any time, and withdrawal does not affect processing carried out before you withdrew.

Do you have to give us your data? Identity, contact and account data are necessary for us to enter into and perform a contract with you and to run a Platform account, so we cannot provide those without them. Where the law requires us to collect something, we will say so at the time. Everything else is voluntary.

Change of purpose. We will only use your data for the purposes we collected it for, unless we reasonably consider another purpose compatible. If we need it for an unrelated purpose we will tell you and explain the legal basis. We may process personal data without your knowledge or consent where the law requires or permits it.

Automated decision-making. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

Our work does involve automated analysis of advertising data, at three levels: rule-based checks that apply defined thresholds; machine learning models that identify patterns and anomalies; and large language models that turn findings into written explanations and reporting. See section 9. In every case the output is a recommendation and not a decision. A member of our team reads the reasoning, decides whether they agree, and applies any change to a live advertising account themselves. No model can change a client’s account.

5. Client advertising data

This section covers the data inside the advertising, analytics and reporting accounts we work in for clients. We act as processor and the client is the controller.

What we access

Our staff access the advertising and analytics platforms our clients use, including Google Ads, Meta Ads Manager, Microsoft Advertising, LinkedIn Ads, Google Analytics and Google Merchant Center. Access is granted by the client and limited to the accounts covered by our engagement. We use it to build, manage and optimise campaigns, to report, and to advise on strategy.

Most of this data is not personal data: it is campaign structure, budgets, keywords, search terms, creative and aggregate performance metrics. Some can be, for example a user on the account or a lead’s details in a lead form report.

We do not create or upload customer match lists, audience lists or other customer contact uploads unless a client instructs us to in writing. Where they do, they remain responsible for the lawful basis and consents the platform’s policies require, including Google’s Customer Match policy. Any such upload is done by a person in the platform’s own interface.

Our reporting pipeline

Where a client uses our Platform, we bring their advertising data into our own environment so we can report on it, which means we hold a copy. Adverity extracts it from the advertising platforms under the client’s authorisation, it is held and structured in our Microsoft Azure environment, and Power BI and the Platform present the reporting to our team and the client. We do not place our own tracking tags on client websites for this purpose.

Reporting is scoped to the client that owns the data. We do not show one client’s data to another, and we do not combine or compare one client’s advertising data with another’s.

Our internal Google Ads review tool

We operate an internal command line tool that reads data from the Google Ads API for the accounts we manage, so our team can review them consistently.

- Read only. It makes read-only requests and issues no mutate requests of any kind, so it cannot change a live account.

- Authorised access. Every account it reads is linked to our Google Ads manager account and we hold the client’s authorisation. Access is revoked when an engagement ends.

- Internal use only. It is used solely by Addesu staff, has no client-facing interface, and is not hosted, distributed, published, licensed or sold. Its OAuth client is restricted to our own Google Workspace domain.

- What it produces. Each run writes a review document and Google Ads Editor CSV files to a private folder in our Google Workspace Drive, retained for the duration of the engagement and deleted when it ends. Output is shared only with Addesu staff on that account and with the client it describes.

- A person decides. Nothing it produces reaches a live account automatically. An account manager reads the reasoning, decides, and applies any change themselves.

- No onward supply. We do not sell, resell, licence, redistribute or provide onward access to Google Ads API data, and we do not offer the tool as a product or service. The only third parties that process this data are our sub-processors, acting on our instructions and under contract.

We use the Google Ads API in accordance with the Google Ads API Terms and Conditions and Google’s applicable policies.

6. Our free tools

Our free website tools work on an advertising export you upload, which can contain personal data if the export includes it. We act as controller for these files, because we decide how the tool processes them and you are not our client when you use one.

- We process the file only to produce the analysis we return to you.

- The file and the analysis are deleted within 24 hours of the run.

- We do not use uploaded files to train models, we do not share them outside Addesu, and we do not use them to build audiences, prospect lists or contact lists.

- We need an email address, because that is how we return your analysis. We use it to send your result and answer follow-up questions. We will also send you marketing about our services if you have separately agreed to that. Agreeing is not a condition of using the tool, and you can unsubscribe at any time. Your address is held in our CRM and kept as set out in section 11.

Your responsibility as the uploader. You must have the right to share the file with us. Please remove personal data you do not need to include, and do not upload special category data or anything you are not permitted to disclose. If your file contains personal data about other people, you are responsible for having told them it may be shared with a service provider.

7. Cookies

Our website and Platform use cookies and similar technologies. UK rules changed in February 2026 and we treat cookies in three groups.

- Strictly necessary cookies make the site and your account work. These are set without consent, as the law permits.

- Statistical and appearance cookies count how the site is used and remember display preferences. These can be set without consent provided we tell you and give you a free and simple way to opt out, which you can do at any time through the cookie preferences link in our website footer.

- Everything else, including marketing and advertising cookies and any cookie that shares data with a third party for that third party’s own purposes, is set only if you consent. You can withdraw consent at any time.

Full details, including the cookies we use and how long they last, are in our Cookie Policy.

8. Who we share your data with

We use a small number of service providers who process personal data on our behalf. Each acts only on our instructions, under a written contract requiring confidentiality and appropriate security. The categories are:

- Hosting, storage and infrastructure providers, holding the data behind our website, Platform and client reporting.

- Data extraction and business intelligence providers, bringing client advertising data into our reporting environment and presenting it.

- Customer relationship management and marketing platforms, holding our contact records and sending our email.

- Website analytics, session analysis and advertising technology providers. See section 7.

- Artificial intelligence providers. See section 9.

- Collaboration and meeting tools, including messaging, document storage, and call recording and transcription.

- Finance and administration providers, including accounting, invoicing, payroll and expense management.

We may also share personal data with professional advisers where they need it to advise us; with regulators, law enforcement and public authorities where we are legally required to, or where it is necessary to establish, exercise or defend legal claims; and with a buyer or successor if we sell or reorganise our business, in which case we will take reasonable steps to ensure your data stays protected and tell you if the acquirer’s policy will govern its further use.

We never sell personal data, and we do not share it with third parties for their own marketing purposes.

Where we process client advertising data as a processor, the sub-processors used for that data are named in the schedule to the Data Processing Agreement in the client’s contract, and we notify clients of changes in line with that agreement.

Our website and Platform contain links to third-party sites. We do not control them and are not responsible for their privacy practices.

9. AI tools

We use AI tools in our work and some of them process client data. We maintain an internal list of approved tools and staff may not use AI services that are not on it. Our position:

- Company accounts only. Staff use Addesu’s own accounts, not personal or free ones, because personal accounts do not carry the same data protection terms.

- Client advertising data. AI tools are used to help build client reports from the data in our own environment, and parts of our Platform and analysis tooling use machine learning and large language models to identify patterns in advertising performance and write up the findings. See section 4.

- What we do not send. We do not send client customer lists, audience uploads or lead contact details to any AI service. These tools work on campaign structure and aggregate performance figures.

- No training on your data. We do not permit client data or personal data to be used to train third party models, and we configure our accounts accordingly.

- Human review. AI output relating to a client’s advertising account is reviewed by a member of our team before it is acted on or sent to a client.

10. Where your data is stored, and how we keep it secure

We are based in the United Kingdom and store personal data in the UK and the EEA wherever we can. Some of our providers process data in the United States or other countries outside the UK and EEA. Where personal data leaves the UK we rely on transfer to a country covered by UK adequacy regulations, on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or on the UK extension to the EU-US Data Privacy Framework where the recipient is certified. We carry out a transfer risk assessment where one is required, and you can ask us about the safeguards applying to a specific transfer.

We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration and disclosure. These include hosting on Microsoft Azure with encryption of data at rest and in transit, HTTPS across our website and Platform, access limited to staff who need it for their role, credentials held in a password manager and never committed to source control, source code held in private repositories, an approved software list that staff must work within, and confidentiality obligations on all staff.

Our staff are required to report any suspected personal data breach immediately to our Data Protection Lead, who assesses it and decides what action is needed. Where we are controller and a breach is likely to result in a risk to people’s rights and freedoms, we will report it to the ICO within 72 hours of becoming aware, and where the risk is high we will also tell the affected individuals without undue delay. Where we are processor, we will notify the client controller without undue delay and support their assessment.

No transmission of data over the internet can be guaranteed completely secure. If you believe your interaction with us is no longer secure, tell us at [email protected].

11. How long we keep your data

We keep personal data only as long as we need it for the purpose we collected it, or as long as the law requires. We may keep it longer where there is a complaint, an investigation or a realistic prospect of litigation.

Data	Retention period
Enquiries that do not become clients	24 months from last contact
Prospect contact details that never respond	12 months from the last attempted contact
Client records and correspondence	Duration of the engagement plus 6 years
Accounting and tax records	6 years after the end of the accounting period
Platform accounts	Duration of the account, then deleted or anonymised after 90 days
Client advertising data and review tool output	Duration of the engagement, deleted when it ends
Files uploaded to our free tools	24 hours
Marketing suppression records	A minimal record of your email address and your opt-out, kept indefinitely so we can keep honouring it
Unsuccessful job applications	6 months, or 12 months where the applicant consents
Website and Platform server logs	12 months

12. Your rights, and how to complain

Under UK data protection law you have the right to access a copy of your personal data; to have inaccurate data corrected and incomplete data completed; to ask us to delete it where we have no good reason to keep using it; to ask us to restrict our use of it, for example while we check its accuracy; to object to processing based on our legitimate interests, and to object to direct marketing at any time; to receive data you gave us in a portable format; to withdraw consent where consent is our basis; and not to be subject to a decision based solely on automated processing that has legal or similarly significant effects.

Erasure is not an absolute right. We may need to keep some data, for example accounting records we are required to retain or data we need to defend a legal claim, and where we cannot delete we will tell you which ground applies.

To exercise a right, email [email protected]. There is normally no fee. We may ask for information to verify your identity so we do not disclose data to the wrong person. We will respond within one month and will tell you if we need to extend that by up to two further months because the request is complex or because you have made several. When responding to an access request we carry out a reasonable and proportionate search.

You can view and update your Platform account details by logging in, and ask us to close the account at any time. Your account is protected by a password, and you are responsible for keeping it confidential and signing out when you have finished.

You can stop marketing emails at any time using the unsubscribe link in any marketing email, or by contacting us. Every marketing email identifies Addesu as the sender and gives a valid address for opting out. Opting out does not stop service messages about an account or contract you hold with us.

Complaints. You have the right to complain to us about how we have handled your personal data, by any reasonable means. We will acknowledge your complaint in writing within 30 days, keep you updated if the investigation takes longer, and tell you the outcome without undue delay. You do not have to come to us first, but we would appreciate the chance to put things right. You can also complain to the Information Commissioner’s Office at www.ico.org.uk or on 0303 123 1113.

If your request concerns data held inside a client’s advertising account, we act as processor and will refer you to the client as controller, as explained in section 2.

13. Children

Our services are for businesses. The Platform and our free tools are for people aged 18 or over. We do not knowingly collect personal data relating to children. If you believe a child has given us personal data, contact us and we will delete it.

14. Changes to this policy, and how to contact us

We keep this policy under review and will publish updates on this page with a new version number and date. Where a change materially affects how we use your personal data we will take reasonable steps to tell you, for example by email to account holders.

Related documents: our Cookie Policy, and our Data Processing Agreement, which forms part of our client contracts and is available to clients from [email protected].

Contact us

[email protected] Addesu Ltd, Sandbox Workspace City, 37 Houndsditch, London, EC3A 7DB