Privacy Policy

Last updated: 20 July 2026

This policy explains what personal data I collect, why I collect it, and what I do with it. It covers this website, enquiries and client work.

I've tried to write it in plain English rather than legal boilerplate. If anything here is unclear, email me and I'll explain it.

1. Who I am

PPC Vibe is a paid search consultancy operated by Adam Riyadh as a sole trader, trading as PPC Vibe. For the purposes of UK data protection law, I am the data controller for the personal data described in this policy.

Controller	Adam Riyadh, trading as PPC Vibe
Address	4th Floor, Silverstream House, 45 Fitzroy Street, Fitzrovia, London W1T 6EB, United Kingdom
Email	adam@ppcvibe.com

The UK's data protection regulator is the Information Commissioner's Office (ICO). You can read more about your rights, and about how personal data must be handled, at ico.org.uk.

2. The law this policy sits under

I handle personal data in line with the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR), which govern cookies and marketing messages.

3. What I collect, and why

Website visitors

When you visit ppcvibe.com, limited technical data is collected automatically: your IP address, browser and device type, the pages you view, how you arrived, and how you interact with the site. This comes from cookies and similar technologies — see section 5.

Why: to understand how the site is used, to improve it, and to measure advertising.
Lawful basis: consent for analytics and advertising cookies. Strictly necessary cookies rely on legitimate interests.

Enquiries and form submissions

When you submit a form, book a call, or request an audit or teardown, I collect the information you provide. Typically:

• Your name and email address
• Your company name and website URL
• Your approximate monthly advertising spend
• Anything else you choose to tell me about your account or objectives

Why: to respond to you, assess whether we're a fit, prepare for a call, and deliver anything you've asked for.
Lawful basis: legitimate interests — responding to a business enquiry you initiated — and, where you're proceeding to work with me, taking steps prior to entering a contract.

Clients

If you become a client I hold contact details, contract and scope documentation, correspondence, billing records and the working records of the campaigns I run for you.

Why: to deliver the service, invoice, and meet legal and accounting obligations.
Lawful basis: performance of a contract, and legal obligation for financial records.

Marketing emails

I may send occasional emails about PPC Vibe services or paid search insight to business contacts who have enquired or worked with me. Every email carries an unsubscribe link, and unsubscribing takes effect immediately.

Lawful basis: legitimate interests for existing and prospective business contacts, or consent where you've opted in.

4. Client account data — my role as a processor

This section matters if you're a client rather than a website visitor.

To deliver PPC work I'm given access to systems that belong to you and that contain data about your customers — typically Google Ads, Microsoft Advertising, Google Analytics, Google Merchant Center, Google Tag Manager, and sometimes ecommerce platforms such as Shopify.

For that data, you are the controller and I act as a processor. That means:

• I only process your data on your instructions, for the purposes of the work you've engaged me for
• I don't use your data for my own purposes, and I don't sell or share it
• I access accounts under my own named user credentials, never shared logins, so activity is attributable
• Where the engagement is audit-only, I request read-only access and cannot change anything in your account
• I return or delete access and any working copies at the end of an engagement, on request
• I can enter into a data processing agreement on request — just ask

Where I handle customer-identifying data on your behalf — for example email addresses used for enhanced conversions or customer match audiences — it is hashed or otherwise protected in line with the relevant platform's requirements, and only ever used within your own accounts.

5. Cookies and tracking

This site uses cookies and similar technologies. Non-essential cookies are only set after you consent via the cookie banner, and you can change or withdraw your choice at any time.

Type	What it does	Consent
Strictly necessary	Makes the site work — page delivery, security, remembering your cookie choice.	Not required
Analytics Google Analytics (GA4)	Tells me which pages are viewed, for how long, and how people move through the site.	Required
Advertising Google Ads	Measures which ads lead to enquiries, and allows remarketing to people who've visited.	Required
CRM and forms HubSpot	Runs the forms and booking scheduler, and links a submission to the visit it came from.	Required
Social and other advertising Meta, LinkedIn, Microsoft Advertising	Measures and targets advertising on those platforms.	Required

You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop parts of the site working.

6. Who I share data with

I don't sell personal data. I share it only with service providers who process it on my behalf, and only as far as needed:

Provider	Purpose
Duda	Website hosting
HubSpot	CRM, forms, scheduling, email
Microsoft (Microsoft 365)	Email and file storage
Google	Analytics and advertising measurement
Meta, LinkedIn, Microsoft Advertising	Advertising measurement and targeting
Payment and accounting providers	Invoicing, payment processing, statutory accounts

I may also disclose data where I'm legally required to, or to establish or defend legal claims.

7. International transfers

Some providers above are based outside the UK, principally in the United States. Where personal data is transferred internationally, it is protected by an appropriate safeguard — either UK adequacy regulations, or the International Data Transfer Agreement or Addendum approved for use in the UK.

8. How long I keep it

Data	Retention
Enquiries that don't become clients	Up to 24 months from last contact
Client records and correspondence	Duration of the engagement, then up to 6 years
Invoices and financial records	6 years, as required by HMRC
Website analytics	Per the retention set in each platform, up to 26 months
Client account access	Removed at the end of the engagement

9. How I keep it secure

• Multi-factor authentication on email, CRM and advertising platforms
• Named individual access to client accounts — never shared logins
• Read-only access requested wherever the work doesn't require more
• Reputable providers with their own security and certification programmes
• Access limited to me; I do not currently use subcontractors

10. Your rights

Under UK data protection law you have the right to:

• Access the personal data I hold about you
• Rectify it if it's inaccurate or incomplete
• Erase it, in certain circumstances
• Restrict or object to processing, including direct marketing — an objection to marketing is always honoured
• Data portability, in certain circumstances
• Withdraw consent at any time, where consent is the basis

To exercise any of these, email adam@ppcvibe.com. I'll respond within one month. There's no charge.

11. Children

This site and these services are aimed at businesses. I don't knowingly collect data about anyone under 18.

12. Changes to this policy

I'll update this policy when what I do with data changes. The date at the top always reflects the current version.

13. Contact

Questions about this policy or your data: adam@ppcvibe.com