Privacy Policy & Data Security
How Digital Optimizer collects, secures, and safeguards client business data, visitor analytics, and digital advertising intelligence.
Privacy Directory
Have a specific Data Processing Agreement (DPA) request?
Request Signed DPA1. Who We Are & Data Controller Identity
Digital Optimizer ("Agency", "we", "us", or "our") operates the website digitaloptimizer.co.uk and delivers premium performance marketing, social media acquisition, Google Ads management, search engine optimization (SEO), and custom web engineering services.
For the purposes of the General Data Protection Regulation (EU GDPR), the UK Data Protection Act 2018 (UK GDPR), and international data privacy statutes, Digital Optimizer acts as the Data Controller for information collected directly through our website, contact forms, and client onboarding workflows. When managing client ad accounts and analytics platforms, we act as a Data Processor operating under explicit contractual mandates.
2. Information We Collect Directly From You
We collect personal information that you voluntarily submit to us when requesting a digital marketing audit, filling out strategic inquiry forms, scheduling video discovery calls, or executing an enterprise retainer:
Contact & Identity Data
- Full Name & Business Job Title
- Corporate Email Address & Phone Number
- Company Name, Website URL, & Industry Sector
- Physical Business / Billing Address
Project & Campaign Data
- Monthly Ad Spend Budgets & Target ROAS
- Current Revenue Metrics & Acquisition Goals
- Target Audience Demographics & Geography
- Technical Briefs, Wireframes & Design Assets
3. Automated Technical Data & Device Analytics
As you navigate through digitaloptimizer.co.uk, our servers and analytics infrastructure automatically log standard technical telemetry to ensure optimal performance, security, and responsive styling:
- Device & Browser Information: Browser type (Chrome, Safari, Firefox), version, operating system (Windows, macOS, iOS, Android), screen resolution, and language preferences.
- Network & Connection Metrics: Anonymized Internet Protocol (IP) address, approximate geographic location (city/country level), Internet Service Provider (ISP), and connection speeds.
- Usage & Clickstream Data: Uniform Resource Locators (URLs) visited, referral URLs, time spent on each service page (SMM, Google Ads, Web Dev, SEO), bounce rates, and navigation paths.
- Performance Diagnostics: Core Web Vitals timings (LCP, FID, CLS), server latency, and error diagnostic logs to maintain sub-500ms page load speeds.
4. Marketing Pixels, Conversion APIs & Analytics Tags
As an elite digital performance agency, we implement industry-standard measurement technologies to assess the effectiveness of our campaigns and measure visitor engagement:
Google Analytics 4 & Google Ads
We use Google Tag Manager (GTM) and GA4 to track anonymized user sessions, conversions, and campaign attribution without capturing unmasked Personally Identifiable Information (PII).
Meta Pixel & Conversions API (CAPI)
Meta conversion signals measure advertising ROI on Facebook and Instagram. Server-side CAPI events are securely hashed using SHA-256 protocols before transmission.
TikTok Pixel & LinkedIn Insight
Measures video interaction metrics, B2B company demographics, and creative campaign performance for our paid social testing sprints.
User Session & Heatmap Tools
Tools like Microsoft Clarity or Hotjar record anonymized mouse scrolls and click paths. All text input fields containing passwords or personal numbers are strictly masked.
Google Consent Mode v2 Alignment
Our website respects user privacy preferences via Google Consent Mode v2. If a visitor declines marketing cookies, analytics and advertising tags dynamically adjust to cookieless ping signals without storing persistent identifiers.
5. How We Use Your Information
Digital Optimizer processes collected data strictly for legitimate commercial and operational purposes:
6. Legal Bases for Processing (UK GDPR & EU GDPR)
Under Article 6 of the General Data Protection Regulation, we rely on the following lawful grounds to process your personal data:
| Lawful Basis | Processing Purpose | Examples |
|---|---|---|
| Contractual Necessity | Fulfilling signed Statements of Work, delivering retainers, managing client accounts. | Building ad campaigns, configuring web servers, setting up domain DNS. |
| Consent | Direct email newsletters, non-essential cookies, retargeting tracking pixels. | Subscribing to agency growth case studies, accepting marketing cookies. |
| Legitimate Interests | Improving website usability, fraud prevention, B2B sales outreach to relevant businesses. | Analyzing website speed metrics, securing contact form submissions. |
| Legal Obligation | Fulfilling statutory tax reporting, VAT invoicing, and regulatory disclosures. | Maintaining financial transaction records for HMRC audit requirements. |
7. Client Account Privacy, IP Whitelisting & Non-Leakage
When clients grant Digital Optimizer access to their Meta Business Managers, Google Ads accounts, Search Consoles, CMS portals, or hosting servers, we enforce strict enterprise safeguards:
8. Cookie Classification & User Opt-Out Controls
Cookies are small text files stored on your device that allow us to enhance site navigation, analyze performance, and deliver tailored marketing:
| Cookie Category | Purpose | Lifespan | Status |
|---|---|---|---|
| Strictly Necessary | Essential for page routing, session security, and preloader mechanics. | Session / 1 Year | Always Active |
| Performance & Analytics | Tracks anonymous page views, Core Web Vitals speed, and traffic sources (GA4). | Up to 2 Years | User Consent |
| Targeting & Advertising | Enables Meta, Google, and TikTok retargeting for agency service campaigns. | 90 Days - 1 Year | User Consent |
How to Control Cookies: You can manage or disable cookies at any time through your web browser settings (Chrome, Safari, Firefox, Edge). To opt out of Google Analytics tracking across all websites, you can install the Google Analytics Opt-out Browser Add-on.
9. Third-Party Service Providers & Sub-Processors
We partner with vetted, enterprise cloud infrastructure providers to operate our digital agency ecosystem. All sub-processors maintain certified SOC 2, ISO 27001, or GDPR Data Processing Addendums (DPAs):
10. International Data Transfers & Standard Contractual Clauses
As a global agency serving clients worldwide, your data may be processed in servers located outside the UK or European Economic Area (EEA), such as the United States. Where international transfers occur, we implement legal safeguards including:
- UK International Data Transfer Addendum (IDTA): Issued by the Information Commissioner's Office (ICO).
- Standard Contractual Clauses (SCCs): Adopted by the European Commission ensuring equivalent data protection levels.
- EU-U.S. Data Privacy Framework: Verifying certified participating vendors for transatlantic data compliance.
11. Data Retention Periods & Automated Erasure
We retain personal data only for as long as necessary to fulfill the operational purposes outlined in this policy:
Form submissions without active contracts are purged after 12 months.
Campaign tracking tokens revoked 30 days after project completion.
Invoices and accounting logs retained as required by tax law.
12. Your Legal Rights (UK GDPR, EU GDPR, CCPA / CPRA)
Depending on your geographic location, you possess powerful legal rights regarding your personal information:
Request a complete copy of the personal data we hold about you in a structured, machine-readable format (JSON/CSV).
Request immediate correction of inaccurate or incomplete personal contact details or business information.
Request the permanent deletion of your personal records where no overriding legal retention obligation exists.
Object to direct marketing communications or request that we restrict active data processing operations.
30-Day Response SLA
We respond to all verified Data Subject Access Requests (DSAR) free of charge within thirty (30) calendar days. To exercise any of these rights, email our Data Protection team at [email protected].
13. Technical Security Measures & Incident Response
Digital Optimizer employs multi-layered technical and organizational safeguards:
- Encryption Everywhere: All web traffic is strictly encrypted using modern TLS 1.3 cryptographic protocols with HSTS preloading.
- Multi-Factor Authentication (MFA): Hardware and app-based MFA is mandatory across all internal agency management tools, code repositories, and ad platforms.
- Automated Vulnerability Scanning: Continuous dependency audits, static code analysis, and DDoS protection via Cloudflare enterprise proxy shielding.
- 72-Hour Breach Notification: In the unlikely event of a verified data breach impacting personal records, we will notify the UK Information Commissioner's Office (ICO) and affected individuals within 72 hours in accordance with GDPR requirements.
14. Data Protection Officer (DPO) & Contact Information
For questions regarding this Privacy Policy, data subject access requests, or specific compliance inquiries, please contact our Data Protection Officer: