Global PPC is a Google Ads and Meta Ads agency serving UK businesses. GLOBAL PPC LTD is the data controller for the personal data described on this page, which means we decide how and why it is used. We are registered with the Information Commission's Office (ICO), the UK data protection regulator, under registration number 16086795.

We are not required to appoint a statutory Data Protection Officer. Our founder, Hassan Tahir, is responsible for data protection and advertising compliance and is your point of contact for anything on this page.

When we work inside a client's own Google Ads or Meta Ads account, we usually act as a data processor on that client's behalf. Section 04 explains how that works.

• ✓Identity and contact details: your name, work email, phone or WhatsApp number, business name and job role.
• ✓Business and account details: your website, target market, industry, monthly ad spend band, biggest challenge, the notes you give us, and your Google Ads Customer ID and Meta Ads Account ID.
• ✓Payment and billing details: payments are processed by Stripe. We receive your name, email, billing address, the amount, the date and the card type and last four digits so we can issue VAT invoices. We never see or store your full card number.
• ✓Communications: emails, WhatsApp messages, call notes and, where we tell you in advance, recordings of audit walkthrough calls.
• ✓Ad account data: what we can see when you give us read-only access to your ad accounts (see section 04).
• ✓Website and device data: IP address, browser and device type, pages visited and how you arrived, collected through cookies and similar technologies in line with your cookie choices (see section 11).

Where it comes from: mostly directly from you, through our forms, WhatsApp, email and calls. We also receive data from Stripe when you pay, from Google and Meta when you grant ad account access, from our analytics tools, and from public business sources such as Companies House and your own website when we prepare your audit.

The UK GDPR requires a lawful basis for every use of personal data. Here is ours for each purpose.

Where we rely on legitimate interests, we have balanced our interests against yours and concluded they are not overridden. You can ask us for details of that assessment. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

To audit or manage your advertising, we need access to your ad accounts. Those accounts can contain personal data about your customers and prospects, such as the search terms people typed, hashed customer lists, lead form submissions and offline conversion uploads. You remain the controller of that data. We process it only on your instructions, as your processor under UK GDPR Article 28.

• ✓Audits use read-only access. We can see performance data but cannot change campaigns, budgets, billing or users.
• ✓We don't download or export your customer lists or lead form data, and we never use your account data for our own purposes or for other clients.
• ✓Access ends when the job ends. We remove our access within [5 working days] of your walkthrough call. You can revoke it yourself at any time.
• ✓Managed clients get a written data processing agreement covering everything Article 28 requires, including confidentiality, security, sub-processors, breach notification and deletion or return of data at the end of the contract.

Audit clients are covered by the processor terms in our terms and conditions.

We never sell personal data and we never share it with anyone for their own marketing. We use trusted service providers who process data on our behalf under written contracts:

We may also share data with our professional advisers (accountants, lawyers, insurers), and with HMRC, the ICO, the police or courts where the law requires it. If our business is ever sold or restructured, data may transfer to the new owner under the same protections.

Some of our providers process data outside the UK. We only allow this where the transfer meets UK data protection law: either the destination is covered by UK adequacy regulations, or we use an appropriate safeguard such as the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with an assessment that the level of protection is not materially lower than in the UK.

[If any team member, contractor or provider accesses personal data from a country outside the UK, name the country and the safeguard used here.] You can ask us for a copy of the relevant safeguards.

When the period ends, we securely delete the data or fully anonymise it.

• ✓Multi-factor authentication on every business account, including email, ad platforms, payment and file storage.
• ✓Least-privilege access: read-only for audits, and only the people working on your account can see your data.
• ✓Encryption in transit across our website, forms and tools, plus a password manager and confidentiality commitments for everyone who handles client data.
• ✓Breach response: if a personal data breach is likely to put people's rights at risk, we report it to the ICO within 72 hours of becoming aware of it, and we tell affected people without undue delay where the risk is high.

How to use them: email [hello@globalppc.org] or message us on WhatsApp. It's free in almost all cases. We respond within one month, and we can extend that by up to two further months for complex or numerous requests, telling you why within the first month. If we need to confirm your identity or clarify what you're asking for, the time limit starts once we have that information. We carry out reasonable and proportionate searches for your data.

If you think we've misused your personal data or mishandled a request, you have the right to complain to us. Here's how our process works:

You can also complain to the UK regulator, the Information Commission's Office (ICO), at ico.org.uk/make-a-complaint or on 0303 123 1113. The ICO normally asks people to raise their complaint with the organisation first, so we'd appreciate the chance to put things right.

Cookies, pixels and similar technologies store or read information on your device. Under PECR, we must ask for your consent before using any that aren't covered by a legal exception. Analytics and advertising technologies stay switched off until you choose to allow them, and rejecting them is as easy as accepting them.

We use Google Consent Mode v2, so Google tags respect your choice. When you decline, they don't set analytics or advertising cookies.

When you click through to pay, you move to Stripe's checkout, which sets its own cookies for security and fraud prevention under Stripe's privacy policy. Our pages also load fonts from Google Fonts, which means your browser shares your IP address with Google.

• ✓Individuals and sole traders: we only send marketing emails, texts or WhatsApp messages if you've opted in, or if you're a customer or were negotiating with us and we offered you a simple way to opt out when we collected your details. In that case we only tell you about similar services of our own.
• ✓Company email addresses: we may send relevant business-to-business emails to staff at limited companies and LLPs. Every message identifies us and includes an easy unsubscribe.
• ✓Phone calls: before any live marketing call, we screen numbers against the Telephone Preference Service (TPS) and Corporate TPS, and we respect any objection. We never make automated marketing calls without consent.
• ✓Service messages aren't marketing: messages about an audit you booked, such as access requests, delivery and your walkthrough call, are sent because they're part of the service.
• ✓We never buy or rent contact lists and we never hide who we are.

Opting out is free and immediate: click unsubscribe, reply "STOP" on WhatsApp or text, or email [hello@globalppc.org]. We'll add you to our suppression list so you don't hear from us again.

As an advertising agency, we hold ourselves to the same code we apply to clients: the UK Code of Non-broadcast Advertising and Direct & Promotional Marketing (the CAP Code), enforced by the ASA, together with the Business Protection from Misleading Marketing Regulations 2008 and the consumer protection rules in the Digital Markets, Competition and Consumers Act 2024.

How we advertise ourselves

• ✓Claims we can prove: we hold documentary evidence before publishing any objective claim, including results, client numbers, ratings, certifications and comparisons with other agencies.
• ✓Results are examples, not promises: performance figures such as the 13.59x ROAS on our website come from a specific client account over a specific period, published with that client's permission. They aren't typical or guaranteed. Your results depend on your market, offer, budget, website and tracking. We don't guarantee any level of ROAS, leads or revenue.
• ✓Clear prices: [Choose one and make every price on the site match: "Our prices are business prices shown excluding VAT at 20%. For example, the Paid PPC Audit is £950 + VAT (£1,140 including VAT)." OR "All prices include VAT at 20%."]
• ✓Conditions stated up front: the £950 audit fee is credited against your first month's management fee if you sign a management agreement within [90 days] of audit delivery. Our free teardown is genuinely free, with no payment details and no obligation.
• ✓Genuine reviews only: we never write, buy or incentivise reviews, and we never hide negative ones. Testimonials are used with the client's written permission, and ratings are shown with their source and the number of reviews.
• ✓Accurate badges: partner badges and certification counts reflect our current status and can be verified on request.
• ✓Recognisable marketing: our ads, emails and social posts are clearly marketing, and any paid partnership is labelled as an ad.

The ads we create for clients

Before launch, we check ad copy, offers and landing pages against the CAP Code and Google and Meta advertising policies. We ask clients for evidence of their product and results claims, and we will pause or decline ads we believe break the rules. We take particular care in regulated sectors:

Complaints about advertising

If you think any of our ads, or an ad we run for a client, is misleading or irresponsible, please tell us first at [hello@globalppc.org] and we'll investigate. You can also complain to the Advertising Standards Authority at asa.org.uk.

Children: our services are for businesses and this website is not aimed at anyone under 18. We don't knowingly collect children's personal data. If you think we have, contact us and we'll delete it.

Changes: we review this page at least once a year and whenever the law or our practices change. The date at the top shows the latest version. If we make significant changes that affect current clients, we'll tell you by email.