01Who we are
Ascend Media is a Google Ads agency working with ecommerce brands across the Benelux and DACH regions. For the personal data described in this policy, the data controller is:
- Trading name: Ascend Media
- Established in: Dubai, United Arab Emirates
- Email: support@ascend-media.io
We are based in the United Arab Emirates and work with clients internationally, including in the European Economic Area and the United Kingdom. Where we offer services to clients there, the GDPR applies to us directly, and we apply GDPR standards to that data regardless of where it is processed.
We are not required to appoint a Data Protection Officer, and have not appointed one. Privacy questions go to the email address above and are handled by us directly.
02What this policy covers
This policy covers two different situations, and it is worth keeping them apart because our role — and your rights — differ in each.
- As controller. When you visit this website, book a call, email or message us, or work with us as a client contact, we decide why and how your data is processed. Sections 3 and 5 to 15 apply.
- As processor. When we work inside a client's Google Ads, Merchant Center, analytics or ecommerce platform, we process personal data on that client's instructions. The client is the controller. Section 4 explains this.
This policy does not cover third-party websites we link to, such as Calendly, WhatsApp, Discord or Google. Their own privacy policies apply once you leave this site.
03Data we collect
When you visit this website
This site is a static website. It has no contact form, no account system, and sets no cookies of its own. It does not run Google Analytics or any other visitor-tracking or advertising pixel.
Our hosting provider, Vercel, automatically records technical request data for security and reliability — your IP address, browser type and version, the pages requested, referring page, and the date and time of the request. The page also loads fonts from Google Fonts and an animation library from Cloudflare's public CDN; both receive your IP address as a technical necessity of serving those files to your browser.
When you book a call
Our booking links open Calendly, a third-party scheduling service. When you book, you provide your name and email address, and optionally a company name, phone number, and answers to any questions on the booking form. Calendly also records your time zone and the meeting details, and it sets its own cookies once its widget or page loads.
When you contact us
If you email us or message us on WhatsApp, we receive whatever you choose to send: your name, email address or phone number, and the content of your message. We keep this correspondence so we can answer you and maintain a record of what was agreed.
When you become a client
For client relationships we hold business contact details for the people we work with (name, role, email, phone), the commercial terms of the engagement, invoicing and payment records, and the login or delegated access we need to manage your advertising accounts. We may also hold notes, reports and correspondence relating to the work.
We do not intentionally collect special categories of personal data — health, ethnicity, political opinions, religious beliefs, trade union membership, genetic or biometric data, or data about sex life or sexual orientation — and we ask that you do not send such data to us.
04Data we handle on behalf of our clients
Managing advertising accounts means working with data that belongs to our clients and relates to their customers. Depending on the engagement, this can include:
- Conversion and measurement data from Google Ads, Google Analytics, Google Tag Manager and server-side tracking setups
- Product feed and Merchant Center data, including order and transaction data used for conversion values
- Customer lists a client chooses to upload for audience targeting or exclusion, such as Customer Match lists (typically hashed email addresses)
- Audience, remarketing and site-behaviour data generated by the client's own tags
In these cases the client is the controller and we act as processor under Article 28 GDPR. We process this data only on the client's documented instructions, under a data processing agreement (verwerkersovereenkomst) forming part of our engagement. We do not use client data for our own purposes, do not sell it, and do not use one client's data to benefit another.
If you are a customer of one of our clients and want to exercise your data rights, contact that business directly — they are the controller of their customer data. If you contact us instead, we will pass your request to them and support them in answering it.
05Purposes and legal bases
Under Article 6 GDPR we must have a legal basis for each processing purpose. Ours are:
| What we do | Legal basis |
|---|---|
| Serving and securing this website, preventing abuse, diagnosing faults | Legitimate interest (Art. 6(1)(f)) in a working, secure site |
| Scheduling and holding an introductory call | Steps taken at your request prior to a contract (Art. 6(1)(b)) |
| Answering your email or WhatsApp message | Legitimate interest (Art. 6(1)(f)) in responding to enquiries, or Art. 6(1)(b) if it leads to a contract |
| Delivering our services and managing the client relationship | Performance of a contract (Art. 6(1)(b)) |
| Invoicing, accounting and tax records | Legal obligation (Art. 6(1)(c)) |
| Occasional updates to existing clients about our services | Legitimate interest (Art. 6(1)(f)); you can object at any time |
| Establishing, exercising or defending legal claims | Legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interest, we have weighed our interest against your rights and freedoms, and we will stop if you object and we have no overriding grounds to continue.
08Transfers outside the EEA
We are established in the United Arab Emirates, and several of the providers above are established in the United States or process data there. The UAE has not received an EU adequacy decision, so where personal data of people in the EEA or UK reaches us or our providers, we rely on the safeguards in Chapter V GDPR: the European Commission's Standard Contractual Clauses, the EU–US Data Privacy Framework where the provider is certified, and appropriate technical and organisational measures.
You can ask us for details of the safeguards applying to a specific transfer by emailing support@ascend-media.io.
09How long we keep data
- Server logs: retained by our host for a short technical period, typically no more than 30 days
- Enquiries that do not become clients: up to 12 months after the last contact
- Client records and correspondence: for the duration of the engagement and 2 years after it ends
- Invoices and accounting records: at least 5 years, in line with UAE record-keeping requirements
- Client account data we process as processor: deleted or returned on the client's instruction when the engagement ends, as set out in the data processing agreement
Where a legal claim is reasonably foreseeable, we may keep relevant records until it is resolved or time-barred.
10Security
We apply measures appropriate to the risk: encrypted connections (HTTPS) across this site, access to client advertising accounts through delegated or role-based access rather than shared passwords wherever the platform allows, multi-factor authentication on accounts that support it, a password manager for credentials, and access limited to the two people who run the agency.
No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours where the GDPR requires it, and inform you and any affected clients directly where the risk is high.
11Your rights
Under the GDPR you have the right to:
- Access — ask whether we process your data and receive a copy
- Rectification — have inaccurate or incomplete data corrected
- Erasure — have your data deleted where one of the grounds in Art. 17 applies
- Restriction — have processing paused while a dispute is resolved
- Portability — receive data you gave us in a structured, machine-readable format
- Object — object to processing based on legitimate interest, including direct marketing, which we will always honour
- Withdraw consent — where processing is based on consent, without affecting what was lawful beforehand
Email support@ascend-media.io to exercise any of these. We respond within one month, extendable by two further months for complex requests, and we will tell you if we need the extension. We may ask you to confirm your identity first. Exercising these rights is free unless a request is manifestly unfounded or excessive.
12Complaints
If you think we have handled your data wrongly, tell us first — most issues are quickest to fix directly. If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with the data protection supervisory authority in your country of residence, place of work, or the place where you believe the issue occurred.
13Children
Our services are sold to businesses and this website is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
14Changes to this policy
We may update this policy as our services, tools or legal obligations change. The current version is always on this page, with the date at the top. Where a change materially affects how we handle your data, we will inform affected clients directly.
15Contact
For any question about this policy or about your personal data:
- Email: support@ascend-media.io
See also our terms of service.