Privacy policy.

Last updated: 13 November 2026
Organisation: Synergic Marketing and Business (trading as “SMB”, “smb-marketing.agency”, “the Company”, “we”, “us” or “our”)
Registered operations: United Kingdom
Contact: [email protected]

1. Scope and overview

This Privacy Policy governs the collection, processing, storage and retention of personal data and commercial information by SMB. It applies to:

• Visitors and users of smb-marketing.agency (the “Site”);
• Prospective clients submitting enquiries, campaign audits or consultation requests; and
• Active, onboarding and historical clients (“Clients”) who engage SMB for digital marketing, paid advertising management, search engine optimisation, creative production, consulting, data analytics or operational workflows (collectively, the “Services”).

This policy sits alongside any Master Services Agreement (MSA), Statement of Work (SOW) or Terms of Business executed between SMB and the Client. By accessing our Site, communicating with our team or engaging our Services, you acknowledge the terms of this Privacy Policy.

2. Status under data protection law

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018:

• As a Data Controller: SMB acts as a Controller regarding personal data relating to our website visitors, prospective leads and direct business contacts at our Client organisations (for example names, business email addresses and billing details).
• As a Data Processor: when managing advertising accounts, lead generation funnels, customer lists or CRM databases on behalf of a Client, the Client acts as the Data Controller and SMB acts as the Data Processor, carrying out processing in accordance with the Client’s instructions and agreed Service terms.
• Commercial and non-personal data: operational heuristics, advertising metadata, campaign taxonomies and anonymised analytics do not constitute personal data under UK law, and are processed under our unrestricted commercial discretion as outlined in sections 5 and 6.

3. Information we collect

A. Client account and commercial data

To onboard Clients, manage billing and execute marketing campaigns, we collect:

• Identity and contact data: full names, job titles, business trading names, registered company numbers, corporate email addresses and telephone numbers.
• Billing and financial data: invoicing details, VAT registration numbers and transactional records. SMB does not take card payments.
• Advertising and integration access: delegated administrative access tokens, API credentials and user permissions across third-party networks (for example Google Ads, Meta Business Suite, TikTok Ads Manager, LinkedIn Campaign Manager, CRMs and web analytics platforms).
• Campaign collateral: brand guidelines, customer demographic profiles, creative assets, copywriting drafts, product catalogues, pricing models and historical conversion metrics.

B. Client warranties regarding customer lists (“clean hands”)

Where a Client provides SMB with existing customer lists, prospect databases or CRM exports for lookalike targeting, custom audience matching or direct marketing:

• The Client explicitly warrants that all such personal data has been obtained, processed and transferred in full compliance with the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
• The Client confirms that valid, verifiable consents or appropriate lawful bases have been documented.
• The Client agrees to indemnify and hold harmless SMB against any regulatory investigations, Information Commissioner’s Office (ICO) notices, fines or third-party claims arising from unlawfully sourced Client data.

C. Communications

• Records of email correspondence, strategy call notes, transcripts and support tickets via [email protected].
• WhatsApp. Choosing a WhatsApp link opens WhatsApp. We then see your number and whatever you send. WhatsApp’s own terms and privacy notice apply to how Meta handles messages.
• The “write it here” form on the contact page prepares an email in your own mail app. Nothing is transmitted to us until you press send there, and your email provider handles the message on its way.

D. This website

• Optional website measurement. With your separate permission, Google Analytics 4 (via Google Tag Manager) records page visits, acquisition channels and non-personal enquiry-button activity; Microsoft Clarity records heatmaps and session interactions to help us understand usability. Neither service loads until its category is enabled. In this protected preview, collection is disabled regardless of preferences. No Meta Pixel, remarketing or advertising tracker is installed.
• Changing your choice. Choose 'Cookie settings' in the footer to reject, accept or change Analytics and Experience insights independently. We remember this choice in browser storage for up to 180 days. Analytics/Clarity cookies may be set only after opting in, and rejecting can remove accessible analytics cookies and prevent further requests. Your browser can also erase stored site data.
• What is measured. Consented events can include traffic channel/campaign, pages viewed, CTA placement and enquiry intent. Clicking WhatsApp or preparing an email does not prove a message was delivered or a customer acquired. We do not include enquiry text, form answers, internal search terms, budget calculator figures, telephone numbers or email addresses in custom analytics events. Microsoft Clarity masks sensitive inputs by default.
• Standard server logs. Our hosting provider records technical information, such as your IP address, the browser, the page requested and the time, to deliver the Site and keep it secure.
• Fonts, search and tools are all served from this Site. The Knowledge Hub search and the calculators run in your browser, and what you type into them is not sent to us.
• Links to other websites (for example LinkedIn and Facebook) take you to services with their own privacy practices. We are not responsible for them.

4. Purposes and lawful bases of processing

We process data under the following lawful bases under UK GDPR Article 6:

5. Artificial intelligence (AI) and machine learning practices

SMB employs enterprise-tier Artificial Intelligence (AI), Large Language Models (LLMs), automated machine learning pipelines and predictive algorithms to deliver high-velocity, commercially competitive marketing solutions.

A. Strict exclusion of public model training

SMB contractually enforces and technically configures enterprise zero-data-retention safeguards with commercial AI platform providers. No confidential Client trade secrets, proprietary brand assets or personally identifiable information will be used to train, update or calibrate public, open-source or third-party commercial AI foundation models.

B. Permitted internal model training and operational efficiency

Clients grant SMB an irrevocable, royalty-free, worldwide, non-exclusive licence to ingest, process and apply non-identifiable commercial data, campaign performance metadata and workflow artefacts within our private, firewalled, internal systems. This internal processing applies explicitly to:

• Campaign performance metadata: cost-per-acquisition (CPA), return-on-ad-spend (ROAS), click-through rates (CTR), bidding curves and audience conversion pacing;
• Ad copy frameworks and semantic patterns: headline structures, syntactic angles, emotional hooks and value proposition formats;
• Funnel architecture and UX blueprints: layout hierarchies, landing page wireframes, form field conversion patterns and drop-off ratios;
• Search and intent taxonomies: keyword clusters, search intent structures and negative keyword databases;
• Bidding and algorithmic heuristics: dayparting schedules, pacing velocity, budget allocation equations and attribution decay patterns;
• Creative lifecycles and ad fatigue models: creative burnout decay curves, asset format efficiency ratios and hook retention dynamics;
• Operational artefacts: internal strategy prompts, SOP templates, testing hypotheses and procedural workflows.

C. Intellectual property of algorithmic derivatives

Any internal machine learning weights, neural adjustments, prompt libraries, algorithmic scripts, heuristics or operational tools developed or refined by SMB using data gathered during service provision remain the sole and exclusive intellectual property of SMB. Clients acquire no proprietary rights, ownership claims or licensing interests in these internal operational assets.

D. Catch-all operational artefact processing

Any reference to specific data categories or performance indicators within this policy is illustrative and non-exhaustive. The rights granted to SMB to process operational information for efficiency and internal model calibration extend to all non-identifiable telemetry, workflow diagnostics, system logs, testing iterations and analytical outputs generated now or in the future during the course of the engagement.

E. Independent editorial verification and AI disclaimers

AI tools generate probabilistic suggestions. While SMB applies human oversight, strategy and quality assurance to all deliverables:

• SMB provides no warranty that AI-assisted drafts, predictive ROAS forecasts or automated campaign analyses are completely error-free.
• The Client retains ultimate responsibility for vetting and approving all commercial claims, factual statements, legal disclosures, advertising standards compliance (including Advertising Standards Authority / ASA regulations) and intellectual property clearances prior to public dissemination.

6. Aggregated and anonymised data rights

SMB frequently synthesises cross-client marketing telemetry to identify macro trends across industries (for example average cost-per-click across specific UK commercial sectors).

Because truly anonymised and aggregated data cannot directly or indirectly identify any individual person or individual Client, SMB retains perpetual, unrestricted ownership of these aggregated datasets. SMB reserves the right to use this anonymised data for published case studies, industry benchmarks, whitepapers and agency marketing materials.

7. Third-party platforms, integrations and API volatility

To execute digital campaigns, SMB integrates with third-party software, advertising exchanges and cloud platforms (for example Google, Meta, TikTok, LinkedIn, Amazon and HubSpot).

• Platform terms: the processing of data within third-party advertising platforms is subject to those platforms’ respective terms of service and privacy declarations.
• Platform volatility disclaimer: SMB relies on third-party digital networks, ad approval engines and external AI application programming interfaces (APIs) whose policies, algorithms, uptime, account approvals and operational terms are outside SMB’s direct control. SMB accepts no liability for third-party platform service deprecations, algorithmic distribution changes, sudden ad account suspensions, API access revocations or policy modifications enacted by third-party platforms.

8. Data sharing and sub-processors

SMB does not sell, rent or trade personal data. We disclose information solely to:

• Approved infrastructure sub-processors: secure cloud hosting providers, internal task management databases, communication tools and enterprise AI API vendors operating under binding confidentiality and UK GDPR-compliant Data Processing Agreements.
• Advertising channels: direct advertising platforms chosen and authorised by the Client to deploy campaigns.
• Corporate reorganisation: successors in title, assignees or purchasers in the event of a merger, acquisition, business sale or corporate restructuring of SMB.
• Legal and regulatory mandates: UK law enforcement, tax authorities (HMRC), the courts of England and Wales, or legal advisers where strictly necessary to comply with the law or defend legal claims.

We do not use website enquiries for advertising.

9. Data security and transmission limits

We employ appropriate technical and organisational measures designed to safeguard personal data, including TLS/SSL encryption for data in transit, encrypted storage protocols, role-based access restrictions and multi-factor authentication (MFA) across all agency workstations and cloud systems.

However, no method of transmission over the internet can be guaranteed as completely impenetrable. SMB disclaims any implied warranty of absolute security. Clients remain solely responsible for safeguarding their own login credentials, multi-factor backup codes and administrative access permissions.

10. Data retention and irrevocability of algorithmic weights

We retain personal data only for as long as necessary to fulfil the commercial purposes for which it was gathered, satisfy contractual deliverables, and adhere to statutory UK accounting and corporate retention obligations (typically six years following the conclusion of a financial year). Website enquiries that do not lead to work are kept only as long as we need them to deal with your message and to keep ordinary business records, and are then deleted. If you ask us to delete a message sooner, we will, unless we are legally required to keep it.

Website measurement retention: if you choose Analytics, our Google Analytics 4 property is configured to retain eligible user-level and event-level analytics data for 14 months. This setting primarily affects GA4 explorations and funnel analysis, and does not necessarily limit aggregated reports or every category of data processed by Google. Clarity retention follows Microsoft’s applicable service policies; you can change or withdraw the relevant preference using Cookie settings.

Irrevocability of internal model weights: because internal machine learning fine-tuning and algorithmic calibration permanently alter mathematical weights, parameters and integrated heuristics, rights of data deletion or return do not apply retroactively to private algorithmic weights or aggregated operational metrics generated prior to a deletion request.

11. Your statutory rights under UK GDPR

Subject to statutory exemptions, individuals located in the United Kingdom hold the following rights:

• Right of access: the right to obtain confirmation as to whether their personal data is being processed and to receive a copy of that data.
• Right to rectification: the right to require the correction of inaccurate or incomplete personal records.
• Right to erasure (“right to be forgotten”): the right to request the deletion of personal data, subject to ongoing statutory, legal defence or contractual processing exemptions.
• Right to restriction of processing: the right to temporarily freeze the processing of personal data in certain circumstances.
• Right to object: the right to object to processing based on legitimate interests or direct marketing.
• Right to data portability: the right to receive personal data in a structured, commonly used and machine-readable format.

To exercise any of these rights, contact us at [email protected]. We may request proof of identity before completing your request. You also retain the right to lodge a complaint with the UK supervisory authority:

• Information Commissioner’s Office (ICO)
• Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Website: ico.org.uk

12. Blue-pencil severability

If any provision or part-provision of this Privacy Policy, including terms governing internal algorithmic weights, efficiency processing or liability exclusions, is held by a court or administrative body of competent jurisdiction to be invalid, illegal or unenforceable under UK law, that provision shall be deemed deleted or severed to the minimum extent necessary. Such severance shall not affect the validity, legality and enforceability of the remaining provisions of this Policy.

13. Governing law and jurisdiction

This Privacy Policy, any disputes and any claims arising out of or in connection with it or its subject matter (including non-contractual disputes) are governed by and construed in accordance with the laws of England and Wales.

You irrevocably agree that the courts of England and Wales have exclusive jurisdiction to settle any dispute or claim arising out of or in connection with this Policy or its formation.

14. Updates to this policy

SMB reserves the right to amend, update or replace this Privacy Policy at any time to reflect operational, technological or legal developments. The updated version will be marked with a revised “Last updated” date at the top of this document and published directly on the Site. Continued use of the Site or engagement with our Services following the publication of changes constitutes acceptance of the revised terms.

15. Contact details

For enquiries, operational data requests or questions regarding this Privacy Policy and our artificial intelligence workflows, please contact:

• Synergic Marketing and Business (SMB)
• Location: United Kingdom
• Email: [email protected]
• Website: smb-marketing.agency