Privacy Policy

ThumbStop Social Ltd ("ThumbStop Social", "ThumbStop", "we", "our") are committed to protecting the privacy and security of personal data we collect about customers and users of our services ("you/your").

This privacy notice explains what personal data we collect about you when you use our website or provide our services to you. When we do this, we are the data controller. It also covers data accessed via third-party platform APIs on behalf of our clients.

Please read this privacy notice carefully, as it provides important information about how we handle your personal information and your rights. We may update this notice from time to time — please revisit it regularly.

If you have any questions, contact us using the details below or email us at support@thumbstopsocial.co.uk

ThumbStop Social Ltd is a social media and lead generation agency based in Walton-on-Thames, Surrey. We provide services including paid advertising management, organic social media management, content production, and performance reporting.

We operate a client dashboard platform that connects to third-party platforms (including Meta and LinkedIn) via authorised API integrations to retrieve and display performance data on behalf of our clients.

We collect, use, and are responsible for certain personal data about you. When we do so, we are subject to the UK General Data Protection Regulation ("UK GDPR"). The personal data we may collect includes (but is not limited to):

From website visitors:

• Contact details such as your name, phone number, email address, website URL, location (city), and company name, which we collect when you fill in our contact form
• Information about your engagement with us online via cookies and similar technologies, such as your IP address and geographical location

From clients and client users:

• Account credentials (name, email address, encrypted password) for dashboard access
• Business information (company name, ad account references)

Via third-party platform APIs (on behalf of clients):

• Advertising performance data (spend, impressions, clicks, reach, leads) from Meta Ads
• Page and profile analytics (reach, impressions, engagement, follower data) from Meta Graph API (Facebook Pages and Instagram Business accounts)
• LinkedIn Page analytics and advertising data, where API access has been granted
• This data relates to page and campaign performance, not to individual end users

We collect all personal data directly from you — in person, by telephone, text or email, and/or via our website. We also collect data via authorised API connections to Meta and LinkedIn, acting on behalf of and with the explicit authorisation of our clients, and via cookies and analytics tools on our website.

We process your personal data on the following lawful bases:

Where personal data is processed because it is necessary for the performance of a contract to which you are a party, we will be unable to provide our services without the required information.

Where we access data from third-party platforms (Meta, LinkedIn) via API:

• We do so only with the explicit authorisation of the client who owns or manages the relevant account
• Data is accessed solely for the purpose of generating performance reports for that client
• Platform data is stored securely in our infrastructure and is not shared with any other client or third party
• We comply with the terms of service and developer policies of each platform
• Clients may revoke our access at any time by removing our app's permissions within the relevant platform

We do not use platform data for advertising, profiling, or any purpose beyond client reporting.

For some business activities, we share your personal data with our vendors and third-party service providers — for instance, to provide email marketing services or payment processing.

Personal data may also be shared with government authorities and/or law enforcement officials for the prevention or detection of crime if required by law or if required for a legal or contractual claim.

We do not sell personal data to any third party.

The personal data we collect from you may be processed outside of the UK. We have taken appropriate steps to ensure that personal data processed outside the UK has an essentially equivalent level of protection. We do this by ensuring that:

• Your personal data is only processed in a country which the UK government has confirmed has an adequate level of protection (an adequacy regulation), or
• We enter into Standard Contractual Clauses (SCCs) with our affiliates and providers and ensure that supplementary measures are applied where necessary

We will retain your personal data for as long as is necessary to provide you with our services and for a reasonable period thereafter to enable us to meet our contractual and legal obligations and to deal with complaints and claims.

Platform analytics data accessed via API is retained for the duration of the client relationship and deleted upon termination.

At the end of the retention period, your personal data will be securely deleted or anonymised — for example, by aggregation with other data so that it can be used in a non-identifiable way for statistical analysis and business planning.

We endeavour to process all personal data securely and have implemented appropriate technical and organisational measures to protect data from unauthorised disclosure, use, alteration, or destruction. This includes encrypted storage of credentials and access tokens, role-based access controls, and secure infrastructure.

You have the following rights in respect of your personal data:

• The right to access your personal data and request copies of it and information about our processing of it
• If the personal data we hold about you is incorrect or incomplete, you can ask us to rectify or add to it
• Where we are using your personal data with your consent, you can withdraw consent at any time
• Where we are using your personal data because it is in our legitimate interests to do so, you can object to us using it this way
• Where we are using your personal data for direct marketing, including profiling for direct marketing purposes, you can object to us doing so

You can ask us to restrict the use of your personal data if:

• It is not accurate
• It has been used unlawfully, but you do not want us to delete it
• We do not need it anymore, but you want us to keep it for use in legal claims
• You have already asked us to stop using your data but are waiting for confirmation of whether we can comply

In some circumstances, you can compel us to erase your personal data.

You can request a machine-readable copy of your personal data to transfer to another service provider.

You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you.

You will not have to pay a fee to exercise any of these rights. However, we may charge a reasonable fee if your request is clearly unfounded or excessive.

To exercise any of your rights, please contact us at support@thumbstopsocial.co.uk

You can also lodge a complaint with the Information Commissioner's Office at ico.org.uk/concerns

Our website may contain hyperlinks to websites owned and operated by third parties. These third-party websites have their own privacy notices, and we strongly suggest you review them separately before submitting your data. We have no control over, and are not responsible for, third-party collection, use, or disclosure of your personal information.