Privacy policy

1. Introduction

By using our website or giving us your personal data, you confirm that you have read and understood this Privacy Policy.

2. Who we are

Ridley Digital is a paid search and SEO consultancy. We build the account structure, bidding, search strategy, content and measurement that a business needs to connect search to revenue, then hand that system back so the client can run it.

Data controller: Ridley Partners Ltd (trading as Ridley Digital) is the data controller responsible for your personal data.

If you have any questions about this policy or how we handle your data, please contact us using the details above.

3. What personal data we collect

3.1 Information you give us directly

• Contact information: name, email address, phone number, company name and job title.
• Communication data: the content of emails, messages, enquiries or other correspondence you send us.
• Professional information: business details, industry sector, current marketing and search setup, and other information relevant to scoping an engagement.
• Marketing preferences: your preferences for receiving marketing communications from us.
• Billing information: billing address and the details needed to invoice you for a paid engagement.

3.2 Information we collect automatically

• Technical data: IP address, browser type and version, device type, operating system, and time zone setting.
• Usage data: how you use our website, including pages visited, time on page, links clicked and referral source.
• Cookies and similar technologies: data collected through cookies and similar technologies (see Section 11).

3.3 Information from third parties

We may receive limited personal data about you from analytics providers, from professional networking sites such as LinkedIn where you contact us through them, and from referral sources and publicly available business sources.

4. How we use your personal data

We process your personal data only when we have a lawful basis under UK GDPR. The bases we rely on are consent, contract, legal obligation and legitimate interests.

4.1 Purposes of processing

4.2 Marketing communications

We may send you marketing communications if you have given us consent, or if you are an existing client and we are marketing similar services (soft opt-in) and you have not opted out. You can opt out at any time by using the unsubscribe link in any marketing email or by contacting us at hello@ridleydigital.co.uk.

5. How we share your personal data

We do not sell, rent or trade your personal data. We may share it with the following categories of recipient where necessary.

5.1 Service providers

We work with a small number of third-party providers who process data on our behalf, including our website host, our analytics provider, and our professional advisors such as our accountant. A list of the main providers is in Section 13. Each operates under terms that require them to protect your data.

5.2 Legal and regulatory authorities

We may disclose your personal data to law enforcement, regulators, courts and professional advisors where required by law or in connection with legal proceedings.

5.3 Business transfers

If Ridley Partners Ltd goes through a merger, acquisition or sale of assets, your personal data may be transferred to the new owner, subject to this Privacy Policy.

6. How long we keep your data

We keep your personal data only for as long as we need it for the purposes in this policy and to meet our legal obligations.

After the retention period ends, we securely delete or anonymise your personal data. We may keep data longer where the law requires it or for the establishment, exercise or defence of legal claims.

7. Your rights under UK GDPR

Under UK data protection law you have the following rights over your personal data:

1. Right of access: you can ask for a copy of the personal data we hold about you.
2. Right to rectification: you can ask us to correct inaccurate or incomplete data.
3. Right to erasure: you can ask us to delete your personal data in certain circumstances.
4. Right to restrict processing: you can ask us to limit how we use your data.
5. Right to data portability: you can ask for a copy of your data in a structured, commonly used, machine-readable format.
6. Right to object: you can object to processing based on legitimate interests or to direct marketing.
7. Rights related to automated decision-making: you have rights regarding automated decisions and profiling.
8. Right to withdraw consent: where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, contact hello@ridleydigital.co.uk. We will respond within one month, which can be extended by up to two further months for complex requests. We may need to verify your identity first.

Where we act as a processor on behalf of a client (for example, when we work with data inside that client's advertising or analytics accounts), rights requests from that client's customers should be directed to the client as controller. We will support the client in responding, as set out in our Data Processing Agreement with them.

8. How to make a data protection complaint

8.1 Complaints to us

If you are concerned about how we handle your personal data, you can raise it by emailing hello@ridleydigital.co.uk or writing to us at:

We will acknowledge your complaint within 30 days, investigate without undue delay, keep you updated, and respond as quickly as we can.

8.2 Complaints to the ICO

You also have the right to complain to the UK Information Commissioner's Office (ICO):

9. Data security

We take the security of your personal data seriously and use appropriate technical and organisational measures to protect it, including encryption of data in transit using SSL/TLS, restricted access to systems that hold personal data, strong authentication on key accounts, regular updates, and terms with our providers that require them to maintain security standards.

No method of transmission over the internet or electronic storage is fully secure, so we cannot guarantee absolute security. Where the law requires it, we will notify you and the ICO of a relevant data breach without undue delay, and within 72 hours where feasible.

10. Third-party links

Our website may link to third-party websites and tools. Following those links may allow third parties to collect or share data about you. We do not control these sites and are not responsible for their privacy practices. We encourage you to read the privacy policy of every site you visit.

11. Cookie policy

Our website uses cookies and similar technologies to tell you apart from other users, to improve your experience, and to understand how the site is used.

What cookies are

Cookies are small text files placed on your device when you visit a website. They are widely used to make websites work and to give information to site owners.

Types of cookies we use

We do not use advertising or targeting cookies on this website.

Managing cookies

You can manage your preferences through the cookie banner when you first visit, through your browser settings, or with browser extensions that block tracking cookies. Disabling some cookies may affect how the website works.

12. Working in your advertising and search accounts

This section explains how we handle data when we deliver a paid engagement. Each engagement that involves us processing personal data on your behalf is governed by a separate Data Processing Agreement (DPA), which sets out the specific terms.

12.1 Controller and processor roles

For our own business (your contact details, enquiries, billing, the running of this website), Ridley Partners Ltd is the data controller.

When we work inside your own accounts, such as Google Ads, Microsoft Ads, Google Analytics and Google Search Console, any personal data within those accounts (for example, audience and conversion data relating to your customers) remains under your control. For that data you are the data controller and we act as your data processor, under the DPA attached to your engagement.

12.2 Your accounts stay yours

We build and run campaigns inside accounts you own, under your billing, with access you can withdraw at any time. We do not take ownership of your accounts, your audience data or your conversion history. On handover, all of it stays with you.

12.3 What we access

To do the work, we access the campaign, analytics and search data inside your accounts. We do not need or ask for raw payment instrument data, special category data under UK GDPR Article 9, or employee payroll data, and you should not place such data in the accounts we work in.

13. Service providers

The following providers support our website and business. Each operates under terms that require appropriate technical and organisational safeguards.

Where we deliver a paid engagement, we also work inside the third-party platforms you use, such as Google Ads, Microsoft Ads, Google Analytics and Google Search Console. Those platforms are governed by their own terms and privacy policies, and where we process personal data within them on your behalf, the DPA attached to your engagement applies.

This list is current as of the date above. We will update it when our providers change.

14. International data transfers

Some of our providers, including Google Analytics, process data outside the United Kingdom, including in the United States. Where personal data is transferred outside the UK or the European Economic Area, we rely on appropriate safeguards under UK GDPR Chapter V, including:

• the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, as appropriate;
• transfers to countries covered by a UK adequacy decision; or
• other lawful transfer mechanisms approved by the UK Information Commissioner.

For paid engagements, the position on international transfers is also set out in the DPA, which you are asked to review and sign before the engagement begins.

15. Changes to this privacy policy

We may update this Privacy Policy from time to time. Material changes will show in an updated revision date at the top of this page, and where appropriate we will tell clients with active engagements directly. Please review this policy from time to time.