Privacy Policy

1. Who we are

The Web Caterer is a UK digital marketing and web development business. For the purposes of UK data protection law, The Web Caterer is the controller of personal information it collects for its own business purposes.

When we handle advertising account data on a client's instructions, our role may instead be that of a processor acting for that client. The relevant client agreement may provide further details.

2. Information we may collect

Website and enquiry information

If you contact us, use a website form or correspond with us, we may collect your name, email address, telephone number, organisation, the content of your message and any other information you choose to provide.

Technical, analytics and cookie information

The site may collect technical information such as IP address, browser and device type, pages visited, referral source, approximate location and dates and times of visits. The site currently includes Google Analytics technology, which may use cookies or similar technologies to help us understand site use. See the “Cookies” section below.

Client and business information

We may hold client contact details, account administration information, service correspondence, billing records, permissions and audit records needed to provide and manage our services.

3. Paid Media Agent and advertising-platform data

PMA is an internal application operated by The Web Caterer. It connects only to advertising accounts that an account holder or authorised user has explicitly authorised. It currently supports Google Ads and may support other platforms, such as Meta Ads or Microsoft Advertising, where a user separately authorises those connections.

OAuth credentials and access or refresh tokens are used to authenticate API access. Depending on the platform, permissions granted and services requested, PMA may access:

• advertising account identifiers, names, users, permissions and account settings;
• campaign, ad group, advert, keyword, audience, budget, bidding and other configuration information;
• performance metrics such as impressions, clicks, spend, conversions and conversion values;
• search terms, conversion information and related account data made available by the relevant API; and
• change history, processing status, error information and audit logs.

This information is used for reporting, campaign analysis, optimisation recommendations, authorised campaign management, account administration, troubleshooting and audit logging. PMA does not access an advertising account unless the required permission has been granted.

4. Google Ads API and Google OAuth

Where Google access is authorised, PMA uses Google OAuth and the Google Ads API to authenticate and interact with the authorised Google Ads account. The scope of access depends on the permissions granted in Google and the functions used.

API credentials and authentication tokens are treated as confidential and are not intentionally exposed publicly. Appropriate technical and organisational measures are used to restrict access to people and systems that need it.

The Web Caterer does not sell Google user data obtained through OAuth or API access. Google advertising data is used only for the purposes described in this policy, to provide requested services, maintain security and comply with applicable law.

Access may be revoked through the relevant Google account, Google Ads account permissions or other advertising-platform permission settings. Revoking access prevents new API access but may not automatically delete information already retained where it is still required for a lawful purpose. You may contact us to request deletion as described below.

5. Why we use information and our legal bases

Depending on the circumstances, we process information:

• to take steps at your request or perform a contract, including providing digital marketing and authorised advertising account services;
• for our legitimate interests, including operating and improving our services, communicating with clients, producing reports, securing systems, preventing misuse and keeping appropriate audit records;
• with consent, where consent is required—for example, for certain cookies or an OAuth connection that you authorise; and
• to comply with legal, regulatory, tax, accounting or law-enforcement obligations.

Where a client is the controller and The Web Caterer acts as its processor, the client determines the relevant purpose and legal basis.

6. Storage and security

We use reasonable technical and organisational safeguards designed to protect information against unauthorised access, loss, misuse, alteration or disclosure. These may include access controls, authentication, encryption in transit where supported, restricted handling of credentials, system monitoring and audit logging. No internet transmission or storage system can be guaranteed completely secure.

7. How long we keep information

We retain information only for as long as reasonably necessary for the purposes described in this policy, to provide services, resolve disputes, maintain security and audit records, and meet legal, tax or accounting obligations. Retention periods vary according to the type of information, client instructions, contractual requirements and applicable law.

OAuth tokens are retained while needed to maintain an authorised connection and may be deleted or rendered unusable when access is revoked or the connection is removed, subject to operational backups and legal obligations. Advertising reports, logs or account data already created may be kept for an appropriate period where needed for client services, security, audit or legal purposes.

8. Sharing and service providers

We do not sell personal information. We may share information with:

• the client or account owner for whom services are provided, and authorised members of their team;
• advertising platforms, where needed to carry out an authorised action;
• trusted hosting, cloud, analytics, security, communications and professional service providers that support our operations; and
• regulators, courts, law-enforcement bodies or other parties where required by law or necessary to protect legal rights.

Service providers are permitted to use information only as needed to provide their services or as otherwise allowed by law.

9. International transfers

Some advertising platforms and service providers may process information outside the United Kingdom. Where UK data protection law requires it, we use an approved transfer mechanism or rely on another lawful safeguard, such as UK adequacy regulations or appropriate contractual protections.

10. Your data protection rights

Depending on the circumstances, UK data protection law may give you rights to request access to, correction of, deletion of, or restriction of your personal information; to object to certain processing; and to receive certain information in a portable format. Where processing relies on consent, you may withdraw that consent without affecting earlier lawful processing.

These rights are not absolute and exemptions may apply. If we process information only on behalf of a client, we may refer your request to that client.

To make a request for access, correction or deletion, email james@thewebcaterer.com. We may need to verify your identity and clarify the scope of your request. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.

11. Cookies

Cookies are small files placed on a device. The site may use cookies that are necessary for site operation and analytics cookies that help measure visits and usage. Google Analytics may receive technical and usage information through these technologies.

You can block or delete cookies using your browser settings. Blocking some cookies may affect site functionality. Where applicable law requires consent for non-essential cookies, those cookies should be used only after consent has been obtained.

12. Third-party services and links

This site and PMA may link to or interact with third-party services, including Google, Meta and Microsoft. Those organisations operate under their own privacy notices and terms. We are not responsible for the privacy practices of third-party websites or platforms.

13. Changes to this policy

We may update this policy when our services, technology or legal obligations change. The latest version will be published on this page with a revised “Last updated” date. Material changes may also be communicated through an appropriate additional channel.

14. Contact us

For privacy questions or requests, contact:

The Web Caterer
Email: james@thewebcaterer.com
Website: thewebcaterer.com