Privacy Policy
This Privacy Policy explains how GUPF DIGITAL LLC ("GUPF Digital", "we", "us") collects, uses, shares and protects personal data. It covers this website, the advertising services we operate for our clients, and the internal tools we use to manage advertising accounts through platform APIs, including the Google Ads API.
1. Who we are
GUPF DIGITAL LLC is a growth and lead generation agency registered in the State of Delaware, United States.
GUPF DIGITAL LLC
254 Chapman Road, STE 208 #19720
Newark, Delaware 19702, United States
Email: hello@gupfdigital.com
2. Scope of this policy
We handle personal data in three distinct roles, and your rights depend on which one applies:
- As a controller: for visitors of this website and for our own business contacts and clients.
- As a processor: for personal data contained in advertising campaigns we operate on behalf of a client, including leads generated by those campaigns. In that case our client is the controller and their own privacy policy governs how the data is ultimately used.
- As an API client: when we access advertising accounts owned by our clients through platform APIs such as the Google Ads API.
3. Data we collect
3.1 Website visitors
This website is a single static page. We do not run analytics scripts, advertising pixels or tracking cookies on it. Our hosting and CDN provider processes technical connection data (such as your IP address, user agent and requested URL) in server logs for security and delivery purposes. The page also loads fonts and libraries from third-party providers (Google Fonts and unpkg), which receive your IP address as a technical necessity of serving those files.
3.2 People who contact us
If you email or call us, we process the contact details and the content of your message in order to reply and, where relevant, to manage a commercial relationship.
3.3 Leads generated through advertising campaigns
When we operate lead generation campaigns for a client, personal data submitted by prospects, typically name, email address, phone number, postal code and answers to qualification questions, is collected through the advertising platform's native lead form or through a landing page form. This data is collected for and on behalf of the client whose campaign it is, and is transmitted to that client, who is the controller and determines how it is subsequently used.
3.4 Advertising account data
Through platform APIs we access campaign structures, budgets, creative assets, keywords, audience configuration, conversion actions and performance metrics belonging to the advertising accounts our clients have granted us access to. This data is largely aggregated and commercial rather than personal, but may include limited personal data such as account user names and email addresses.
4. Google API Services
We use the Google Ads API to manage and report on Google Ads accounts that our clients have explicitly authorised us to access. Access is granted through a service account added as a user to the relevant Google Ads account or manager account, and can be revoked by the account owner at any time from the Google Ads interface.
GUPF Digital's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, data obtained through Google APIs is used only to operate, optimise and report on the advertising accounts of the client that granted access. We do not use it to build advertising profiles, we do not transfer it to third parties other than the client it belongs to and the sub-processors listed in section 7, we do not use it to train generalised artificial intelligence or machine learning models, and we do not allow humans to read it except where necessary for the operation of the client's account, for security purposes, to comply with applicable law, or where the client has explicitly asked us to.
5. How we use personal data
| Purpose | Legal basis (GDPR) |
|---|---|
| Delivering and securing this website | Legitimate interest |
| Responding to enquiries and managing client relationships | Contract / legitimate interest |
| Creating, managing and optimising advertising campaigns for clients | Contract (as processor, on the client's instructions) |
| Transmitting generated leads to the client whose campaign produced them | Contract (as processor, on the client's instructions) |
| Measuring campaign performance, including importing conversion data back to advertising platforms | Contract / legitimate interest of the client |
| Meeting accounting, tax and other legal obligations | Legal obligation |
Where the collection of a lead relies on consent, that consent is obtained by the advertising platform's lead form or by the landing page at the moment of submission, on behalf of the client running the campaign.
6. Automated decision-making
Advertising platforms use automated systems to decide which ads are shown to which people. We configure targeting, budgets and optimisation goals, but we do not make automated decisions that produce legal effects concerning you or similarly significantly affect you.
7. Sharing and sub-processors
We do not publish or make personal data publicly available. We share it only with:
- The client whose campaign generated the data.
- Advertising platforms: Google (Google Ads), Meta (Facebook and Instagram) and TikTok, when campaigns are created, when conversion data is imported, or when audiences are configured. Each platform processes this data under its own privacy policy.
- Infrastructure and tooling providers acting on our instructions, such as our website host and CDN (Cloudflare), our email provider, and our cloud infrastructure provider.
- Professional advisers and authorities, where required by law.
8. International transfers
GUPF Digital is established in the United States and several of our providers are located there. Where personal data originating in the European Economic Area, the United Kingdom or Switzerland is transferred outside those territories, the transfer relies on the European Commission's Standard Contractual Clauses or on another transfer mechanism permitted under applicable law, together with appropriate supplementary measures.
9. Retention
- Server logs: retained by our hosting provider for a short technical period, typically no longer than 30 days.
- Enquiries and business correspondence: retained for the duration of the relationship and up to 3 years afterwards.
- Leads: retained only for as long as needed to transmit them to the client and to resolve any dispute about delivery, after which the client's own retention policy applies. Copies held by us are deleted at the end of the engagement or on the client's documented instruction.
- Advertising account and performance data: retained for the duration of the engagement, and afterwards only in aggregated form that no longer identifies individuals.
- Accounting records: retained for the period required by applicable tax and commercial law.
10. Your rights
Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent at any time without affecting the lawfulness of processing carried out beforehand.
If you are a California resident, you may also have the right to know what categories of personal information we have collected, to request deletion or correction, and to opt out of the sharing of personal information for cross-context behavioural advertising. We will not discriminate against you for exercising any of these rights.
To exercise any right, contact us at hello@gupfdigital.com. Where we act as a processor on behalf of a client (which is the case for leads generated by advertising campaigns), we will forward your request to that client without undue delay, as they are the controller of that data. You also have the right to lodge a complaint with your local data protection supervisory authority.
11. Security
We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls and least-privilege credentials for the platform APIs we use, secret storage outside of source control, and prompt revocation of access when an engagement ends. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
12. Cookies
This website does not set cookies for analytics, advertising or profiling purposes. Landing pages we operate for clients may use cookies or similar technologies for measurement and attribution; where that is the case, the relevant consent notice is presented on the landing page itself.
13. Children
Our services are directed at businesses and are not intended for children. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
14. Changes to this policy
We may update this policy to reflect changes in our practices or in applicable law. The date at the top of this page indicates when it was last revised. Material changes will be highlighted on this page.
15. Contact
Questions about this policy or about how we handle personal data can be sent to hello@gupfdigital.com, or by post to the address in section 1.