Privacy Policy

1. Introduction and company information

This Privacy Policy explains how Northbridge Media Planning Ltd collects, uses, stores, shares and protects personal data when you visit our website, contact us, use our services, or otherwise interact with us. We are committed to handling personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR), and other applicable UK data protection laws.

Data controller: Northbridge Media Planning Ltd

Registered / business address: Northbridge Media Planning Ltd, 14 Finsbury Square, London EC2A 1AH, United Kingdom

Email: [email protected]

Phone: +44 20 7946 8372

Northbridge Media Planning Ltd is a media-planning business. In the course of providing media-planning, campaign strategy, audience analysis, reporting, and related services, we may process personal data relating to clients, prospective clients, suppliers, website users, and other individuals.

2. Data collection and processing

We may collect and process the following categories of personal data:

• Identity data: name, job title, employer, and professional contact details.
• Contact data: email address, telephone number, postal address, and communication preferences.
• Business and account data: company information, contractual details, billing information, service requirements, and correspondence.
• Technical data: IP address, browser type and version, device identifiers, operating system, time zone setting, and website usage data.
• Usage data: information about how you use our website, services, emails, and communications.
• Marketing and communications data: your preferences in receiving marketing from us and your communication preferences.
• Client campaign data: where relevant to our services, audience, campaign, and performance data provided by clients or generated in connection with media-planning activities.

We collect personal data directly from you, from your employer or organisation, from publicly available sources, from our website and analytics tools, and from third parties such as service providers, business partners, and advertising or media platforms where lawful and appropriate.

We do not intentionally collect special category data unless it is necessary, lawful, and separately justified. We ask that you do not send us sensitive personal data unless we specifically request it.

3. Purpose of data processing

We process personal data for the following purposes:

• to provide and manage our media-planning and related professional services;
• to communicate with clients, prospects, suppliers, and website users;
• to prepare proposals, quotations, contracts, and invoices;
• to manage client accounts and business relationships;
• to analyse campaign performance, audience insights, and service effectiveness;
• to operate, maintain, secure, and improve our website and internal systems;
• to send service-related notices and administrative communications;
• to send marketing communications where permitted by law and where you have not opted out;
• to comply with legal and regulatory obligations;
• to establish, exercise, or defend legal claims;
• to prevent fraud, misuse, and security incidents;
• to manage recruitment and supplier relationships where applicable.

4. Legal basis for processing

We only process personal data where we have a lawful basis under UK data protection law. Depending on the context, our legal bases may include:

• Performance of a contract: where processing is necessary to enter into or perform a contract with you or your organisation.
• Legitimate interests: where processing is necessary for our legitimate business interests, such as delivering and improving our services, managing client relationships, securing our systems, and promoting our business, provided those interests are not overridden by your rights and freedoms.
• Consent: where you have given clear consent, for example for certain marketing communications or optional cookies where required.
• Legal obligation: where processing is necessary to comply with applicable law, regulation, court order, or regulatory requirement.
• Vital interests: in rare cases where processing is necessary to protect someone’s life.
• Public task: generally not applicable to our business, but included where relevant under law.

Where we rely on legitimate interests, we assess the impact of the processing on your rights and freedoms and take steps to ensure appropriate safeguards are in place.

5. Data sharing and third parties

We may share personal data with trusted third parties where necessary for the purposes described in this Privacy Policy. These may include:

• IT, hosting, cloud storage, and cybersecurity providers;
• email, communications, and collaboration tool providers;
• analytics, website performance, and cookie management providers;
• professional advisers such as lawyers, accountants, auditors, and insurers;
• payment processors and invoicing providers;
• media, advertising, research, and platform partners where required for campaign delivery or reporting;
• regulators, law enforcement, courts, and other authorities where legally required;
• business partners, subcontractors, and suppliers who assist us in delivering our services.

We require third parties to process personal data only in accordance with our instructions, applicable law, and appropriate confidentiality and security obligations. Where a third party acts as an independent controller, their own privacy notice may also apply.

6. Data transfer to third countries

Some of our service providers or business partners may be located outside the United Kingdom. Where personal data is transferred outside the UK, we take appropriate steps to ensure that it is protected in accordance with UK data protection law.

Such safeguards may include:

• the UK International Data Transfer Agreement (IDTA);
• the UK Addendum to the European Commission Standard Contractual Clauses;
• an adequacy regulation or other lawful transfer mechanism;
• additional technical and organisational safeguards where appropriate.

If you would like more information about international transfers and the safeguards we use, please contact us using the details below.

7. Storage duration

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying legal, accounting, reporting, and contractual requirements.

In determining retention periods, we consider:

• the nature and sensitivity of the data;
• the purpose for which it was collected;
• legal and regulatory retention requirements;
• the risk of harm from unauthorised use or disclosure;
• whether we may need the data for legal claims or dispute resolution.

When personal data is no longer required, we will securely delete, anonymise, or archive it in accordance with our retention procedures and applicable law.

8. User rights

Under UK data protection law, you may have the following rights in relation to your personal data:

• Right of access: to request confirmation of whether we process your personal data and to obtain a copy of that data.
• Right to rectification: to request correction of inaccurate or incomplete personal data.
• Right to erasure: to request deletion of your personal data in certain circumstances.
• Right to restriction: to request that we limit the processing of your personal data in certain circumstances.
• Right to data portability: to receive certain personal data in a structured, commonly used, machine-readable format and to request transfer to another controller where technically feasible.
• Right to object: to object to processing based on our legitimate interests or for direct marketing purposes.

These rights are not absolute and may be subject to legal exceptions and limitations. If you wish to exercise any of these rights, please contact us using the details in Section 12.

9. Withdrawal of consent

Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.

You can withdraw consent by contacting us at [email protected] or by using any unsubscribe or preference-management option provided in our communications. If you withdraw consent, we may still be able to process your personal data where another lawful basis applies.

10. Right to complain

If you have concerns about how we handle your personal data, we encourage you to contact us first so that we can try to resolve the issue.

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner’s Office (ICO):

Website: https://ico.org.uk/

Telephone: 0303 123 1113

Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom

11. Data security

We take appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, alteration, disclosure, or destruction. These measures may include:

• access controls and role-based permissions;
• password protection and multi-factor authentication where appropriate;
• encryption and secure data transfer methods;
• regular backups and system monitoring;
• staff confidentiality obligations and data protection training;
• vendor due diligence and contractual safeguards;
• incident response and breach management procedures.

While we take reasonable steps to protect personal data, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security.

12. Contact information

If you have any questions about this Privacy Policy or how we process personal data, or if you wish to exercise your rights, please contact:

Northbridge Media Planning Ltd
14 Finsbury Square
London EC2A 1AH
United Kingdom

Email: [email protected]
Phone: +44 20 7946 8372

13. Changes to privacy policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. Any updated version will be posted on our website with a revised effective date where appropriate.

We encourage you to review this Privacy Policy periodically to stay informed about how we process personal data. Where required by law, we will notify you of material changes using reasonable means.