Privacy Policy

Last updated: 2 November 2026. This update adds sections 8A and 8B on our advertising research, covers our study sign-up form and our newsletter, updates section 5 on cookies, and corrects details in sections 2, 3, 4, 7, 8.3, 8.5, 8.6, 8.7, 8.8, 8.9, 9 and 10.

1. OUR COMMITMENT

7 Pockets Ltd ("7P", "we", "us") is a digital marketing agency providing advertising management, campaign optimisation, and performance reporting services to business clients. We are committed to protecting the privacy and personal data of everyone who interacts with us.

This Privacy Policy explains how we collect, use, store, and protect personal data in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

If you have questions about this policy or how we handle personal data, contact us using the details in the Contact section below.

---

2. WHO WE ARE

7 Pockets Ltd is a company registered in England and Wales (Company Number: 14173279). We are registered with the Information Commissioner's Office (ICO) under the Data Protection Act 2018.

The Director of 7 Pockets Ltd is the designated individual responsible for data protection. We have not appointed a formal Data Protection Officer (DPO), because UK GDPR Article 37 does not require one for our activities.

Data protection contact: data@the7pockets.com

---

3. WHAT PERSONAL DATA WE COLLECT

The personal data we collect depends on how you interact with us:

Website Visitors:

- IP address

- Browser type, device type, operating system

- Pages visited, time on site, referring URL

- Whether you arrived from one of our ads on Meta, and whether you used a form on our website (only if you accept advertising cookies)

- Cookie data and your cookie choice (see Section 5)

Business Clients and Contacts:

- Name, email address, phone number

- Company name and role

- Communication history (emails, meeting notes)

- Billing and payment information

Study Sign-ups:

- First name, work email address, company and job title

- The industries you tick

- Whether you tick the box to hear from us, and when you signed up

You need to give these details to get the full study. Ticking the box is optional.

Newsletter Subscribers:

- Your email address, and your name if you give it, when you subscribe to our newsletter on Substack

Job Applicants and Contractors:

- Name, email address, phone number

- CV/resume and professional history

- Right to work documentation

We do not collect:

- Consumer personal data (e.g. email lists, customer databases) beyond transient handling as described in Section 8, except as sections 8A and 8B describe

- Special category data (Article 9) in the ordinary course of our business, except as sections 8A and 8B describe

- Children's data (our services are B2B and not directed at children), except that ads in the research in sections 8A and 8B can show children

---

4. HOW AND WHY WE USE YOUR DATA

We process personal data under the following lawful bases (UK GDPR Article 6):

For the performance of our contract with you (Article 6(1)(b)):

- Delivering advertising management and reporting services

- Managing client accounts and campaigns

- Processing invoices and payments

- Providing customer support

For our legitimate business interests (Article 6(1)(f)):

- Business development and relationship management

- Improving our website and services

- Internal administration and record-keeping

- Protecting against fraud and security threats

- Giving you a study you ask for through a form on our website, including one email with the link to it, and understanding which businesses and industries read our studies

- Considering applications for roles with us

Where you have given consent (Article 6(1)(a)):

- Sending marketing communications about our services

- Emailing you about a study you signed up for, and about talking through what it means for your brand, if you ticked the box to hear from us

- Sending you our newsletter, if you subscribe to it

- Using analytics and advertising cookies on our website, and measuring our ads on Meta (see Section 5)

You can withdraw consent at any time by contacting us, replying to any of our emails, or using the unsubscribe link in our emails.

For legal obligations (Article 6(1)(c)):

- Financial record-keeping (HMRC requirements)

- Responding to lawful requests from authorities

---

5. COOKIES

When you visit our website, we use cookies and similar technologies, such as tags and storage in your browser. Cookies the website needs to work are always on. We use analytics and advertising cookies only if you choose "Accept" in our cookie banner. You can change your choice at any time with "Cookie settings" at the foot of every page.

Essential Cookies (always on): Required for the website and its forms to work and stay secure. These cannot be disabled.

- crumb (Squarespace, our website host): protects our forms against misuse; deleted when you close your browser

- 7p_consent (kept in your browser by us): remembers whether you chose Accept or Decline, until you clear your browser's data for our site

- _GRECAPTCHA (Google reCAPTCHA, used by our forms): protects our forms from spam and abuse

Analytics Cookies (only if you accept): We use Google Analytics to understand how visitors use our website, so that we can improve it. The data passes through our own measurement server, at 7p.the7pockets.com, on its way to Google.

- _ga, _ga_79145V0813, FPLC and, where our measurement server sets it, FPID (Google Analytics): tell visits apart and remember a visit; kept for up to 2 years, and FPLC for 20 hours

Squarespace, our website host, also counts page visits for us without using cookies. We have switched its analytics cookies off.

Advertising Cookies (only if you accept): We use the Meta pixel to measure the ads we run on Meta's platforms, such as Facebook and Instagram, including whether people who saw an ad then visited our website or used one of our forms. Our measurement server may also send the same events to Meta directly.

- _fbp and _fbc (Meta): identify your browser to Meta, and record whether you arrived from a Meta ad

If you decline, these analytics and advertising tools do not run. If you change your choice to Decline, we also remove their cookies where our website can; any we cannot remove stop being used and expire.

Our newsletter is on Substack. Our website links to it, and Substack's own cookies and privacy policy apply once you are on its site.

You can also control cookies through your browser settings. Disabling essential cookies may affect website functionality.

---

6. WHO WE SHARE DATA WITH

We share personal data only where necessary and with appropriate safeguards:

- Cloud infrastructure providers: Google Workspace (email, file storage, collaboration, the spreadsheet our study sign-up form writes to, and the email with your study link) — governed by Google's Data Processing Amendment

- Analytics: Google Analytics, only if you accept analytics cookies, through our measurement server hosted by Stape, governed by Google Analytics Data Processing Terms

- Advertising measurement: Meta, only if you accept advertising cookies. Meta receives information from the Meta pixel on our website and from our measurement server. We decide to collect it and send it to Meta; what Meta does with it after that is covered by Meta's own privacy policy

- Form security: Google reCAPTCHA, which checks our forms for spam and abuse, under Google's terms

- Website and forms: Squarespace, which hosts our website and processes what you enter in our forms, in the United States, under its data processing terms and the UK Extension to the EU-U.S. Data Privacy Framework

- Newsletter: Substack, which runs our newsletter and handles sign-ups to it, in the United States, under the UK Extension to the EU-U.S. Data Privacy Framework. Substack also uses some of your details for its own purposes, as its privacy policy explains

- Advertising platforms: Meta, Google, TikTok, Snapchat — only in the context of managing client advertising campaigns, governed by each platform's terms

- Professional advisers: Accountants, legal counsel — where required for business operations

- Law enforcement or regulators: Where required by law or valid legal process

We do not sell, rent, or trade personal data to any third party. We do not share personal data with data brokers or unrelated third parties. The only advertising network we share data with for our own marketing is Meta, as described above and in Section 5, and only if you accept advertising cookies.

---

7. DATA RETENTION

We retain personal data only for as long as necessary:

- Client business contacts: Duration of engagement + 2 years

- Supplier and contractor contacts: Duration of engagement + 6 years (HMRC requirements)

- Financial records: 6 years from end of financial year (Companies Act 2006 and HMRC requirements)

- Website analytics data: Event data is deleted from Google Analytics after 2 months and user-level data after 14 months of inactivity, as set in our Google Analytics account; aggregated reports are kept

- Marketing consent records: Until consent is withdrawn + 1 year for compliance records

- Study sign-ups: 24 months from the date you sign up, then deleted

- Newsletter subscribers: Until you unsubscribe

- Prospective client contacts, and reads we have sent them: 24 months from sending, unless you become a client

- Job applicants: 6 months after the role closes, then deleted, unless you join us

When data is no longer required, it is securely deleted from all our systems.

---

8. ADVERTISING PLATFORM DATA PROCESSING (META MARKETING API)

8.1 Overview

7 Pockets Ltd uses the Meta Marketing API and other advertising platform APIs to access and manage advertising campaign data on behalf of our clients. This section explains how we handle data obtained through these platforms.

8.2 Data Controller and Processor Roles

- Data Controller: Our clients remain the data controller for their advertising account data. 7 Pockets Ltd acts as a data processor on their behalf, processing advertising data solely under their instruction and in accordance with a written data processing agreement.

- Data Controller (own accounts): Where we manage our own advertising accounts, 7 Pockets Ltd is the data controller.

- Data Controller (research): Sections 8A and 8B describe research where 7 Pockets Ltd is the data controller.

8.3 What Data We Access

Through advertising platform APIs, we access the following categories of data:

| Data Category | Examples | Contains Personal Data? |

|--------------|----------|----------------------|

| Campaign structure | Campaign names, ad set names, statuses, objectives | No |

| Budget and spend | Daily/lifetime budgets, amount spent, bid strategies | No |

| Performance metrics | Impressions, clicks, conversions, ROAS, CPM, CPC, CTR | No |

| Targeting parameters | Audience definitions, age ranges, geographic regions | Aggregated only |

| Ad creative | Ad copy, headlines, images, video and audio, and our analysis of them | Yes, where people appear |

| Account information | Ad account ID, account name, currency, timezone | No |

We do not access: individual user profiles, Custom Audience member lists, pixel-level user tracking data, or any data that identifies the people who see ads. Account records, such as change logs, can name the people who work on an account, and can include their work email.

8.4 Lawful Basis for Processing

We process advertising platform data under:

- Legitimate interests (Article 6(1)(f)): To provide advertising management and optimisation services

- Contractual necessity (Article 6(1)(b)): To fulfil our service agreements with clients

8.5 Purposes of Processing

We process advertising platform data solely for:

1. Campaign monitoring and reporting

2. Optimisation recommendations

3. Budget management and pacing

4. Configuration validation

5. Client communication and strategic recommendations

6. Our own research, as section 8B describes

We do not use advertising platform data for: building user profiles, selling data to third parties, targeting or profiling beyond stated functions, or training machine learning models on client data without explicit consent.

8.6 Data Storage and Security

- Storage location: Our advertising databases and creative file storage are in the United Kingdom and European Economic Area. Our source code and working files, which can include client material, are held in the United States with GitHub, and some working records with Notion. Other service providers, such as Google Workspace, can also process data outside the UK and EEA, including in the United States. Section 9 explains this.

- Encryption: In transit (TLS 1.2+) and at rest (AES-256)

- Access controls: Role-based access with multi-factor authentication

- API credentials: Stored securely using environment variables

- Logging: Access to advertising data is logged for audit purposes

8.7 Data Retention and Deletion

- Campaign performance data (aggregated, non-personal): Retained indefinitely for long-term trend analysis, benchmarking, and historical reporting. This data does not contain personal information about individual users.

Client account data: We keep data from our clients' advertising accounts as each client's agreement and each advertising platform's terms allow. Where they allow it, we combine results from several clients' accounts into statistics, use those statistics in our services and research, and may publish them. Published statistics identify no person and no client.

- Campaign configuration data: Retained for duration of engagement + 30 days, then securely deleted, unless we keep it for our own research as section 8B describes.

- Client offboarding: All advertising platform data deleted within 30 days of engagement end, unless the client requests export or provides written instruction to retain, or we keep it for our own research as section 8B describes.

- Meta-initiated deletion: Complied with without undue delay.

8.8 Data Sharing

We do not sell, rent, or trade advertising platform data. Data may be shared with:

- The client whose ad account the data relates to

- Sub-processors (cloud infrastructure, code hosting and workspace tools, including GitHub and Notion) solely for service delivery

- Where required by law or valid legal process

8.9 Audience Data Handling

Where clients provide audience data containing personal data (e.g. email lists for Custom Audiences):

- Files are received in password-protected format

- Uploaded to the advertising platform as soon as practicable

- Permanently deleted from all 7P systems immediately after upload

- Audience files do not persist on 7P infrastructure

---

8A. ADVERTISING RESEARCH USING META'S AD LIBRARY

This section explains how we use information from Meta's public Ad Library. For this research, 7 Pockets Ltd (company number 14173279, registered office 167-169 Great Portland Street, 5th Floor, London W1W 5PF) is the controller. You can contact us at data@the7pockets.com.

What we collect. We collect information about advertisements from the Meta Ad Library, a public archive Meta publishes of ads shown on Facebook, Instagram, Messenger, Threads and the Audience Network. We collect it through Meta's API and through a data collection service, and we collect commercial ads shown in the UK. For each ad we collect its text, the dates it ran, the platforms it appeared on, the reach and audience figures Meta publishes for it, and the name and ID of the Facebook page that ran it. We also collect the images and video in these ads and keep our own copy for research and analysis. These can show people who appear in the ads, such as models, presenters and customers, or include their voices. Our analysis describes what each ad shows, including the people in it: for example how many appear, the age range, gender and expression they appear to present, and the mix of people an ad shows. These are estimates about the ad, not facts about anyone.

Personal data in it. This information is almost entirely about businesses. It can include personal data about people who appear in ads, by their image or voice; where a page is run by an individual or a sole trader; where a page or business is named after a person; where an ad's text includes a person's name or contact details; and where Meta shows a person as having paid for or benefited from an ad.

Why we use it, and our lawful basis. We use it to research how businesses advertise, to publish studies of it (for example, how brands advertise around seasonal sales), to advise our clients and prospective clients on how brands in their market advertise, and to identify businesses, at company level, that may be interested in our services. Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)). Those interests are understanding the advertising market, advising clients and prospective clients, publishing research about it, and finding new clients. Our published studies name businesses and give aggregate figures. We do not publish any individual's contact details, and we do not use this data to contact individuals. We name a person only where they advertise under that name, as performers and some sole traders do, or where an ad we quote names them. Our studies may show a still from a business's ad, credited to it, where we comment on that ad. We do not use images or voices to identify who anyone is.

Who else handles it. Our cloud and data service providers, who store it for us in the UK and the European Union, and who also analyse it, including its video, with AI services in the European Union; the data collection service that collects ads from the Ad Library for us, which processes them outside the UK and EEA, including in the United States; and the AI service provider we use to read and describe the ads' text and images, which processes them in the United States. For that transfer we rely on the International Data Transfer Addendum to the European Commission's standard contractual clauses, issued by the Information Commissioner, which forms part of that provider's data processing terms. The data collection service is provided by a company in the European Union, which UK law treats as giving adequate protection, and its data processing terms require it to have a lawful transfer mechanism in place when it processes data in the United States. Clients and prospective clients who receive a read from us see what it reports, which can include a credited still from an ad. We do not sell this data or the images and video, and we do not share the dataset with anyone else.

How long we keep it. Meta removes an ad from its library a year after it last ran; we keep our own copy. We keep the text and details of ads for as long as they serve the purposes above, and we review what we hold at least every 24 months, deleting what we no longer need. We keep the images and video for no more than 3 years after the ad last ran, and review them every 12 months.

If you appear in an ad. If you appear in an ad and want our copy deleted, send the ad, or a link to it, to data@the7pockets.com. We will find our copy, delete it, and make sure we do not collect it again.

Your rights. You can ask us for a copy of any personal data we hold about you from this source, and ask us to correct it, delete it or restrict how we use it. You can complain to us at data@the7pockets.com, and you can complain to the Information Commissioner's Office (ico.org.uk).

Your right to object. You can object at any time to our use of your personal data for these purposes. If you do, we will stop unless we have compelling legitimate grounds that override your interests. We will always stop using it for marketing.

Why we have not told you directly. We did not collect this information from you. For most of the people it might concern, including people who appear in ads, we hold no name or contact details, and finding them would mean identifying them, which we do not do. Contacting each of them would take disproportionate effort, so we publish this notice instead (UK GDPR Article 14(5)(b)). We do not make automated decisions about anyone using this data.

---

8B. ANALYSIS OF ADVERTISING

This section explains how we analyse advertisements, including ads we ran for clients, to research what makes advertising work and to build and test our own analysis tools. For this work 7 Pockets Ltd (company number 14173279, registered office 167-169 Great Portland Street, 5th Floor, London W1W 5PF) is the controller. You can contact us at data@the7pockets.com.

What we use. The ads themselves (their images, video, sound and text), the results the advertising platforms report for them, and the account records the platforms return with them, such as page details and change logs.

Personal data in it. People appear in ads, and account records can name the people who worked on an account. Our analysis records what an ad shows: for example how many people appear, and the age range, gender and expression they appear to present. These are estimates about the ad, not facts about anyone. We do not use them to make decisions about anyone, and we do not publish anything that identifies a person.

Why we use it, and our lawful basis. Legitimate interests (UK GDPR Article 6(1)(f)): understanding how advertising works and developing our services. This work is internal, except that we may publish aggregated findings, which identify no person and no client. Ads we read from Meta's public Ad Library, including our clients' ads, fall under section 8A.

Who else handles it. Google Cloud, which stores it and runs part of the analysis for us in the European Union, and Anthropic, whose AI service runs part of the analysis in the United States. For that transfer we rely on the International Data Transfer Addendum to the European Commission's standard contractual clauses, issued by the Information Commissioner, which forms part of Anthropic's data processing terms. Anthropic may not use it to train its models. We do not sell it or share it with anyone else.

How long we keep it. For as long as it serves these purposes. We review what we hold at least every 24 months and delete what we no longer need.

Your rights. You can ask us for a copy of personal data we hold about you from this source, and ask us to correct it, delete it or restrict how we use it. You can complain to us at data@the7pockets.com, and you can complain to the Information Commissioner's Office (ico.org.uk).

Why we have not told you directly. We did not collect this information from you, and we hold no contact details for the people who appear in ads. Contacting each of them would take disproportionate effort, so we publish this notice instead (UK GDPR Article 14(5)(b)).

---

9. INTERNATIONAL DATA TRANSFERS

7 Pockets Ltd operates from the United Kingdom and processes data mainly within the UK and European Economic Area.

7P does not independently transfer personal data outside the UK/EEA, except as sections 6, 8.6, 8A and 8B describe. Where third-party platforms we use (Google, Meta, TikTok, Snapchat) transfer data internationally as part of their service delivery, this is governed by those platforms' own transfer mechanisms, including:

- UK International Data Transfer Agreements (IDTAs)

- Standard Contractual Clauses (SCCs) approved by the ICO

- Adequacy decisions where applicable

For the research in sections 8A and 8B, the AI service provider that reads ads' text and images processes them in the United States; for that transfer we rely on the International Data Transfer Addendum to the European Commission's standard contractual clauses, issued by the Information Commissioner. The data collection service for the research in section 8A is provided by a company in the European Union, which UK law treats as giving adequate protection; its data processing terms require it to have a lawful transfer mechanism in place when it processes data in the United States. Squarespace, which hosts our website and forms, and Substack, which runs our newsletter, process data in the United States under the UK Extension to the EU-U.S. Data Privacy Framework. Stape, Inc., a US company that hosts our measurement server in the European Union, can process data in the United States under the UK Extension to the EU-U.S. Data Privacy Framework. GitHub, which holds our source code and working files, and Notion, which holds some working records, process data in the United States under the same UK Extension.

We review the transfer mechanisms of our key service providers as part of our annual policy review.

---

10. YOUR RIGHTS

Under the UK GDPR, you have the following rights:

- Access (Article 15): Request a copy of the personal data we hold about you

- Rectification (Article 16): Request correction of inaccurate data

- Erasure (Article 17): Request deletion of your personal data

- Restriction (Article 18): Request that we limit processing of your data

- Data portability (Article 20): Request your data in a structured, machine-readable format

- Object (Article 21): Object to processing based on legitimate interests

- Automated decision-making (Articles 22A to 22D): We do not carry out automated decision-making with legal effects

To exercise any of these rights, contact: data@the7pockets.com

We will respond within one month of receipt. Identity verification may be required. We will not charge a fee unless the request is manifestly unfounded or excessive.

You have the right to complain to us about how we handle your personal data, at data@the7pockets.com. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay. You also have the right to complain to the Information Commissioner's Office (ICO) at https://ico.org.uk.

---

11. CHANGES TO THIS POLICY

We may update this Privacy Policy to reflect changes in our services, legal requirements, or data processing practices. Material changes will be noted at the top of this page with the updated date.

---

12. CONTACT US

7 Pockets Ltd

167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF

General enquiries: fraser@the7pockets.com

Data protection enquiries: data@the7pockets.com

You can also contact the Information Commissioner's Office (ICO) at https://ico.org.uk, although we encourage you to contact us first so we can try to resolve your concern.

---