This policy explains how Amplio Growth Ltd. handles personal data on amplio.example, in our client portal and in the marketing work we run for clients. It applies to visitors, prospects, clients, candidates and anyone who contacts us.
1. Who we are
Amplio Growth Ltd. is a digital marketing agency registered in California, with offices at 548 Market Street, San Francisco, CA 94104 and at Rua da Prata 18, 1100-052 Lisbon, Portugal. For the data described in this policy we act as the data controller, which means we decide why and how it is used. Our data protection lead can be reached at privacy@amplio.example or by post at the San Francisco address, marked "Privacy".
When we run campaigns, analytics or email programmes inside a client's own accounts, that client is the controller and we act as their processor. Section 11 covers that situation.
2. Data we collect
We only collect what we need to answer you, run a project or improve the site. In practice that falls into five groups.
- Data you give us. Your name, work email, phone number, company, role, budget range and whatever you write in a brief, an audit request, a webinar sign-up, a job application or a message to support.
- Account data. If you use the client portal: your login email, a hashed password, two-factor settings, the client accounts you may view, and a log of sign-ins with time, browser and approximate location.
- Billing data. Company name, billing address, tax number, purchase orders and invoice history. Card details are handled by our payment provider and never reach our servers.
- Usage data. Pages you open, referring site, search Terms & Conditions used on our site, device type, browser, language, approximate city and the time of your visit, collected through cookies and server logs.
- Marketing data. Whether you opened a newsletter, which links you clicked, which webinars you attended and which resources you downloaded.
We do not ask for special category data such as health, religion or political opinions, and we ask you not to include it in briefs or messages.
3. How we use your data
Under the GDPR and the UK GDPR we must have a lawful basis for every use. Ours are these.
- To answer you and prepare a proposal, including an audit or a strategy call. Basis: steps taken at your request before a contract.
- To deliver the services in our contract, run the portal, send reports and raise invoices. Basis: performance of a contract.
- To keep records, prevent fraud and defend legal claims, and to meet tax and accounting rules. Basis: legal obligation and our legitimate interests.
- To measure and improve the site, test pages and understand which channels bring the right enquiries. Basis: consent for non-essential cookies, legitimate interests for aggregated server logs.
- To send marketing emails about our articles, webinars and services. Basis: consent, or legitimate interests where you are an existing client. Every email has a one-click unsubscribe link.
- To hire. We use application data to assess candidates and, with your permission, keep it on file for twelve months for future roles. Basis: steps before a contract and consent.
We do not sell personal data, and we do not use automated decision making that produces legal effects for you.
4. Cookies and similar tools
On your first visit a banner lets you accept or refuse everything that is not strictly necessary. You can change your mind at any time through the cookie link in the footer.
- Strictly necessary. Session, security, load balancing, your cookie choice and your light or dark mode preference. These cannot be switched off.
- Analytics. First-party analytics with IP truncation, which tells us how many people read an article and where they came from.
- Advertising. Pixels from Google Ads, Meta, LinkedIn and TikTok that measure whether an ad led to an enquiry and allow us to show follow-up ads. These load only after you accept.
Most cookies we set expire within 13 months. Blocking advertising cookies does not change what you see on this site, only which ads you may see elsewhere.
5. Who we share data with
We share personal data only with suppliers who help us run the business, and only with a written data processing agreement in place. The categories are hosting and content delivery, email delivery and newsletter tools, customer relationship management, analytics, advertising platforms, video conferencing, accounting and invoicing, and recruitment software. A current list of named sub-processors is available on request at privacy@amplio.example.
We also share data when the law requires it, when we need to defend a legal claim, or if the business is sold or merged, in which case we tell you before your data moves to a new controller.
6. International transfers
Our main systems are hosted in the European Union and in the United States. When personal data leaves the European Economic Area or the United Kingdom, we rely on the European Commission's standard contractual clauses together with the UK addendum, or on an adequacy decision where one exists. We review each transfer for the risk it carries and apply encryption in transit and at rest. You can ask us for a copy of the safeguards used for a specific supplier.
7. How long we keep data
- Enquiries that do not become projects: 24 months from the last message.
- Client contracts, reports and correspondence: for the length of the contract and 7 years afterwards, to meet tax and audit rules.
- Invoices and accounting records: 7 years.
- Newsletter subscribers: until you unsubscribe, then a suppression record so we do not email you again by mistake.
- Job applications: 6 months, or 12 months if you agree to stay on file.
- Server and security logs: 12 months.
When a period ends we delete the data or anonymise it so it can no longer be linked to you.
8. Your rights in the EU and UK
You can ask us to give you a copy of your data, correct it, delete it, limit how we use it, or send it to another provider in a portable format. You can object to processing based on legitimate interests, and you can withdraw consent at any time without affecting what we did before. You will never be charged for making a request, and we will not treat you differently for making one.
Write to privacy@amplio.example with enough detail for us to find your record. We reply within 30 days and may ask you to confirm your identity first. If you are not satisfied, you may complain to your local supervisory authority, to the Comissão Nacional de Proteção de Dados in Portugal, or to the Information Commissioner's Office in the United Kingdom.
9. Your rights in California
If you live in California, the CCPA as amended by the CPRA gives you the right to know which categories of personal information we collected in the last 12 months, the sources, the purpose and the categories of third parties we disclosed it to. You may request a copy, ask us to correct or delete it, and limit the use of sensitive personal information. We do not collect sensitive personal information for the purposes that trigger that limit.
We do not sell personal information for money. Sharing data with advertising platforms for cross-context behavioural advertising may count as "sharing" under California law, so our cookie banner and the "Do not sell or share my personal information" control in the footer let you opt out. We honour Global Privacy Control signals sent by your browser. You may use an authorised agent to make a request, and we will ask for written proof of their authority.
10. Security
Access to client data follows the least privilege rule and is reviewed every quarter. Accounts in the portal and in our internal tools require two-factor authentication. Data is encrypted in transit with TLS 1.3 and at rest with AES-256. We run automated backups with a 30-day window, test restores twice a year, and train every employee on phishing and data handling when they join and once a year after that. If a breach ever affects your data, we notify the relevant authority within 72 hours and tell you directly when the law requires it.
11. Data we handle for clients
Marketing work often means touching data that belongs to our clients: audience lists, CRM exports, conversion events and analytics accounts. In that work the client is the controller and we are the processor. We act only on documented instructions, keep the data inside the client's own platforms wherever possible, delete or return it at the end of the contract, and never use it to market our own services. Our data processing agreement, including the sub-processor list and the security annexe, is available to every client before onboarding.
12. Changes and contact
We review this policy once a year and whenever we add a tool that changes how data is used. The date at the top always shows the current version. If a change affects you materially we email everyone with an active account at least 14 days before it takes effect, and we keep previous versions on file for anyone who asks.
Questions, requests and complaints all go to the same place: privacy@amplio.example. A human reads every message.