Privacy Policy

3. The personal data we collect

3.1 Data you give us

• Identity and contact details: name, job title, company, email address, phone number and postal address.
• Enquiry and booking details: the content of your message, the meeting type, date and time you book, your time zone, and any notes you add when booking.
• Commercial details: information about your business, marketing budgets, platforms, audiences and goals that you share when requesting a proposal or during discovery calls.
• Marketing preferences: whether you have subscribed to our emails and how you interact with them (opens, clicks, unsubscribes).
• Recruitment details: your CV, cover letter, portfolio, work history, references and right-to-work information if you apply for a role.
• Correspondence: emails, messages, and recordings or transcripts of calls and video meetings where we have told you that we are recording (see section 4).

3.2 Data we collect automatically

• Technical data: IP address, browser type and version, device type, operating system, screen size, language settings and referring website.
• Usage data: pages viewed, time on page, clicks, scrolling, forms started or submitted, downloads, and approximate location (country or city level) derived from your IP address.
• Cookie and tracking data: as described in our Cookie Policy. Non-essential cookies and tracking technologies are only used with your consent.

3.3 Data we receive from other sources

• Public business sources: your company website, LinkedIn profile, Companies House or equivalent business registers, and industry publications, when we research prospective clients or check a supplier.
• Referrals and introductions: from clients, partners, networks and events.
• Advertising and social platforms (Meta, Google, LinkedIn, TikTok): aggregated campaign and audience statistics and, if you engage with our pages, posts or ads, the interaction data those platforms make available to page and account owners.
• Meta Platform data: as described in section 6.

We do not intentionally collect special category data (for example information about health, religion, ethnicity or political opinions) through the Site, and we ask you not to include it in enquiries or applications.

4. How we use your data and our legal bases

Under the UK GDPR and the EU GDPR we must have a legal basis for every use of personal data. The purposes and bases we rely on are:

Responding to enquiries and bookings

To answer your questions, hold the call or meeting you booked, send you a proposal and follow up. Legal basis: taking steps at your request before entering
into a contract, and our legitimate interest in responding to people who contact us.

Delivering our services to clients

To onboard clients, manage the relationship, deliver the work, report on results, invoice and collect payment, and keep the records the law requires. Legal basis: performance of a contract; compliance with legal obligations (accounting, tax and anti-fraud rules); and our legitimate interest in running our business.

Business-to-business marketing and prospecting

To contact people at businesses we believe could benefit from our services, to send case studies, proposals and updates, and to keep our prospect records accurate Legal basis: our legitimate interest in promoting our services to businesses. For marketing emails we rely on your consent or, where permitted, the rules for corporate subscribers and existing customers under the UK Privacy and Electronic Communications Regulations (PECR) and the Spanish Ley de Servicios de la Sociedad de la Información (LSSI). You can opt out at any time using the link in every email or by contacting us.

Newsletters and subscriptions

To send you the emails you have signed up for. Legal basis: consent, which you can withdraw at any time.

Site analytics and improvement

To understand how the Site is used, fix errors, test pages and improve content. Legal basis: consent for analytics cookies and similar technologies; our legitimate interest in aggregated, non-identifying statistics and in keeping the Site secure.

Advertising and remarketing

To show our advertising on Meta, Google, LinkedIn and similar platforms to people who have visited the Site, to measure the results of our campaigns and to build lookalike audiences. Legal basis: consent, given through the cookie banner. We do not load advertising tags or pixels until you consent to marketing cookies.

Recording and transcribing meetings

We may record video calls and use a meeting assistant (currently tl;dv) to produce notes, action points and summaries for our team. Legal basis: our legitimate interest in keeping accurate records of discussions. We tell you at the start of the call, and you can ask us not to record.

Recruitment

To assess applications, arrange interviews, check references and eligibility, and make offers. Legal basis: taking steps before entering into a contract; compliance with legal obligations (right-to-work checks); and our legitimate interest in hiring the right people.

Security, records and legal claims

To protect the Site and our systems, detect fraud and abuse, keep audit records, and establish, exercise or defend legal claims. Legal basis: our legitimate interests and compliance with legal obligations.

Complying with the law

To respond to lawful requests from courts, regulators and authorities. Legal basis: compliance with legal obligations.

Where we rely on legitimate interests we have balanced those interests against your rights and freedoms. You can ask us for details of that assessment and you can object to processing based on legitimate interests (see section 10).

5. Cookies and similar technologies

The Site uses cookies and similar technologies. Strictly necessary cookies are set without consent because the Site cannot work without them. Analytics, functional and marketing cookies are only set after you accept them in the cookie banner, and you can change or withdraw your choice at any time through the "Cookie settings" link in the footer of every page. Our Cookie Policy lists each cookie we use, who sets it, what it is for and how long it lasts.

Our Google and Meta tags are configured so that no analytics or advertising cookies are set unless you have consented to the relevant category.

6. Meta Platform data (Facebook and Instagram)

We are a Meta Business Partner. We use Meta's platforms and developer tools in two ways:

• Advertising for clients. We manage Meta ad accounts, Pages, pixels and datasets on behalf of clients through Meta Business Manager and the Marketing API. We do this under Meta's terms and under our agreement with each client. The data remains in the client's Meta assets and in our reporting systems.
• Our own tools. Our internal operations platform connects to Meta's APIs to (a) read ad account spend and performance data for reporting and billing, and (b) plan and publish organic content to Facebook Pages and Instagram professional accounts that we or our clients own and administer, with an internal approval step before anything is published.

Through these connections we receive ad account and campaign metrics, spend figures, Page and post metrics, engagement on our own posts, and account identifiers. We use this data only to deliver and report on our services and to publish approved content. We do not sell Meta data, do not use it to build profiles of individual users, and do not share it with anyone other than the client to whom it relates and the service providers listed in section 7. Access tokens are stored encrypted and are scoped to the assets we administer. Media files are copied only transiently at publish time and deleted after publishing. Reporting data is kept in line with section 9.

Deleting data received through Meta. If you have interacted with our app or with a Page we administer and want the data we hold about you removed, email hello@invincible-digital.com with "Meta data deletion" in the subject line and the name of the Facebook or Instagram account concerned. We will confirm the deletion, or explain why we must keep any of it, within 30 days.

7. Who we share your data with

• Our team. Staff and contractors of Invincible Digital UK and Invincible Digital Spain, on a need-to-know basis and under confidentiality obligations.
• Service providers acting as our processors. Cloud hosting and application platforms (including Replit and Google Cloud); Google Workspace for email, calendar, documents and video meetings; Slack; our operations and client platform; meeting recording and transcription (tl;dv); electronic signature tools (our own signing tool and DocuSign); payment providers (Stripe and GoCardless); accounting software (QuickBooks); email delivery services; analytics and tag management tools; AI-assisted tools we use to draft, tag and organise our work (including Anthropic and Google Gemini); and our professional advisers, including accountants, our Spanish gestoría, lawyers and insurers.
• Advertising and social platforms. Meta, Google, LinkedIn and similar platforms receive data through their cookies and tags when you consent to marketing or analytics cookies. They use that data as independent controllers under their own privacy policies.
• Clients. If you contact us on behalf of a client, or a client introduces you to us, we may share relevant details with that client.
• Authorities and successors. Courts, regulators and law enforcement where the law requires it, and any buyer or successor of our business in the event of a sale, merger or restructuring.

We do not sell personal data.

8. International transfers

We operate from the United Kingdom and Spain and transfer data between the two under the UK adequacy regulations for the EEA and the European Commission's adequacy decision for the United Kingdom. Some of our service providers are located in the United States or elsewhere. Where we transfer personal data outside the UK or the EEA we rely on one or more of: an adequacy decision (including the EU-US Data Privacy Framework and its UK Extension for certified providers); the European Commission's Standard Contractual Clauses; the UK International Data Transfer Agreement or Addendum; and supplementary technical and organisational measures where needed. You can request a copy of the relevant safeguards by contacting us.

9. How long we keep your data

• Enquiries and prospect records: up to 24 months after our last meaningful contact if no client relationship follows.
• Client and supplier records: for the duration of the relationship and then for six years, or for the longer period required by UK or Spanish accounting, tax and commercial law.
• Marketing subscriptions: until you unsubscribe, after which we keep a minimal suppression record so that we do not contact you again.
• Meeting recordings and transcripts: for as long as they are useful to the engagement they relate to, and then deleted in line with our retention schedule.
• Cookie consent records: for as long as needed to demonstrate that consent was given, and no longer than three years.
• Recruitment records: six months after the vacancy closes, unless you agree to stay in our talent pool for longer or we hire you.
• Security and access logs: twelve months.

We may keep data for longer where it is needed to establish, exercise or defend legal claims, or where the law requires it. When data is no longer needed we delete or anonymise it.

10. Your rights

Under the UK GDPR, the EU GDPR and the Spanish Ley Orgánica 3/2018 (LOPDGDD) you have the right to:

• access the personal data we hold about you and receive a copy;
• rectify data that is inaccurate or incomplete;
• erase your data in certain circumstances;
• restrict how we use your data in certain circumstances;
• data portability, meaning to receive data you gave us in a structured, machine-readable format;
• object to processing based on our legitimate interests, and to object to direct marketing at any time;
• withdraw consent at any time where we rely on consent, without affecting the lawfulness of processing before withdrawal; and
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make such decisions.

To exercise any of these rights, email hello@invincible-digital.com. We may ask you to confirm your identity. We will respond within one month, which we may extend by two further months for complex requests, in which case we will tell you. There is no fee unless a request is manifestly unfounded or excessive.

If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office in the UK (ico.org.uk, helpline 0303 123 1113), to the Agencia Española de Protección de Datos in Spain (aepd.es, C/ Jorge Juan 6, 28001 Madrid), or to the supervisory authority in the country where you live or work. We would appreciate the chance to resolve your concern first.

11. How we protect your data

We use appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS) and at rest for sensitive credentials, access controls based on least privilege, invitation-only accounts with passkey or single sign-on authentication on our platforms, audit logging, regular backups, staff confidentiality obligations and due diligence on our service providers. No method of transmission or storage is completely secure, and we will notify you and the relevant authority of any personal data breach where the law requires it.

12. Children

The Site and our services are intended for businesses and business users. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Automated decision-making and AI-assisted tools

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We do use AI-assisted tools to help us draft documents, summarise meetings, tag and organise files and analyse campaign performance. These tools operate under human supervision, and the providers act as our processors under contracts that prohibit them from using your data for their own purposes.

14. Third-party links and embedded content

The Site may contain links to other websites and embedded content such as videos, maps and social media posts. Those websites and services have their own privacy policies and we are not responsible for them. Embedded content that sets cookies is only loaded after you consent to the relevant cookie category.

15. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last changed. If we make material changes we will highlight them on the Site and, where appropriate, tell subscribers and clients by email.

16. Contact us

Email: hello@invincible-digital.com

Phone: +44 20 8163 5091

Invincible Digital Ltd, 20 Wenlock Road, London N1 7GU, United Kingdom

Invincible Digital Spain, S.L., Plaza del Campillo 1, Oficina 7, 18009 Granada, Spain