Google Ads Agency for UK E-commerce Brands

Privacy policy

Last updated: 13 July 2026

1. Who we are

Brass Tacks is a trading name of Colossal Search Ltd, a company registered in England and Wales (company number 08531647). Registered office: Quarry Hill House, School Street, Farsley, Pudsey, West Yorkshire, LS28 5EY.

For the personal data described in this policy, Colossal Search Ltd is the data controller. If you have any questions about this policy or your data, contact us at ads@colossalsearch.com.

We're a Google Ads agency for e-commerce businesses. We deal mainly with business data — ad accounts, product costs, order totals — but some of what we handle is personal data, and this policy explains how we look after it.

2. Who this policy covers

  • Website visitors — anyone browsing this site;
  • Enquirers — anyone who fills in our audit/contact form or emails us;
  • Audit participants — businesses that send us data for a free profit audit;
  • Clients and their staff — the people we work with at client businesses.m

One important distinction. When a client connects their store or order data to our platform, that data can include the client's own customers' details. For that data we are a processor acting on the client's instructions — the client remains the controller, and their privacy policy governs it. Section 10 explains what we do in that role.

3. What we collect

Data you give us:

  • Enquiry form: your name, email address, and monthly Google Ads spend.
  • Enquiries via our ads: if you respond to one of our ads on another platform — forexample a lead form on Facebook or Instagram — we receive the details youchoose to submit there (typically your name, email address and the answers you give). Meta's own privacy policy also applies to what happens on their platform.
  • Audit files: a Google Ads report export and a product cost spreadsheet. These are business data, but may incidentally contain personal data (for example astaff member's name in a file name or export field).
  • Correspondence: emails, call notes and anything you share with us while we work together.
  • Client engagement data: contact details of the people we work with at your business, billing details, and the access credentials or account links you authorise.

Data collected automatically:

  • Technical and usage data when you visit the site (IP address, browser type, pages viewed), via cookies and similar technologies — but only to the extent you allow. See our Cookie Policy

We do not knowingly collect data from children; our website and services are aimed at businesses.

4. How we use your data, and our lawful bases

What we do Data used Lawful basis (UK GDPR)
Respond to your enquiry and run your free profit audit Form data, audit files, correspondence Legitimate interests (responding to a business enquiry you initiated)
Deliver our management service, operate the platform, and manage the client relationship Engagement data, correspondence, connected account data Performance of a contract
Invoice you and keep accounting records Billing details Legal obligation
Send you relevant follow-ups and marketing about our services Name, email Legitimate interests (B2B marketing) — you can opt out at any time
Improve our services and platform Anonymised, aggregated data only Legitimate interests
Measure website performance and advertise our own services Usage data Consent (via the cookie banner)
Establish, exercise or defend legal claims Whatever is relevant Legitimate interests

We do not sell your personal data, and we don't use it for automated decision-making that produces legal or similarly significant effects about you.

5. Marketing

If you enquire with us, we may follow up by email about the audit and our services. Every marketing email includes an unsubscribe link, and you can opt out at any time by emailing ads@colossalsearch.com. Opting out doesn't affect emails we need to send to deliver a service you've asked for.

6. Who we share data with

We share personal data only with:

  • who host and run our business — website hosting (Webflow), email and document storage, our CRM, payment and invoicing providers, and the infrastructure behind our platform. They process data only on our instructions.Service providers who host and run our business — website hosting (Webflow), emailand document storage, our CRM, payment and invoicing providers, and theinfrastructure behind our platform. They process data only on our instructions.
  • Advertising platforms — Google and Meta (Facebook/Instagram). This happens in two ways: to manage your accounts at your request when you're a client, and —only with your cookie consent — to measure and improve our own advertising, as described inour Cookie Policy.
  • Professional advisers — accountants, lawyers and insurers, where necessary.
  • Authorities — if the law requires it.

7. International transfers

Some of our service providers (for example Webflow, Google and Meta) store data in the United States or elsewhere outside the UK. Where that happens, we rely on UK adequacy regulations (including the UK–US Data Bridge) or the UK International Data Transfer Agreement / Addendum to ensure your data gets equivalent protection.

8. How long we keep data

Data How long
Enquiry data where you don't become a client Up to 24 months from last contact, then deleted
Audit files where you don't become a client Deleted on request, and in any case within 12 months of the audit
Client contract, correspondence and platform data Duration of the engagement, then up to 6 years (limitation periods)
Accounting and tax records 6 years from the end of the financial year, as required by law
Marketing suppression list (so we don't email you again) Kept indefinitely — it's how we remember you opted out

9. Security

We protect personal data with appropriate technical and organisational measures — encrypted connections, access controls, reputable hosting providers, and limiting access to those who need it. No system is perfectly secure, but if a breach ever puts your rights at risk we will notify you and the ICO as the law requires.

10. When we act as a processor (your customers' data)

If you're a client and your connected order data includes your customers' personal data (names, order details and the like), we process it **only** to compute your profitability figures and deliver the service — never for our own purposes, never for marketing, and never shared with anyone beyond the hosting infrastructure the platform runs on. When the engagement ends we delete or return it, at your choice. The processor commitments we make to clients are set out in our Terms & Conditions.

11. Your rights

Under UK data protection law you have the right to:

  • Access the personal data we hold about you;
  • Correct it if it's wrong;
  • Delete it in certain circumstances;
  • Restrict or object to our processing (including objecting to marketing at anytime, which we will always honour);
  • Port data you gave us to another provider, in certain circumstances;and
  • Withdraw consent at any time, where consent is the basis we rely on.

To exercise any of these, email ads@colossalsearch.com. We'll respond within one month. We may need to verify your identity first.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ICO) — [ico.org.uk](https://ico.org.uk) or 0303 123 1113. We'd appreciate the chance to sort it out first.

12. Cookies

See our separate Cookie Policy for what cookies this site uses and how to control them.

13. Changes to this policy

We'll post any changes on this page and update the date at the top. If a change is significant and we hold your email address, we'll tell you directly.