Privacy notice

1. Who is responsible

THEFOCUS LTD is the controller of the personal data described in this notice. Our company registration details are on the Legal notice page. We are based in the United Kingdom and follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), each as amended by the Data (Use and Access) Act 2025. Our data protection regulator is the Information Commission, which still operates as the ICO.

When we process personal data inside a client workspace or in a client's advertising, analytics or CRM systems on that client's instructions, the client is the controller and we act as its processor. The client's own privacy notice applies to that data.

You can reach our data protection team through the contact form by choosing "Privacy request". We do not publish an email address or phone number; if you cannot use the form, you can write to our registered office.

2. What we collect

• Contact and qualification data you submit: name, work email, company, website, role, country, industry, objective, budget range, markets, current channels and your message.
• Build Your Plan answers: business, goal, economics and stack information, linked to an anonymous session until you choose to contact us or create an account.
• Account data: name, work email, role, authentication records, multi-factor enrolment status (never the secret in readable form) and sign-in history.
• Billing data: company name, billing address, tax ID and payment processor customer and invoice references. Card details go directly to our payment processor and never reach our systems.
• Service data authorised by clients: plans, approvals, tasks, reports, aggregated advertising metrics and CRM outcome stages.
• Technical data: security logs with pseudonymised IP addresses, device and browser type, and analytics only if you allow it, as described in our Cookie notice.
• Supplier data: contact details of people at our suppliers and partners.
• Business contact details of companies we approach: company name, website, the business email address the company publishes on its own website, and the public facts we used to decide to write to it, such as its entry in a company register or its public advertising.

3. Where it comes from

Most data comes from you. Some comes from your employer when it sets up your user account, from advertising platforms and analytics tools that a client connects, from our payment processor, and from public business sources such as company registers and company websites when we prepare a meeting or check a business.

4. Purposes, lawful bases and retention

• Answering enquiries and preparing plans and quotes. Lawful basis: steps you ask for before a contract, and our legitimate interest in replying to business enquiries. Kept for 24 months after the last contact if no contract follows.
• Providing the contracted service, support, reporting and billing. Lawful basis: performance of a contract with you or your employer, and our legitimate interest in running the service for business clients. Kept for the contract and 6 years afterwards.
• Keeping the Site and accounts secure, preventing fraud and misuse, and keeping audit logs. Lawful basis: legitimate interests, and recognised legitimate interests under Annex 1 UK GDPR where we must detect or prevent crime. Kept for 24 months.
• Accounting, tax and company records. Lawful basis: legal obligation. Kept for 6 years after the end of the financial year they relate to.
• Writing to businesses that may benefit from our service, using a business email address the company publishes on its own website. Lawful basis: legitimate interests. We only write to company addresses in countries where the law allows this without prior consent, send at most three messages, and stop as soon as you reply, object or unsubscribe. Kept for 12 months after the last message, then deleted; if you object, we keep only the address on a suppression list so that we never write to it again.
• Sending product updates and insights to business contacts. Lawful basis: legitimate interests, or consent where PECR requires it. Kept until you unsubscribe or object; every message has an unsubscribe link.
• Website analytics. Lawful basis: consent through our cookie banner. Analytics data is kept no longer than 14 months.
• Handling complaints, legal claims and regulator requests. Lawful basis: legitimate interests and legal obligation. Kept for 6 years after the matter closes.

5. Who we share it with

We share personal data with the service providers described on our Subprocessors page (for example cloud hosting, payment processing and email), with professional advisers such as lawyers and accountants, with a buyer or investor if our business is sold or financed (under confidentiality), and with courts, regulators and authorities where the law requires.

We do not sell personal data. We do not share personal data with advertising platforms for audience building or retargeting, and this Site loads no advertising pixels.

6. International transfers

Our service runs on a distributed, encrypted infrastructure that delivers the Site from locations in more than 125 countries. Personal data is stored mainly in the United States and the European Economic Area. When personal data leaves the UK, we use one of these safeguards:

• UK adequacy regulations, which cover the EEA, Switzerland and other countries the UK has approved.
• The UK Extension to the EU-US Data Privacy Framework, where a US recipient is certified.
• The ICO International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment showing that protection is not materially lower than in the UK.

7. Your rights

You can ask for access to your personal data, ask us to correct or delete it, ask us to restrict processing, object to processing based on legitimate interests (including direct marketing, which we will always stop), and ask for a portable copy of data you gave us. Where we rely on consent you can withdraw it at any time. Use the contact form and choose "Privacy request".

We reply within one month. For complex or numerous requests we can extend this by up to two further months and will tell you why. We may need to confirm your identity first; the time limit starts when we have what we need. Our search for your data will be reasonable and proportionate, as the law allows.

8. Complaints about your data

You have the right to complain to us. Use the contact form and choose "Privacy request" or "Complaint". We acknowledge data protection complaints within 30 days (in practice within 2 UK business days), investigate without undue delay, keep you informed and tell you the outcome, as section 164A of the Data Protection Act 2018 requires.

You can also complain to the Information Commission (ICO) at ico.org.uk at any time, and you may go to court.

9. Automated decisions

Build Your Plan ranks advertising channels for a business using documented rules and research. Its output is a recommendation for a business to review. It does not make decisions about individuals that have legal or similarly significant effects, and it does not use special category data.

10. Security

We protect personal data with mandatory multi-factor authentication, isolation between client workspaces, encryption in transit and at rest, least-privilege staff access and audit logging. The Security statement describes our controls.

11. Children

The Site is for businesses and is not directed at children. We do not knowingly collect data from anyone under 18.

12. European Economic Area and Switzerland

If you are in the EEA, the EU General Data Protection Regulation may apply to our processing of your data; if you are in Switzerland, the Federal Act on Data Protection (FADP) may apply. You have the same rights as set out above and can complain to the data protection authority where you live or work. Personal data sent from the EEA to the UK is covered by the European Commission's adequacy decision for the United Kingdom, renewed in December 2025, and transfers from Switzerland are covered by Switzerland's recognition of the UK. We have no establishment in the EU or Switzerland; you can exercise your rights directly with us through the contact form.

13. United States

State privacy laws such as the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and the laws of Colorado, Connecticut, Virginia, Texas, Oregon and other states, apply to businesses that meet their thresholds. Whether or not they apply to us, we follow these commitments for US residents:

• In the last 12 months we collected identifiers, professional or employment information, commercial information and internet activity, for the purposes in section 4.
• We do not sell personal information and do not share it for cross-context behavioural advertising. We do not use sensitive personal information to infer characteristics about you.
• You can ask to know, access, correct or delete your personal information and to opt out of sale, sharing or targeted advertising. An authorised agent may make a request for you with your signed permission.
• If we refuse a request you can appeal through the contact form; if you remain unhappy after the appeal you can contact your state attorney general.
• We will not discriminate against you for using these rights.

14. Canada

Where the Personal Information Protection and Electronic Documents Act (PIPEDA) or Quebec's Act respecting the protection of personal information in the private sector applies, we process personal information with your knowledge and consent, which may be implied for business contact information used for business communication. Your information may be stored and processed outside Canada and Quebec, where it may be accessible to authorities under local law. You can contact our privacy officer through the contact form and complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

15. Australia and New Zealand

We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 and the information privacy principles of New Zealand's Privacy Act 2020. Your information may be disclosed to recipients in the UK, the United States and the EEA under the safeguards in section 6. If you are not satisfied with our reply to a complaint, you can contact the Office of the Australian Information Commissioner or the New Zealand Privacy Commissioner.

16. Brazil

Where the Lei Geral de Proteção de Dados (LGPD) applies, we rely on the corresponding legal bases in Article 7: performance of a contract and preliminary procedures, legitimate interests, compliance with a legal obligation and consent. You have the rights in Article 18, including confirmation of processing, access, correction, anonymisation, portability, deletion and information about sharing. Our data protection officer (encarregado) can be reached through the contact form by choosing "Privacy request". You can complain to the Autoridade Nacional de Proteção de Dados (ANPD).

17. Türkiye

Where the Law on the Protection of Personal Data No. 6698 (KVKK) applies, we process your data on the grounds in Article 5, mainly the establishment or performance of a contract, legal obligation and legitimate interests, and on explicit consent only where the law requires it. Transfers abroad rely on the safeguards in Article 9, including standard contracts notified to the Personal Data Protection Authority where required. You can use the rights in Article 11 by applying through the contact form; we reply free of charge within 30 days. You can complain to the Personal Data Protection Board (KVKK).

18. Mainland China and Hong Kong

If you are in mainland China and the Personal Information Protection Law (PIPL) applies, we process your personal information to conclude or perform a contract with you or your employer, or with your consent. Your information is processed outside mainland China by us and the recipients in section 5; where PIPL requires separate consent for a cross-border transfer or a disclosure to another processor, we ask for it before the transfer. You have the rights in Chapter IV of PIPL, including access, copying, correction, deletion and explanation of our processing rules.

In Hong Kong we follow the data protection principles of the Personal Data (Privacy) Ordinance. You can ask to access and correct your data and complain to the Privacy Commissioner for Personal Data.

19. Japan

Where the Act on the Protection of Personal Information (APPI) applies, we use personal information only for the purposes in section 4. Japan's Personal Information Protection Commission recognises the United Kingdom as having an equivalent standard of protection. Recipients in other countries are bound by contract to equivalent measures. You can ask us to disclose, correct, stop using or delete your retained personal data through the contact form.

20. South Korea

Where the Personal Information Protection Act (PIPA) applies, we process only the items in section 2 for the purposes and retention periods in section 4. Personal information is transferred to and stored in the UK, the United States and the EEA through our network when you submit it, for the purposes in section 4 and until the retention periods end; the recipients are described on our Subprocessors page. You can refuse the transfer by not submitting data, but we then cannot reply to you or provide the service. You can ask for access, correction, deletion or suspension of processing, and complain to the Personal Information Protection Commission.

21. Saudi Arabia and the United Arab Emirates

Where Saudi Arabia's Personal Data Protection Law or the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data applies, we process your data for the purposes in section 4 and transfer it outside the country only where those laws and their regulations allow, using the safeguards in section 6. You can ask for information about our processing, access, correction and deletion, and complain to the Saudi Data and AI Authority (SDAIA) or the UAE Data Office.

22. Singapore and the Philippines

We follow Singapore's Personal Data Protection Act 2012 and the Philippines' Data Privacy Act of 2012. We collect, use and disclose personal data with your consent or as those laws otherwise permit, and protect data transferred overseas to a comparable standard. Our data protection officer can be reached through the contact form. You can complain to Singapore's Personal Data Protection Commission or the Philippines' National Privacy Commission.

23. Israel

Where the Protection of Privacy Law, 5741-1981, as amended, applies, you are not under a legal duty to give us personal data; we need the data in section 2 to reply to you and to provide the service. You can ask to inspect and correct information about you through the contact form, and complain to the Privacy Protection Authority.

24. Mexico and other markets

In Mexico we follow the Federal Law on the Protection of Personal Data Held by Private Parties and you may exercise your ARCO rights (access, rectification, cancellation and opposition) through the contact form. In every other market we serve, you can use the rights described in section 7 and complain to your local data protection authority.

25. Changes to this notice

We update this notice when our processing or the law changes. The "last updated" date shows the current version. We tell client users about material changes in the application.