Privacy Notice
1. Introduction
This Privacy Notice explains how Adspur Ltd (“Adspur”, “we”, “us”, “our”) collects, uses, shares and protects personal information when you use our website at www.adspur.com and the Adspur platform (the “Service”).
Adspur is a privately-owned limited company registered in the United Kingdom. We are committed to processing personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and applicable data protection laws in other jurisdictions where our users are based.
By using the Service, you acknowledge that we will process your personal information as described in this notice.
If you have any questions or concerns about how we handle your personal information, please contact:
3. What personal information does Adspur collect?
We collect personal information from the following sources:
Information you provide directly:
- Account registration details: name, email address, job title, organisation name
- Billing and payment information (processed by Stripe — Adspur does not store card details)
- Award submission content: creative work, case studies, written descriptions, images, videos, PDF documents, and credits identifying creators and contributors
- Communications you send us via email or the contact form
Information collected automatically:
- Log data: IP address, browser type, device information, pages visited, referring URL
- Session data: login times, feature usage, actions performed within the platform
- Cookies and similar technologies (see Section 12)
Information from third parties:
- Payment status from our payment processor, Stripe (success or failure only)
4. How do we use personal information?
We use personal information for the following purposes:
Service delivery: To provide, maintain and improve the Adspur platform, including account management, calendar tools, awards tracking, and agency account features.
Award submission management: To store and manage creative work, case studies, supporting files, and associated creator credits that users submit in connection with award shows. This content is visible only to the submitting user and their team.
Authentication and security: To verify your identity, manage access to your account, and protect against unauthorised access, fraud and abuse.
Payment processing: To process subscription payments and manage billing through our payment processor, Stripe.
Communications: To send transactional emails related to your account, such as signup confirmation, password resets, and service notifications.
Analytics and improvement: To understand how the Service is used, identify trends, and improve functionality and user experience.
Legal and regulatory compliance: To comply with applicable laws, regulations, court orders and legal processes, and to enforce our terms of use.
Security and audit: To log user and admin actions for security monitoring, incident investigation, and compliance purposes.
5. Lawful basis for processing
Under the UK GDPR, we rely on the following lawful bases:
| Purpose | Lawful basis |
|---|
| Account management and service delivery | Performance of a contract (Article 6(1)(b)) |
| Award submission storage and management | Performance of a contract (Article 6(1)(b)) |
| Authentication and security | Performance of a contract (Article 6(1)(b)) |
| Payment processing | Performance of a contract (Article 6(1)(b)) |
| Transactional emails | Performance of a contract (Article 6(1)(b)) |
| Analytics (Umami) | Legitimate interests (Article 6(1)(f)) — understanding how the Service is used. No cookies are set and no personal data is collected. |
| Security monitoring and audit logging | Legitimate interests (Article 6(1)(f)) — security and fraud prevention |
| Legal and regulatory compliance | Legal obligation (Article 6(1)(c)) |
6. Who do we share information with?
We do not sell, rent or trade your personal information to third parties for their commercial purposes.
We may share personal information with:
- Service providers and processors who assist us in operating the platform (see Section 7)
- Professional advisors such as lawyers, accountants or auditors where necessary
- Law enforcement or regulatory bodies where we are required to do so by law or to protect our legal rights
- A purchaser or successor entity in the event of a merger, acquisition or sale of all or part of our business, in which case we will notify you of any changes to how your personal data is handled
Award submission content is visible only to the submitting user and their team. It is not shared publicly or with other users on the platform.
7. Third-party processors
We use the following third-party service providers who process personal data on our behalf:
| Processor | Purpose | Data processed | Location |
|---|
| Amazon Web Services (AWS) | Hosting, infrastructure, and file storage (S3) | All platform data including award submission files | EU (Ireland) / UK |
| Amazon Simple Email Service (SES) | Transactional email delivery | Names, email addresses, email content | EU (Ireland) / UK |
| Stripe | Payment processing | Billing name, email, payment card details | UK/EU (PCI DSS compliant) |
| Amazon DocumentDB (AWS) | Database services (audit logging) | User IDs, IP addresses, action logs | EU (Ireland) |
| imgix | Image and PDF processing and delivery | Images, PDF documents, access metadata | United States (EU-U.S. Data Privacy Framework) |
| Umami | Website analytics (cookieless) | Aggregated page views, referring site, country-level location. No cookies, no personal data. | EU |
We ensure that appropriate Data Processing Agreements (DPAs) are in place with all processors and that they provide adequate safeguards for personal data.
8. International data transfers
Adspur’s primary infrastructure is hosted within the EU (Ireland) and the UK.
Some personal data is transferred to processors located in the United States, specifically:
- imgix — for image and PDF processing, including award submission assets. imgix is certified under the EU-U.S. Data Privacy Framework and has Standard Contractual Clauses (SCCs) in place.
Where personal data is transferred outside the UK and EEA, we ensure appropriate safeguards are in place, including:
- EU-U.S. Data Privacy Framework certification
- UK International Data Transfer Agreements (IDTAs)
- EU Standard Contractual Clauses (SCCs)
- Adequacy decisions recognised by the UK or EU
For US-based users: We process your data in accordance with applicable US privacy laws. If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell personal information.
9. How long do we retain personal information?
We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law.
| Data category | Retention period |
|---|
| Account data | Duration of account plus 90 days after cancellation/deletion |
| Award submission content | Duration of account plus 90 days after cancellation/deletion. You may request extended retention before the 90-day period expires by contacting dataofficer@adspur.com |
| Payment and billing records | Minimum 6 years (tax and accounting obligations) |
| Audit logs | 1 year |
| Analytics data | 6 months (aggregated and non-personal) |
| Transactional email delivery logs | As per AWS SES default retention |
To close your account, email dataofficer@adspur.com. You will then have 90 days to export or request retention of your award submission content. After 90 days, account data and submission content will be deleted or anonymised unless you have requested otherwise.
When personal data is no longer required, we will securely delete or anonymise it.
10. Your privacy rights
Under the UK GDPR, you have the following rights regarding your personal information:
- Right of access — request a copy of the personal data we hold about you
- Right to rectification — request correction of inaccurate or incomplete data
- Right to erasure — request deletion of your personal data (subject to legal obligations)
- Right to restriction — request that we limit how we process your data
- Right to data portability — request your data in a structured, machine-readable format
- Right to object — object to processing based on legitimate interests
- Right to withdraw consent — where processing is based on your consent, you may withdraw it at any time
To close your account or request deletion of your data, email dataofficer@adspur.com. There is no self-service deletion option; we handle removal requests manually so that we can confirm your identity and check whether any content must be retained for legal reasons.
To exercise any of these rights, please contact dataofficer@adspur.com. We will respond within one month of receiving your request. If your request is complex or we receive a large number of requests, we may extend this by a further two months, and we will inform you if this is the case.
If you are not satisfied with our response, you have the right to lodge a complaint with:
11. How does Adspur ensure the security of personal information?
We implement appropriate technical and organisational measures to protect personal data, including:
- Encryption at rest and in transit (TLS/SSL)
- Role-based access controls
- Audit logging of system and user actions
- Regular security reviews
- Secure password storage (hashing)
You are responsible for keeping your login credentials confidential. Please notify us immediately at dataofficer@adspur.com if you believe your account has been compromised.
12. Cookies
Cookies are small files stored on your device when you visit our website.
We use one cookie, and only for essential purposes — session management and authentication, so that you stay logged in and pages are served securely. Essential cookies do not require consent.
We do not use analytics, advertising or tracking cookies. We measure how the Service is used with Umami, a privacy-focused analytics tool that does not set cookies, does not store or read anything on your device, and does not collect personal data. It records only aggregated information such as page views, referring site and country-level location. Because nothing is stored on your device and no personal data is collected, we do not need to ask for your consent, and you will not see a cookie banner.
Cookies used by adspur.com
| Name | Provider | Purpose | Expiry |
|---|
| Session cookie | Adspur | Session management and authentication | End of session |
You can manage cookies at any time by adjusting your browser settings. Blocking our session cookie will prevent you from logging in, as it is required to keep you signed in.
For more information about cookies, visit https://www.aboutcookies.org
13. Children’s privacy
The Adspur Service is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take steps to delete it promptly.
14. Changes to this notice
We may update this Privacy Notice from time to time. If we make material changes, we will notify you via the Service or by email. The date of the most recent update is shown at the top of this notice.
Your continued use of the Service after any changes constitutes acceptance of the updated Privacy Notice.
For any questions about this Privacy Notice or how we handle your personal information:
