Privacy Policy

Privacy Policy

Effective Date: 4 August 2026
Version 1.3

Document Version History

1. About Us & Data Controller

This Privacy Policy is issued by:

SUPERBONBON LTD
Registered Office:
71-75 Shelton Street
Covent Garden
London, WC2H 9JQ
United Kingdom

Email: hello@superbonbon.com
Website: www.superbonbon.com

Superbonbon Ltd is the data controller for personal data collected through this website and in the course of providing our services. We are registered with the Information Commissioner's Office (ICO). Our ICO registration number is: ZC212960. You can verify our registration by searching the ICO Data Protection Register at ico.org.uk/about-the-ico/what-we-do/register-of-fee-payers/.

We are a London-based digital marketing agency specialising in PPC, SEO, Amazon Advertising, and Technical Implementation.

Privacy Officer / Data Protection Contact

While we are not required to appoint a formal Data Protection Officer (DPO), we have designated a Privacy Officer as the first point of contact for all data protection matters. For all privacy-related enquiries, requests, and complaints, please contact our Privacy Officer directly at privacy@superbonbon.com.

2. Scope of This Policy

This Privacy Policy explains how we collect, use, store, share, and protect personal data when you visit our website, enquire about our services, or engage us as a client or supplier. It applies to all personal data we process as a data controller.

This policy complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

3. Personal Data We Collect

3.1 Data You Provide Directly

We may collect the following personal data that you provide to us:

• Full name and job title
• Business and personal email address
• Telephone number
• Billing and correspondence address
• Details of your enquiry or project brief
• Contractual and financial information (for clients and suppliers)

3.2 Data We Collect Automatically

When you visit our website, we may automatically collect:

• IP address and approximate geographic location
• Browser type and version
• Device type and operating system
• Pages visited, time spent, and referring URL
• Cookie identifiers (see Section 5 for full details)

3.3 Data We Receive from Third Parties

We may receive personal data from:

• Third-party platforms such as LinkedIn or Google, where you engage with our advertising
• Analytics providers who help us understand website usage
• Referral partners or introducers

3.4 Special Category Data

We do not intentionally collect or process any special category personal data as defined under Article 9 UK GDPR (which includes data relating to health, racial or ethnic origin, religious beliefs, biometric data, sexual orientation, political opinions, or trade union membership). If you inadvertently provide us with such data, we will delete it as soon as we become aware of it. Please do not send us special category data unless we have specifically requested it and established a lawful basis for processing it.

4. How We Use Your Data & Our Lawful Basis

Under UK GDPR Article 6, we must have a lawful basis for processing your personal data. The table below sets out our processing activities and the lawful basis for each.

Legitimate Interests: Where we rely on legitimate interests as our lawful basis, we have conducted a Legitimate Interests Assessment (LIA) to balance our interests against yours. We have concluded that our processing does not override your rights and freedoms. A summary of our LIA is available on request by contacting hello@superbonbon.com. You have the right to object to processing carried out on this basis at any time (see Section 10).

5. Cookies & Tracking Technologies

We use cookies and similar tracking technologies on our website. Cookies are small text files placed on your device. We use the following categories:

Strictly Necessary Cookies — Required for the website to function. These cannot be disabled.

• Session cookies to maintain your browsing session

Analytics / Performance Cookies — Help us understand how visitors use our website (e.g. Google Analytics). These are only set with your consent.

• _ga, _gid, _gat (Google Analytics) — expire after 2 years / 24 hours / 1 minute respectively

Marketing / Targeting Cookies — Used to serve relevant advertising and track campaign performance. These are only set with your consent.

• Third-party advertising pixels (e.g. Google Ads, Meta Pixel) where active

You can manage your cookie preferences via our cookie banner when you first visit the site, or by adjusting your browser settings. Note that disabling certain cookies may affect website functionality.

For full details, including a complete list of cookies and their expiry periods, see our Cookie Policy at www.superbonbon.com/cookie-policy.

6. Sharing Your Personal Data

We may share your personal data with the following categories of recipients:

Service Providers (Data Processors): Third parties that process data on our behalf, including:

• Website hosting and infrastructure providers
• Analytics platforms (e.g. Google Analytics)
• Email and CRM software providers
• Accounting and invoicing software
• Project management tools

All processors are bound by data processing agreements and may only process your data on our documented instructions.

Legal & Regulatory Authorities: Where required to do so by law, court order, or regulatory obligation.

Business Transfers: In the event of a merger, acquisition, or sale of all or part of our business, your data may be transferred to the successor entity, subject to equivalent privacy protections.

We do not sell your personal data to any third party, and we do not share it for third-party marketing purposes without your explicit consent.

7. International Data Transfers

Some of our service providers are based outside the United Kingdom. When we transfer personal data outside the UK, we ensure that appropriate safeguards are in place as required by UK GDPR Chapter V.

Transfers may occur to:

• The European Economic Area (EEA) — covered by the UK's adequacy regulations
• The United States and other third countries — protected by UK-approved Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA), as applicable

You may request a copy of the relevant safeguards by contacting us at hello@superbonbon.com.

8. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law. Our retention periods are as follows:

• Prospect / Enquiry Data: 2 years from the date of last contact, unless a contract is entered into
• Client / Contractual Data: 7 years from the end of the contractual relationship, in accordance with our legal and accounting obligations
• Supplier Data: 7 years from the end of the commercial relationship
• Website Analytics Data: 26 months (as configured in Google Analytics)
• Marketing / Consent Records: 3 years from the date consent was given or last exercised, or until consent is withdrawn
• Job Applications: 6 months from the conclusion of the recruitment process, unless you consent to longer retention

After the applicable retention period, data is securely deleted or anonymised.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include:

• Encrypted data transmission (HTTPS/TLS)
• Access controls and role-based permissions
• Regular security assessments of our systems and processors
• Staff training on data protection obligations

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify affected individuals without undue delay.

10. Your Rights Under UK GDPR

As a data subject, you have the following rights under UK GDPR. These rights are not absolute and may be subject to exemptions in certain circumstances.

Right of Access (Subject Access Request): You have the right to request a copy of the personal data we hold about you, along with information about how we process it.

Right to Rectification: You have the right to request that we correct inaccurate or incomplete personal data.

Right to Erasure ('Right to be Forgotten'): You have the right to request deletion of your personal data where there is no compelling reason for us to continue processing it.

Right to Restriction of Processing: You have the right to request that we restrict the processing of your personal data in certain circumstances (e.g. while accuracy is contested).

Right to Data Portability: Where processing is based on consent or contract and carried out by automated means, you have the right to receive the personal data that you have directly provided to us in a structured, commonly used, machine-readable format, and to transmit that data to another controller. This right does not extend to data that we have derived, inferred, or generated from your data.

Right to Object: You have the right to object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will stop processing immediately and without exception.

Rights Related to Automated Decision-Making & Profiling: You have the right not to be subject to a decision based solely on automated processing that produces significant legal or similarly significant effects on you. As a digital marketing agency, we may use tools that perform audience segmentation and profiling for advertising purposes (e.g. creating audience lists in Google Ads or Meta). These activities do not produce legal or similarly significant effects on you as an individual, and human oversight is maintained in all campaign decisions. You have the right to object to profiling for direct marketing purposes at any time.

Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact our Privacy Officer at:

• Email: privacy@superbonbon.com
• Post: Privacy Officer, Superbonbon Ltd, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ

We will respond to all legitimate requests within one calendar month. If your request is complex or you have made multiple requests, we may extend this by a further two months and will notify you accordingly.

We may need to verify your identity before processing your request. There is no charge for making a request, unless requests are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request.

11. Right to Lodge a Complaint with the ICO

If you are not satisfied with our response to any privacy concern, or if you believe we are processing your personal data in a manner that is inconsistent with UK GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:

Information Commissioner's Office

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline: 0303 123 1113

Website: ico.org.uk

We would, however, appreciate the opportunity to address your concerns before you contact the ICO, and encourage you to reach out to us in the first instance.

12. Third-Party Websites

Our website may contain links to third-party websites, plug-ins, and applications. Clicking on those links may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy practices. We encourage you to review the privacy policy of every website you visit.

13. Children's Privacy

Our services are directed exclusively at business clients and professionals. We do not knowingly collect or process personal data of anyone under the age of 18. If you believe we have inadvertently collected data from a minor, please contact us at hello@superbonbon.com and we will delete it promptly.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. The 'Effective Date' and version number at the top of this document will be updated whenever changes are made.

Material changes — where we make significant changes that affect how we use your personal data or your rights, we will notify you directly by email (where we hold your contact details) and/or by displaying a prominent notice on our website prior to the changes taking effect. We will not rely solely on website publication as notification of material changes.

Minor changes — for non-material updates (such as corrections or clarifications that do not affect your rights), we will update this policy and revise the version number. We encourage you to review this page periodically.

All previous versions of this policy are recorded in the Version History at the top of this document.

15. Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our data processing activities, please contact our Privacy Officer:

Privacy Officer
SUPERBONBON LTD
71-75 Shelton Street
Covent Garden
London, WC2H 9JQ
United Kingdom

Email: privacy@superbonbon.com (dedicated privacy & data protection enquiries)

General enquiries: hello@superbonbon.com