CipherGold rated TikTok Shop Partner
Book a call
Legal

Privacy policy

Cipher Paid Media Ltd, trading as Cipher Agency.

Last updated: April 2026

NeverWe do not sell your personal data
UK & EUWhere personal data is primarily stored and processed
1 monthTo respond when you exercise your rights
72 hrsTo notify the ICO of a reportable breach
On this page

1Who we are

Cipher Paid Media Ltd, trading as Cipher Agency ("we", "us", "our"), is a company registered in England and Wales. We are committed to protecting your personal data and respecting your privacy.

This Privacy Policy explains how we collect, use, store, and protect personal data when you visit our website, engage us as a client, or otherwise interact with our services.

We are registered with the Information Commissioner's Office (ICO) and act as a data controller in respect of personal data we collect about visitors, clients, and prospects. Where we process personal data on behalf of our clients (for example, in connection with TikTok Shop performance analytics), we act as a data processor.

2How to contact us

For any questions about this policy, your personal data, or to exercise your rights:

Data Protection OfficerJesper Anker

3What personal data we collect

Depending on how you interact with us, we may collect the following categories of personal data:

When you visit our website:

  • Technical data such as IP address, browser type, device information, and pages visited
  • Cookie data (where you have consented — see Section 9)

When you contact us or enquire about our services:

  • Name and job title
  • Business email address and phone number
  • Company name
  • The content of your enquiry or correspondence

When you become a client:

  • Business contact details for you and members of your team
  • Billing and invoicing information
  • Records of communications and meetings
  • Any data you provide to us in connection with the services we deliver

When we deliver TikTok Shop performance analytics on behalf of clients:

  • Seller and merchant identifiers
  • Business contact details for sellers
  • Transaction and KPI data linked to seller accounts

We do not knowingly collect special category data (such as health or biometric data) or data relating to children.

4How we use your personal data

We process personal data for the following purposes and on the following lawful bases under UK GDPR:

PurposeLawful Basis
To respond to your enquiries and provide information you have requestedLegitimate interests; performance of a contract
To deliver our services to clientsPerformance of a contract
To send you service-related communications and updatesPerformance of a contract; legitimate interests
To send marketing communications (where you have consented or where permitted by law)Consent; legitimate interests
To improve our website and servicesLegitimate interests
To comply with legal, regulatory, and tax obligationsLegal obligation
To protect our rights, property, or safetyLegitimate interests

You can opt out of marketing communications at any time by clicking the unsubscribe link in any email or by contacting us.

5Who we share your personal data with

We do not sell your personal data. We share personal data only with trusted third parties who help us run our business or deliver our services. These currently include:

  • Google LLC (Google Workspace — email, document storage, productivity)
  • Microsoft Corporation (Microsoft 365 — email, productivity, endpoint security)
  • Asana, Inc. (project and task management)
  • Professional advisers such as accountants, auditors, and lawyers, where necessary
  • Regulators and law enforcement, where legally required

All third parties are required to respect the security of your personal data and to treat it in accordance with the law. We have written data processing agreements in place with our processors as required under UK GDPR Article 28.

6International transfers

Personal data is primarily stored and processed in the United Kingdom and the European Union. Where any of our service providers process data outside the UK, we rely on appropriate safeguards in accordance with UK GDPR Chapter V — including the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or an applicable adequacy decision.

7How long we keep your personal data

We retain personal data only for as long as necessary for the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements:

Website enquiry data:up to 24 months from your last contact with us
Client data:for the duration of the contract and up to 7 years afterwards (to meet legal and accounting obligations)
Marketing data:until you withdraw consent or unsubscribe
Data processed on behalf of clients:in accordance with the relevant client agreement; deleted or returned within 30 days of contract termination

8Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

Right of accessto request a copy of the personal data we hold about you
Right to rectificationto ask us to correct inaccurate or incomplete data
Right to erasureto ask us to delete your personal data ("right to be forgotten")
Right to restrictionto ask us to limit how we use your data
Right to data portabilityto receive your data in a structured, commonly used format
Right to objectto object to certain types of processing, including direct marketing
Right to withdraw consentwhere we rely on consent, you can withdraw it at any time
Right not to be subject to solely automated decision-makingthat produces legal or similarly significant effects

To exercise any of these rights, contact our DPO at jesper@cipheragency.co.uk. We will respond within one calendar month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at any time:

We would, however, appreciate the chance to address your concerns first, so please contact us before approaching the ICO.

9Cookies

Our website uses cookies and similar technologies to improve your browsing experience and analyse site usage. You can control cookies through your browser settings and through our cookie banner when you first visit our site.

We use the following categories of cookies:

  • Strictly necessary cookies — required for the site to function
  • Analytics cookies — help us understand how visitors use our site
  • Marketing cookies — used only with your consent

You can withdraw your cookie consent at any time by clearing your browser cookies and revisiting our site.

10How we protect your personal data

We have appropriate technical and organisational measures in place to protect personal data against unauthorised access, loss, alteration, or disclosure. These include:

  • Multi-factor authentication on all company accounts
  • Endpoint protection on all company devices
  • Full-disk encryption on all company laptops
  • Encryption of data in transit (TLS 1.2+) and at rest (AES-256 via our cloud providers)
  • Access controls based on the principle of least privilege
  • Regular staff security awareness training
  • A documented incident response plan and breach notification process

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify affected individuals without undue delay.

11Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates when it was last revised. We encourage you to review this policy periodically.

12Contact

If you have any questions or concerns about this Privacy Policy or our data practices, please contact:

Jesper Anker, Data Protection OfficerCipher Paid Media Ltd (t/a Cipher Agency)Email: jesper@cipheragency.co.uk

Our website address is: https://cipheragency.co.uk