Data Processing & GDPR

1. Roles & Responsibilities

Depending on the engagement, Margin Media may act as:

• A data controller for information we collect directly through our own websites and services; and/or
• A data processor when we handle data for clients while building, running or optimizing their digital properties.

As a processor, we use personal data only on the client's (controller's) documented instructions, as set out in the relevant agreements or data processing terms.

2. Types of Data Processed

As controller or processor, we may process:

• Basic contact details, such as name and email address, sent through forms or direct communication.
• Usage and analytics data about website visits, content interactions and performance.
• Data supplied by creators or clients, such as transcripts, media files and content needed to build or run digital assets.

We do not intentionally collect sensitive categories of personal data unless a client explicitly requires it and we agree to it. In that case, additional protections may apply.

3. Legal Bases for Processing

Where GDPR applies, we usually rely on one or more of these legal bases:

• Contractual necessity: to meet our obligations under a contract or service agreement.
• Legitimate interests: to run, secure and improve our services in a way that does not override your rights and freedoms.
• Consent: where required for certain analytics, marketing or non-essential cookies. You can withdraw consent.
• Legal obligations: to comply with applicable laws or regulations.

4. Data Processing on Behalf of Clients

When we build or run creator or business properties, we process data only to deliver those services. In these cases:

• We follow the client's documented instructions.
• We apply appropriate technical and organizational measures to protect the data.
• We do not use client data for unrelated purposes such as independent marketing or resale.

Processor obligations, sub-processors and data locations will be set out in formal Data Processing Agreements (DPAs) or equivalent documents.

5. Data Storage & Security

Data may be stored with trusted hosting providers and cloud services, possibly in more than one region, depending on client needs and our infrastructure. We use reasonable safeguards to protect data against unauthorized access, alteration or loss.

No system can be guaranteed fully secure. We encourage clients and users to follow strong security practices too.

6. International Transfers

When data is transferred outside the European Economic Area (EEA), we aim to put appropriate safeguards in place, such as standard contractual clauses or equivalent mechanisms, to protect personal data in line with GDPR.

7. Data Subject Rights (GDPR)

Where GDPR applies and Margin Media is the controller, you may have these rights over your personal data:

• Right of access to personal data we hold about you.
• Right to request correction or updates.
• Right to request deletion in certain circumstances.
• Right to restrict or object to certain types of processing.
• Right to data portability where applicable.

When we act only as processor, send requests to the relevant controller (our client). We will help them meet those requests as required.

8. Sub-Processors

We may use vetted third-party vendors (sub-processors) for hosting, analytics, error monitoring or other operational needs. They are contractually required to process data only as needed to provide their services and to keep appropriate security measures in place.

9. Relationship to Other Policies

Read this page together with our Privacy Policy and Cookie Policy, which give more detail on how we collect, use and store information.

10. Contact

Questions about data processing, GDPR or how this applies to your engagement? Use our contact form.