Privacy policy

Who we are

This site is run by All Good Marketing Ltd (trading as Itinex), company number 15863529, VAT 477890037, registered at 86-90 Paul Street, London, England, United Kingdom, EC2A 4NE. We're the data controller for everything on this page. Questions, access requests, or want something deleted — email hello@itinexads.com.

What we collect, and why

The chat widget. If you use the chat, we collect what you tell it — typically your name, email, what you're working on, and a rough budget or timeline. If you ask us to call you, we take a phone number for exactly that. None of this is asked for up front — it's gathered naturally in conversation, and you can simply not answer.

Voice notes. If you record one, the audio is sent to a transcription service (see the table below), turned into text, and then discarded. We never store the recording itself — only the transcript, which is then treated exactly like a typed message.

Booking a call. If you book a video call through the site, we collect your name, email, and what you'd like to discuss, so we can send a calendar invite and prepare properly.

Requesting access. If you request access to the client portal, we collect your name, work email, company, website and what you tell us about what you sell and where, so we can check it doesn’t overlap with a client we already run and reply to you.

During the video call itself. The call runs on Daily.co. We do not record calls — no audio, no video, nothing kept. The one thing that is stored is the call's text chat: if you or we type a message in the sidebar during the call, that message is saved against the booking so we don't lose a link or a detail shared mid-conversation.

Cookies and similar technology. Covered in full, and kept separately up to date, on our cookie policy — including the two analytics tools we run (only with your consent) and the handful of strictly necessary cookies the site needs to function.

Private pages we make for you. If we’ve sent you a link to a page made for your organisation, or made one when you asked for access, our server records that it was opened, when, and which copy of the link was used, so we know it reached you and can time our follow-up. Nothing about your device or where you are, and nothing is stored on your device. Detail is on the cookie policy too.

Our lawful basis

For the chat, a booked call and a request for access, we rely on our legitimate interests in answering organisations that ask about our services, and in arranging the call or the access they asked for. We think that is fair because you start it, it is about your organisation’s marketing, and you can stop it at any time: tell the chat, or email us, and we delete the conversation that day. Until 13 October 2026 this page said the chat ran on your consent and calls on a contract; we changed both, because a conversation already sent cannot be withdrawn by not typing, and any contract that follows is with your organisation, not with you. A chat from before that date is deleted the day you ask, as it always was.

The record that a private page we made for you was opened, and business contact details where we approached an organisation first, also rest on legitimate interests; the second has its own section below. A client portal account, its sign-in history and its activity log rest on our legitimate interests in providing the service your organisation agreed with us, keeping accounts secure and keeping a record of who agreed to what. Statistics and marketing cookies run only on your consent. Where our tag or a page we host collects data for an organisation, that organisation decides why and on what basis, and we act on its instructions; both are described below.

If we contacted you about your organisation

Everything above describes information you gave us yourself. This part is different. If we approached you about your organisation’s marketing, we held your details before you had heard of us, and you are entitled to know exactly what and from where.

What we hold: your name, job title, work email address or phone number, and the organisation you work for. Business contact details, in your professional capacity, and nothing about you outside your job.

Where we got it: your organisation’s own website, public professional profiles, and — where the organisation is publicly funded — its published records: procurement notices, committee papers, budgets and annual reports. We do not buy contact lists, and we never collect personal data about consumers for this.

Why we’re allowed to: our legitimate interests in contacting organisations that buy the kind of marketing we do. We think that is fair here because the details are professional rather than private, the subject is directly relevant to the job you hold, the approach is individual rather than bulk, and stopping it takes one line of reply. If that balance ever fails for you, your objection settles it, not ours.

If we made you a page: we record when it is opened, as described above, and nothing about your device.

How long: 24 months from the last time we contacted you, and sooner if you ask. Unlike the automatic deletions in the table below, this one is a review rather than a scheduled job — so if you want it gone today, tell us and it is gone today.

Saying no: reply and say stop, or email hello@itinexads.com. You have an absolute right to object to direct marketing — there is no balancing test on our side once you have said so, and we do not ask why. All the other rights below apply to you in full.

If you have a client portal account

People at the organisations we work for sign in to our client portal. If you have an account, this is what we hold about you.

Your account: your name, work email, the organisation you belong to and your role in it (owner, editor, viewer or billing). Your password is held by our sign-in provider as a one-way code; nobody here can read it.

Signing in: the time of each sign-in, with the IP address and browser it came from, so you and we can spot one that wasn’t you. If you turn on two-factor sign-in, its secret is held by our sign-in provider, never shown to us.

What you do in the portal: who made, changed, paused or approved what, and when, from which IP address. Your organisation can read this log; it is how a team sees its own history.

When you agree to something: approving an order or a quote records your typed name, the time, your IP address and browser; accepting our client terms records the version, your name and email, the time, your IP address and browser. That is the record of the agreement.

What you send us: messages, the pictures and videos you upload for campaigns, and for billing, a contact’s name and email with the organisation’s address and VAT number.

If you visited a page with our tag

Some organisations we work for put our measuring tag on their own website, or use a landing page we build and host for them (its address starts with itinexads.com/l/). For that data we work on the organisation’s behalf: it decides why the data is collected and we act only on its instructions. Its privacy policy is the first place to look, and you can always ask us too.

What the tag collects: the page you viewed and the page that sent you there; which campaign, website and ad brought you, read from the link you clicked; whether you were on a computer or a phone; and what the organisation reports happening next: an inquiry, a booking and its value, or a call. If you click a link to another website, the tag sends that website’s address and nothing else about the link; we keep it only when it is one of the partners the organisation has listed, such as a member hotel, to count the referral, and drop it otherwise.

What it doesn’t: it sets no cookie, and we never store your IP address, name or email from it. To count you once a day without knowing who you are, our server turns your IP address and browser into a one-way code that changes every day.

In your browser: nothing, unless you agree. On an organisation’s own site, if you say yes to its cookie or consent question, the tag keeps the details of the ad you clicked (nothing about you) in your browser for 30 days, so a booking made on a later visit is credited to that ad. Without your yes it keeps nothing and counts the visit from the link alone. On the pages we host, nothing is kept in your browser, with one exception: if you start one of our forms, the answers you tap and the step you reached are kept in that browser tab (its session storage, not a cookie), so reloading the page doesn’t lose them. Nothing you type is kept there. They go when you send the form, when you close the tab, or after an hour, whichever comes first.

A form on a page we host: if you fill it in, what you type (your name, email, phone number, message, and your address if you ask for a brochure by post) and your choices about emails are sent straight to the organisation, by email to the addresses it names or into its own systems. We don’t keep what you typed. We keep a record that a request was sent: its reference number, the page and version you saw, the ad network’s reference for the click that brought you and the site the ad was on (so the request can be credited to that ad), the day’s one-way visit code described above, any answers you picked from a list (such as when you would like to travel; never anything you typed), your choices about emails, and whether it reached the organisation.

Two things we keep for a day at most: if the organisation’s system can’t take your request at once, we hold it sealed (encrypted, and never shown to anyone) and keep trying for up to 24 hours, then delete it. And so that a request sent twice isn’t counted twice, we keep a one-way code made from your email address or phone number, for that one form, for 24 hours; it can’t be turned back into the address or number.

Steps on a page we host: we note that you saw the page, whether you reached the form, started it, tapped to call or message, or clicked through to the organisation’s own site or one of its partners, once a day, counted the same way as a visit and without knowing who you are. Nothing is kept in your browser for it.

How a page we host is read: which parts of the page were on your screen and for about how long, whether you tapped them, how far down you read and how long the main picture took to load, sent as you read and when you leave. It tells the organisation which parts of its page work. Counted the same way as a visit, without knowing who you are; it is held only in the open page while you read, and nothing is kept in your browser for it.

Two versions of a page: an organisation can test two versions of a page against each other. Which one you see is decided from the same daily count, so you see the same version all day, and we note which one it was with your steps and with any request you send. Nothing is kept in your browser for it.

Whether a request led to a booking: the organisation you sent a request to can note in its portal whether it became a booking, and what it was worth, so it can see which of its pages and ads bring real customers. That note is kept with the record of your request, for the same period.

Lists of past customers: an organisation can give us a list of its customers, either so its ads are not shown to them or so they are. Each email address is turned into a one-way code in the organisation’s own browser before anything reaches us: we never receive the addresses. The codes go to Taboola, the ad network, which uses them as a separate controller under its own terms, to find those people there for the use the organisation chose. Telling its customers about that is the organisation’s responsibility, as it is for everything it collects itself. Adding new lists is paused while we settle how the ad network may use them; no list has ever been sent.

The organisation’s own advertising pixels. Some organisations ask us to put their own Meta, Google Ads, LinkedIn or TikTok pixel on a page we host for them, so they can show you ads about it later. In the UK, the EU and Switzerland the page asks you first and loads nothing until you say yes; elsewhere it tells you at the foot of the page, lets you turn the pixels off, and treats a browser’s Global Privacy Control signal as no.

• Who is responsible: we and the organisation named on the page are joint controllers for collecting these details and sending them to the platforms. We run the consent request; the organisation is responsible for how its pixels’ data is used afterwards and handles requests about that. You can contact either of us and we’ll pass it on.
• Lawful basis: your consent (UK, EU, Switzerland).
• What is sent and to whom: details of your visit (the page, your device and browser, your IP address) go to the platforms configured on the page (Meta, Google, LinkedIn, TikTok), which may also use them for their own purposes.
• International transfers: to the US under the UK–US data bridge / EU–US Data Privacy Framework (Meta, Google, LinkedIn) and, for TikTok, to other countries under contractual safeguards.
• What we keep: your answer, in your browser for 180 days so you aren’t asked twice (we ask again if the pixels change), and counts of how many people were asked, said yes, and had the pixels loaded, never who. We keep the counts under our legitimate interest in running the page.
• Your choices: change your answer at the foot of the page at any time. This stops the pixels from then on but can’t recall data already sent; for that, contact the organisation or the platform.

Three things we don’t do

Nothing here is decided by a machine. The chat is answered by an AI, and it drafts a summary of your enquiry for us to read — but no decision that affects you is made automatically. A person reads every conversation, and any decision about whether and how we work together is made by a person, in a conversation with you. You are not profiled and nothing is scored.

None of it is compulsory. You are not required by law or by contract to give us anything on this site. If you would rather not use the chat, or would rather not answer one of its questions, nothing happens except that we know less about what you need — email hello@itinexads.com instead and you will get the same answer from the same people.

And this site is not for children. It is a business service aimed at people buying marketing for an organisation. We don’t knowingly collect anything from under-18s; if you think a child has sent us something, tell us and we will delete it.

Who we share it with

We use a small number of processors to run the chat and booking system. A processor acts only on our instructions — none of the companies in this table are permitted to use your data for their own purposes.

Taboola is not our processor. It is the ad network our campaigns run on. It receives campaign settings and, for a list of past customers, the one-way codes described above (never names or addresses), and it acts as a separate controller under its own terms. We don’t sell or share your data with anyone for advertising, and never have.

When your data leaves the UK

Some of the companies we use are based outside the UK, or reach our data from outside it. UK law allows that in two ways, and the table says which one applies to each. An approved destination: the UK has approved the EU and the rest of the EEA, Canada and Israel, among others, and, for the United States, only companies signed up to the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge; you can check any US company at dataprivacyframework.gov). The UK Addendum: where no approval applies, the company is bound by the UK’s International Data Transfer Addendum to the EU standard contractual clauses, and we weigh the risks of the transfer before relying on it.

For a copy of the transfer terms in any of these contracts, email hello@itinexads.com and we will send it within a month. The template UK Addendum is published by the UK’s Information Commission at ico.org.uk.

Analytics — and one company that isn't our processor

If — and only if — you allow statistics cookies, we run two analytics tools. Neither runs at all until you say yes, and you can change that decision at any time on our cookie policy page.

Google Analytics tells us how many people visit and which pages they read. Google acts as our processor for this, under Google's own data processing terms.

Microsoft Clarity shows us how pages are actually used — where people scroll, click and get stuck — including replays of anonymous sessions. We want to be straight about this one, because it works differently from everything else on this page: Microsoft is not our processor. For Clarity, Microsoft is an independent data controller in its own right — it does not act on our instructions, and it may use what it collects under its own privacy statement, not ours. We have deliberately excluded the chat from Clarity entirely: the conversation panel is masked in the page's own code, so nothing you type or send in the chat is captured in a session replay.

How long we keep it

Every “automatically deleted” above is enforced — a scheduled job runs every day and deletes what has passed its date, so none of it depends on anyone remembering. When an organisation stops working with us, its accounts, report links and hosted pages are closed the same day, and what it asks us to return or delete is returned or deleted. You don't have to wait for those dates either: ask us to delete yours and we'll do it that day.

If any of this ever relates to an actual financial transaction or tax record, UK statutory minimums (typically 6 years) override the periods above for that specific record.

Keeping it secure

Data in transit is encrypted (HTTPS throughout). Access to stored data is restricted to our own team via a password-protected admin area; we don't hand out credentials or share access with anyone outside All Good Marketing Ltd. In the client portal, anyone can turn on two-factor sign-in, and it is required before anyone adds people to a team, changes who receives invoices, or approves an order or a quote. Our nightly backup is encrypted before it leaves us.

Your rights

You can ask us to show you what we hold about you, correct it, or delete it, at any time — email hello@itinexads.com and we'll action it directly; there's no form to fill in.

You have the same right to ask us to restrict how we use your data rather than delete it, to object to us using it at all, and to be sent a portable copy of what you gave us in a common file format. Where we rely on your consent (statistics and marketing cookies) you can withdraw it whenever you like, on our cookie policy page, and withdrawing it doesn’t undo anything that was lawful before you did. Every one of these goes to the same address, and none of them costs you anything.

Complaints to us. If you’re unhappy with how we’ve handled your data, tell us first: email hello@itinexads.com with “Complaint” in the subject. We will acknowledge it within 30 days, look into it, and tell you what we found and what we did.

You can also complain to the UK’s Information Commission (the ICO) at ico.org.uk/make-a-complaint. If you're contacting us from outside the UK, your own country's data protection authority will generally offer an equivalent right, alongside the same rights above, which we honour regardless of where you're writing from.

Changes to this policy

If we change what we collect or why, we'll update this page and change the date at the top. We won't backdate a change to cover something we already did. For the terms that apply to using this site more generally, see our terms of use.

Questions? hello@itinexads.com