Awakened Media.

Privacy policy

Last updated: 21 September 2026 Version 1.2

This policy explains what personal data Awakened Media collects when you use our advertising service, why we collect it, who we share it with, how long we keep it, and what rights you have. It applies to our website at awakenedmedia.net and to the service described in our terms and conditions. If we contacted you before you had given us anything, section 15 is the part written for you.

1. Who we are

  1. We are Shah Corporation Limited, a company registered in England and Wales (company number 08117456, registered office: Irish Square, Upper Denbigh Road, St Asaph, Denbighshire, LL17 0RN), trading as Awakened Media.
  2. We are the controller of the personal data described in this policy. That means we decide why and how it is processed.
  3. We are registered with the Information Commissioner's Office under registration number ZA932503.
  4. For anything to do with your data, contact us at hello@awakenedmedia.net, or through our contact form. We have not appointed a data protection officer, as we are not required to.
  5. Our customers are businesses. Much of what we handle is business information rather than personal data. Where information identifies a living person, for example a sole trader's name, a business owner's email address, or a face in a photograph on a website, it is personal data and this policy applies to it.

2. What we collect

  1. Information you give us. Your name, your email address, your business name, and your website address.
  2. Information from your website. When you give us your website address we read the public pages of that website. We take screenshots of them, and we copy the text, the images, the photographs and the logo we find there. Where those pages contain personal data, for example staff names, staff photographs, a business owner's contact details or customer testimonials, that personal data is collected too.
  3. Information you give during onboarding. The answers you give to the questions we ask about your business, and which ads you choose.
  4. Commercial information. Your spend, your chosen price per click, your billing details, your payment history and your correspondence with us.
  5. Advertising data, once your ads run. Click counts, impressions, reach, cost, delivery, placement, and audience and targeting information reported to us by Meta in respect of the ads we run for you. This is reported to us at an aggregated level. We do not receive the identities of the individuals who saw or clicked your ads.
  6. Technical information. Standard server information generated when you use our website, including IP address, browser type, pages requested and timestamps, held in our hosting and security logs.
  7. Information about businesses we approach. Before you have given us anything, we may hold your business name, your website address, and the business contact email address or telephone number published on your own website or in a public business listing. Section 15 explains this in full.
  8. What we record on your personal page. If we have made you a personal page at awakenedmedia.net/for/ followed by a short code, we record when that page is first opened, how many times it is opened in total, when it was last opened, and whether the link in our email to you has been clicked. We store that alongside your prospect record, together with a short log of each contact between us, for example the day we generated your sample ads, the day we emailed you, and the day you replied or unsubscribed. Those records are not linked to any advertising profile and are not shared with any advertising network.
  9. We do not deliberately collect special category data (such as health, religion, ethnicity or political opinions) or criminal offence data. Please do not send it to us. If such data appears on your public website, it may be captured incidentally when we read the site, and we will handle it in line with this policy and delete it where it is not needed.

3. How we collect it

  1. You give it to us, when you submit your website, join the waiting list, answer our questions, choose your ads, pay, or email us.
  2. We crawl your public website, automatically, using our own tooling and third party reading services. We read only pages that are publicly accessible. We do not attempt to access anything behind a login.
  3. Meta reports it to us, as performance data on the ads we run from our own ad account.
  4. Automatically, through our hosting, in server logs, when you visit our website.
  5. From your public website and public business listings, before you have contacted us, where we have picked your business to approach. See section 15.
  6. On our own server, when a personal page we made for you is opened or an emailed link to it is clicked. This is first party logging in our own database. There is no third party analytics tag and no advertising cookie involved.

4. Why we use it, and our lawful bases

  1. To provide the service. Reading your website, producing your brand brief and your ads, asking you questions, running and managing your ads, billing you and supporting you. Lawful basis: performance of a contract with you, or taking steps at your request before entering a contract. Where you are a company rather than an individual, our lawful basis for handling the personal data of your staff is our legitimate interests in performing that contract.
  2. To run and optimise advertising campaigns. Targeting, measuring, optimising and reporting. Lawful basis: performance of a contract and legitimate interests in operating an effective advertising service.
  3. To operate, evaluate and improve our service. Including analysing what works, refining our prompts and models, and building aggregated performance knowledge. Lawful basis: legitimate interests in developing and improving our business.
  4. To show our work. Using your business name, logo, ads and results in our portfolio, case studies and marketing. Lawful basis: legitimate interests in marketing our service, and our contract with you. You can opt out of this at any time by writing to us. See clause 6.3 of our terms.
  5. To send you service emails. Onboarding, progress, billing, changes to the service. Lawful basis: performance of a contract.
  6. To send you marketing about our own service. Lawful basis: legitimate interests in marketing similar services to an existing business customer, or your consent where consent is required. You can unsubscribe at any time. See section 11, and section 15 where we approached you before you were a customer.
  7. To keep records, meet our legal obligations and protect our position. Accounting and tax records, fraud prevention, security, and establishing, exercising or defending legal claims. Lawful basis: legal obligation and legitimate interests.
  8. Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and concluded that they are not, given the business context and the limited nature of the data. You can ask us for details of that assessment, and you can object under section 8.

5. Who we share it with

  1. We do not sell personal data. We share it only with the suppliers below, who process it on our instructions or, where they are controllers in their own right, under their own terms.
  2. Hosting, storage and database. Cloudflare, Inc. Hosts our website and service, stores the files and screenshots we hold, and runs our database.
  3. Reading your website and writing your brand brief. Google (Google LLC and Google Ireland Limited), through its Gemini models. Jina AI GmbH, which reads and extracts the content of web pages for us.
  4. Image generation. fal.ai (Features and Labels, Inc.) and OpenAI (OpenAI, L.L.C. and OpenAI Ireland Limited). These generate the ad images from your website content and our brand brief.
  5. Running the ads. Meta Platforms, Inc. and Meta Platforms Ireland Limited, which operate Facebook and Instagram. Meta is a separate controller for the personal data of the people who see and interact with your ads, under its own terms and privacy policy.
  6. Sending email. Amazon Web Services, Inc., through Amazon Simple Email Service.
  7. We also share personal data with our professional advisers (accountants, lawyers and insurers), with payment providers where relevant, and with a purchaser or prospective purchaser if we sell or reorganise our business.
  8. We disclose personal data where we are required to by law, by a court, by a regulator such as the Information Commissioner's Office or the Advertising Standards Authority, or where disclosure is necessary to establish, exercise or defend legal claims.
  9. We keep this list current. Suppliers change. If you want to know exactly who holds your data at a given moment, ask us.

6. International transfers

  1. Several of the suppliers in section 5 are based in, or process data in, the United States and other countries outside the United Kingdom. That means your personal data is transferred outside the UK.
  2. Where we transfer personal data out of the UK, we do so on one of the following bases:
    • the country is covered by UK adequacy regulations, or the recipient is certified under the UK Extension to the EU-US Data Privacy Framework; or
    • the transfer is made under the UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum, in each case with any additional safeguards required following a transfer risk assessment.
  3. You can ask us which mechanism applies to a particular supplier, and request a copy of the relevant safeguards, by emailing hello@awakenedmedia.net.

7. How long we keep it

  1. Leads and waiting list entries. Kept while we are considering the business and for up to 2 years afterwards, so we know who has approached us.
  2. Customer records. Kept for the whole of our relationship with you, and for 6 years after it ends, to meet accounting and tax requirements and because that reflects the limitation period for bringing a claim.
  3. Financial records. Kept for at least 6 years from the end of the accounting period, as required by law.
  4. The ads we generate, the screenshots we take and the images and logos we copy from your website. Kept for as long as we maintain our portfolio and business records, under the licence in clause 6.2 of our terms. We review what we hold at least every three years and delete anything we no longer have a business reason to keep. You can opt out of portfolio and marketing use at any time, which stops future publication, and we will then keep the material only as an internal record.
  5. Advertising performance data. Kept indefinitely in aggregated form, which does not identify anyone, as part of the campaign and performance history of our own ad account.
  6. Marketing contacts. Kept until you unsubscribe, plus a suppression record afterwards so that we do not contact you again.
  7. Server and security logs. Kept for up to 12 months.
  8. Prospect records. Where we approached you and you did not become a customer, we keep your prospect record, including the sample ads and the page view and click record in clause 2.8, for up to 2 years from our last contact with you, so that we know who we have already approached. We delete it sooner if you ask. If you unsubscribe we keep only a suppression record, being your business name and email address, so that we do not contact you again.
  9. When a retention period ends we delete the data or anonymise it so that it can no longer identify anyone.

8. Your rights

  1. Under the UK GDPR you have the right to:
    • be informed about how we use your personal data, which is the purpose of this policy;
    • access a copy of the personal data we hold about you;
    • rectification, to have inaccurate data corrected and incomplete data completed;
    • erasure, to have your data deleted where there is no good reason for us to keep it;
    • restriction, to ask us to pause our use of your data in certain circumstances;
    • portability, to receive data you gave us in a structured, commonly used, machine readable format, where we process it by automated means on the basis of contract or consent;
    • object, to our processing based on legitimate interests, and at any time and absolutely to processing for direct marketing;
    • withdraw consent, where our processing is based on consent, without affecting processing already carried out.
  2. These rights are not absolute. We may refuse a request in whole or in part where an exemption applies, for example where we need to keep records for legal or accounting reasons, or to establish, exercise or defend legal claims. We will tell you if we do, and why.
  3. To exercise a right, email hello@awakenedmedia.net or use our contact form. We may ask you for information to confirm who you are. We respond within one month, and can extend by two further months for complex requests, in which case we will tell you within the first month.
  4. Exercising these rights is free. We may charge a reasonable fee, or refuse, if a request is manifestly unfounded or excessive.
  5. Note that deleting the personal data we hold about you does not undo the licence you granted us over your business materials under clause 6.2 of our terms, and does not require us to withdraw ads already published.

9. Complaints

  1. If you are unhappy with how we have handled your personal data, please tell us first at hello@awakenedmedia.net so that we can try to put it right.
  2. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection. Website ico.org.uk, helpline 0303 123 1113, address Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
  3. Complaining to us first does not affect your right to complain to the ICO at any time.

10. Cookies

  1. Our product uses essential cookies and similar storage only. These keep you signed in, hold your session, remember where you are in the onboarding flow, and keep the service secure. Essential cookies do not require consent, so we do not show a cookie banner for them.
  2. We do not set analytics, advertising or tracking cookies on our own website, and we do not use any third party analytics product. If that changes, we will update this section and, where the law requires it, ask for your consent before setting them.
  3. We do keep our own server side record of how our pages are used. In particular, when a personal page we made for a business is opened, or an emailed link to it is clicked, our server writes that to our own database as described in clause 2.8. That happens on our side, with no cookie and no identifier stored in your browser, so it does not require consent under the Privacy and Electronic Communications Regulations. It is covered by our legitimate interests in knowing whether the businesses we approach found what we sent them useful.
  4. Separately, when your ads run, Meta sets its own cookies and identifiers in the browsers of the people who see and interact with those ads, on Facebook, on Instagram and on your own website if you have installed a Meta pixel there. That happens on Meta's side and under Meta's own terms, and is outside our control. If you operate a website that sets such cookies, you are responsible for the consent and notice requirements on your own site.
  5. You can block or delete cookies through your browser settings. Blocking essential cookies will stop parts of our service from working.

11. Marketing emails

  1. We may email you about our service, including new features, changes, offers and tips for getting more from your ads.
  2. You can unsubscribe at any time, using the link in any marketing email or by emailing hello@awakenedmedia.net. We will action it promptly.
  3. Unsubscribing from marketing does not stop service emails about your account, your ads and your billing, which we need to send while you are a customer.

12. Children

  1. Our service is for businesses and is not directed at, or intended for, anyone under 18. We do not knowingly collect personal data from children.
  2. If you believe we hold personal data about a child, tell us at hello@awakenedmedia.net and we will delete it.

13. Security

  1. We take appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, and against accidental loss, destruction or damage. These include encryption in transit, access controls, limiting access to those who need it, and using reputable infrastructure providers.
  2. No system is completely secure. We cannot guarantee the security of data transmitted to us over the internet, and any transmission is at your own risk.
  3. If a personal data breach occurs that is likely to result in a risk to people's rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and tell affected people where the law requires us to.

14. Changes to this policy

  1. We may update this policy from time to time. The current version is always on this page, with the date and version number shown at the top.
  2. If we make a material change to what we collect, why we use it, who we share it with or how long we keep it, we will tell existing customers by email as well as updating this page.
  3. Please check this page from time to time so that you are aware of any changes.

15. Businesses we approach

  1. Sometimes we contact a business before it has given us anything. We pick businesses we think the service suits, make them a set of sample ads, and email those ads with a link to a page we have made for them. This section explains that, because everything above assumes you came to us first.
  2. What we hold. Your business name, your website address, and the business contact email address or telephone number you publish. Where you are a sole trader or a partnership, or where the published contact is a named person, that information is personal data and everything in this policy applies to it.
  3. Where it came from. Your own public website, and public business listings and directories. We do not buy contact lists and we do not take anything from behind a login.
  4. What we made with it. Before contacting you, we read your public website as described in clause 2.2 and generated a small set of sample ads from its own words and pictures. They are illustrations of what we could make for you. We hold them, the screenshots and the copied images as part of your prospect record, and we do not publish them or run them anywhere. Ask us and we will delete them.
  5. Your personal page. The link we email you opens a page we made for you. Clause 2.8 says exactly what we record when it is opened or the link is clicked.
  6. Our lawful basis. Legitimate interests, being our interest in offering an advertising service to businesses we think it suits, and your interest as a business in hearing about a service relevant to it. We contact you at your business address about your business only, and we have weighed our interest against your rights as set out in clause 4.8.
  7. Marketing law. Under regulation 22 of the Privacy and Electronic Communications Regulations, marketing email to a corporate subscriber, meaning a company, a limited liability partnership or a corporate body, does not require prior consent. Where you are a sole trader or an unincorporated partnership you are treated as an individual subscriber, and we email you only where we may lawfully do so and stop the moment you tell us to.
  8. Unsubscribing. Every email we send you carries an unsubscribe link. Using it stops all further marketing from us immediately, with no reply needed. You can also email hello@awakenedmedia.net and we will action it by hand.
  9. Objecting and deleting. You can object to this processing at any time, and ask us to delete your prospect record and the sample ads we made, by emailing hello@awakenedmedia.net or using our contact form. We do not ask for a reason. We will confirm when it is done, and the only thing we keep afterwards is the suppression record described in clause 7.8. Your other rights under section 8 apply in full.