Privacy Policy

1. Who We Are

Bambino Agency (“Bambino”, “we”, “us”, “our”) is a digital marketing agency based in Manchester, United Kingdom. For the purposes of data protection law, Bambino Agency is the data controller responsible for your personal data.

We are registered with the Information Commissioner’s Office (ICO) as a data controller. If you have any questions about this privacy policy or how we handle your data, please contact us using the details above.

2. What Personal Data We Collect and Why

We only collect personal data that is necessary for a specific, legitimate purpose. The categories of data we collect include:

Data you provide to us

• Contact and enquiry data: name, email address, telephone number, company name, and the content of any message you send via our contact form or by email. We use this to respond to your enquiry and to provide our services.
• Client and billing data: billing address, company details, and payment information. We use this to administer our contractual relationship with you.
• Marketing preferences: whether you have opted in to receive newsletters or other marketing communications from us.

Data collected automatically

• Usage and analytics data: pages visited, time spent on site, referring URL, browser type, device type, and approximate geographic location (country/city level). This is collected via Google Analytics 4 (GA4) to help us understand how our website is used and to improve it.
• Advertising data: if you click on one of our adverts on Google, LinkedIn, or Meta, those platforms may set cookies that allow us to measure the effectiveness of our campaigns. See Section 6 for details.
• Technical data: IP address, browser settings, and similar technical identifiers. This is collected for security and fraud prevention purposes and to ensure the website functions correctly.

Data we receive from third parties

• If you interact with us via LinkedIn, Google, or other platforms, we may receive limited profile information in accordance with those platforms’ privacy settings.
• We may receive referral information from our business partners.

We do not knowingly collect personal data from individuals under the age of 18. Our website and services are directed at businesses and adults.

3. Legal Basis for Processing

Under UK GDPR Article 6, we rely on the following legal bases to process your personal data:

• Legitimate interests (Article 6(1)(f)): We process analytics and technical data to operate and improve our website, and to send marketing communications to existing clients or warm prospects where we have a reasonable basis to believe our services are relevant to them. We have conducted legitimate interests assessments (LIAs) for these processing activities.
• Contract performance (Article 6(1)(b)): We process client data to fulfil our contractual obligations to you — for example, delivering agreed services and issuing invoices.
• Legal obligation (Article 6(1)(c)): We may need to retain certain records (such as invoices and contracts) to comply with tax and accounting obligations under UK law.
• Consent (Article 6(1)(a)): Where we rely on consent — for example, for non-essential cookies or email marketing to new contacts — we will ask for it explicitly and record it. You may withdraw consent at any time without detriment.

Where we process special category data (we do not ordinarily do so), we would rely on an appropriate condition under Article 9 UK GDPR and would inform you at the point of collection.

4. How Long We Keep Your Data

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by law. Our standard retention periods are as follows:

• Enquiry and contact form data: 2 years from the date of last contact, unless a business relationship develops.
• Client and contract data: 7 years from the end of the contractual relationship, in line with HMRC requirements for financial records.
• Marketing preference records: retained for as long as you remain a subscriber. If you unsubscribe, we retain a suppression record to honour your opt-out.
• Analytics data: Google Analytics data is retained for 14 months by default. Aggregated, anonymised data may be retained indefinitely.
• Cookie consent records: 13 months from the date of consent, in line with ICO guidance.

When personal data is no longer required, we securely delete or anonymise it.

5. Your Rights Under UK GDPR

As a data subject under UK GDPR, you have the following rights in relation to your personal data. To exercise any of these rights, please contact us at leads@boomymarketing.com. We will respond within one calendar month of receiving your request.

You will not be charged for exercising your rights. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or decline, and will explain why.

6. Third-Party Tools We Use

We use a number of third-party tools to operate our business and measure the performance of our marketing. Each acts as a data processor or independent controller. Where required, we have Data Processing Agreements (DPAs) in place with these providers.

All third-party providers are required to keep your data secure and to process it only on our instructions. We do not sell your personal data to any third party.

7. Cookies

Our website uses cookies and similar tracking technologies to provide essential functionality, analyse traffic, and support our advertising campaigns. Some cookies are strictly necessary for the site to work; others require your consent.

For full details of every cookie we use — including names, purposes, providers, and durations — please read our Cookie Policy.

You can manage your cookie preferences at any time through our cookie consent banner or via your browser settings. Withdrawing consent for non-essential cookies will not affect your ability to use the website.

8. Contact the ICO

We take your data protection rights seriously and aim to resolve any concerns directly. If you are unhappy with how we have handled your personal data, please contact us in the first instance at leads@boomymarketing.com.

If you remain dissatisfied after contacting us, you have the right to lodge a complaint with the UK’s supervisory authority:

This policy was last reviewed and updated on 24 April 2026. We will notify you of any material changes by publishing an updated version on this page and, where appropriate, by email.