Privacy policy.

01Controller and scope

onlinelad is the controller of the personal information described in this policy. This means we decide why and how that information is used.

The policy applies when you use onlinelad.com, register or sign in, buy or download a product, join or manage a membership, use rewards or referral features, enter a promotion, save a preference, submit an image or message, subscribe to updates or otherwise interact with us.

Some pages connect to third-party services with their own privacy notices. Their handling of information is governed by those notices as well as the contracts and controls we put in place.

02Information we collect

The information involved depends on what you choose to do.

03Where it comes from

• Directly from you, when you create an account, place an order, join, complete a form, change a preference, upload a file or contact us.
• From your use of the site, through server logs, cookies, local or session storage, analytics and security technologies.
• From service providers, such as payment confirmation, fraud signals, email delivery information or membership status.
• From referral or campaign links, where a link contains a source, campaign or referral identifier.
• From another person or organisation, if they buy for you, refer you, name you in an enquiry or provide authorised project information.

Please only give us another person's information when you are entitled to do so and they understand how it will be used.

04Purposes and lawful bases

UK data protection law requires a lawful basis for each use of personal information. The main bases we rely on are:

We may use information to establish, exercise or defend legal claims where necessary. If the purpose or lawful basis changes materially, we will provide appropriate information before using the data in the new way.

05Accounts and memberships

Registration and membership records let us authenticate you, display account details, manage plan access, renewals, downloads and benefits, prevent duplicate or abusive use, and provide account support.

Paid plans may renew automatically under the Subscription Access & Membership Terms. We use membership and order status to decide which content, discounts and benefits your account can access.

For age-restricted registration or purchasing, we record the date of birth you enter, the resulting age check and the wording, time and version of any required consent. Do not create an account or purchase if you do not meet the age requirement in our Terms of Use.

You can update most account information in My Account. You may also ask us to close your account, subject to records we must or are entitled to retain.

06Orders and payments

We use order and billing information to process purchases, deliver downloads, apply licence or membership access, send receipts and service messages, handle refunds and disputes, prevent fraud and keep tax and accounting records.

Payments may be processed by Stripe, WooPayments, PayPal or another method shown at checkout. The provider receives the information needed to authorise and settle the transaction. We normally receive a payment status, limited billing details and a transaction reference, not your complete card number, security code or payment-account password.

Payment providers may use information for their own legal, fraud-prevention and service purposes under their privacy notices. If you choose a wallet or third-party checkout, that provider may also share the contact and billing details you have authorised.

07Rewards, referrals and promotions

If you use Rewards, we maintain your points balance, card number, earning and redemption ledger, qualifying order references and timing information. This is needed to display and administer the programme, calculate eligibility, investigate errors and prevent manipulation.

Referral links or codes may connect a visit, registration or qualifying purchase with the referring account. We limit the information shown to participants and do not disclose a referred person's order details to the referrer unless the feature clearly says otherwise and there is a lawful reason.

Promotions, prize draws or discount offers may require entry and eligibility information. Extra rules or a short privacy notice may apply to a particular promotion.

08Messages and marketing

We use contact and support messages to respond, resolve account or order issues and maintain an appropriate record of the conversation. Transactional and service messages, such as receipts, renewal notices, access information and important policy updates, are not marketing.

If you opt in to news or offers, we may use an email or notification service such as Brevo or WonderPush to send them and record delivery, opens, clicks, device tokens and subscription status where the service provides that information. You can unsubscribe through the message, browser notification settings or by contacting us.

Unsubscribing from marketing will not stop necessary service messages. We may keep a minimal suppression record so that we respect your choice.

09Submissions and images

If you send an image, creative brief, testimonial, support attachment or other material, we use it to assess and answer the request, deliver agreed work, manage rights and permissions, keep project records and handle any related dispute.

Submissions may contain personal information about you or other people. You are responsible for having the permissions needed to share that material with us. Please do not send unnecessary sensitive information.

We will not use an identifiable private submission publicly merely because it was sent to us. Any publication, testimonial or portfolio use is subject to the rights and permissions agreed with you.

10Cookies and device storage

Cookies are small text files stored by your browser. The site also uses local storage and session storage, which can remember information on your device without setting a traditional cookie.

The live cookie panel is the current record of the cookie names, providers, purposes, categories and durations detected on the site. It can include onlinelad consent and session records, WooCommerce and Sourcebuster attribution cookies, Cloudflare security cookies, Google Analytics identifiers, Google language preferences and Stripe fraud-prevention identifiers.

You can open the cookie panel from the site footer to accept, reject or change non-essential categories. Browser settings can also delete or block cookies and site storage, but doing so may affect login, checkout, saved preferences or other features.

11Analytics and attribution

Google Tag Manager helps load approved site tags, and Google Analytics helps measure how visitors find and use the site. Depending on your choices and configuration, this may involve online identifiers, IP-derived location, device details, page and event activity, traffic source and campaign information.

WooCommerce Sourcebuster information may remember the first and current source of a visit so an order can be attributed to the appropriate channel. Referral and campaign parameters can serve a similar purpose.

We use this information to understand aggregate performance, improve journeys, diagnose problems and assess campaigns. We do not use analytics reports to make significant decisions about an identifiable person.

12Providers and sharing

We share only what is reasonably needed with service providers and other recipients that help operate onlinelad, comply with the law or protect legitimate rights.

Providers acting for us are expected to use personal information only for agreed purposes and protect it appropriately. Some recipients, particularly payment providers or public authorities, may act as independent controllers for their own legal purposes.

We do not sell personal information. If the business or relevant assets are reorganised, financed or transferred, information may be disclosed under appropriate confidentiality and data-protection safeguards.

13International transfers

Some providers operate outside the United Kingdom or use international support and infrastructure. This can mean personal information is transferred to or accessed from another country.

Where UK law requires it, we rely on an adequacy regulation, the UK International Data Transfer Agreement or UK Addendum to approved contractual clauses, or another lawful safeguard. We also consider supplementary technical and organisational measures where appropriate.

You can contact us for more information about the safeguard relevant to a particular transfer, although commercially confidential material may be redacted.

14How long we keep data

We keep personal information only for as long as it is reasonably needed for the purpose collected, including legal, accounting, security and dispute requirements. Typical periods are:

• Accounts and memberships: while active, followed by a limited period for support, security and record keeping. Core purchase and contract records may be retained for up to six years.
• Orders, payments, required consent and rewards ledgers: generally up to six years after the transaction, membership or relevant relationship ends, unless a longer period is legally required or a dispute is continuing.
• Enquiries, support and unpublished project submissions: generally up to 24 months after the matter closes, unless they become part of a contract, publication, complaint or legal claim.
• Marketing: until you unsubscribe, withdraw consent or remain inactive beyond our review period. A minimal suppression record may remain.
• Cookies and device storage: for the duration shown in the live cookie panel or until you clear them. Session items normally expire when the session ends.
• Security logs and backups: on rolling schedules that reflect risk, operational need and recovery requirements.

At the end of the relevant period, information is deleted, anonymised or securely isolated until routine deletion is possible.

15Security

We use proportionate technical and organisational safeguards intended to protect personal information from unauthorised access, alteration, disclosure, loss or destruction. Measures include encrypted connections, account authentication, access controls, updates, security monitoring, anti-bot and firewall services, backups and restricted administrative access.

No website or transmission method is completely secure. Keep your password confidential, use a unique password and contact us promptly if you believe your account or information has been compromised.

If a personal-data breach is likely to create a risk to people, we will assess it, take appropriate action and notify affected people and the regulator when required.

16Your rights

Depending on the circumstances, UK data protection law may give you the right to:

• ask whether we use your personal information and receive a copy;
• correct information that is inaccurate or incomplete;
• ask for deletion or restriction of use;
• object to processing based on legitimate interests or to direct marketing;
• receive certain information in a portable, machine-readable form;
• withdraw consent without affecting earlier lawful use; and
• challenge certain decisions made solely by automated means.

These rights are not absolute. We may need to verify your identity, clarify the request or retain information where the law permits or requires it. We normally respond within one month, although complex or numerous requests can take longer where the law allows. There is usually no fee.

Send a request through the contact page. You can also change account, marketing, notification and cookie preferences through the relevant controls.

17Age and automated checks

The public site can be browsed generally, but accounts, memberships and purchases are intended for people aged 18 or over. We do not knowingly invite a child to register or buy. If you believe a child has supplied personal information inappropriately, contact us so we can investigate and take suitable action.

We use rules and technical signals to authenticate accounts, calculate access and rewards, block spam or bots, detect suspicious activity and help payment providers prevent fraud. These processes can affect whether an action is accepted or requires review.

onlinelad does not use personal information to make decisions based solely on automated processing that have legal or similarly significant effects on you. If that changes, we will provide the information and safeguards required by law.

18Privacy complaints

If you think we have handled personal information incorrectly, contact us with a clear description of the concern, relevant dates and the outcome you are seeking.

You may complain to the UK Information Commissioner's Office at any time. We would appreciate the chance to address the matter first, but you do not have to contact us before approaching the ICO. Visit ico.org.uk for current complaint options.

19Changes and contact

We may update this policy when the site, providers, legal requirements or our practices change. The effective date at the top shows when this version took effect. If a change materially affects how existing personal information is used, we will take reasonable steps to bring it to your attention.

This policy should be read with the Terms of Use, Subscription Access & Membership Terms and the live cookie panel.