Privacy Policy

1. Who we are

This privacy policy explains how Mostro Group Ltd ("Mostro", "we", "us", "our") collects, uses, and protects personal data. We are a marketing agency registered in England and Wales.

• Company name: Mostro Group Ltd

• Company number: 17227056

• Registered address: 66 Paul Street, London, England, EC2A 4NA, United Kingdom

• Contact email: hi@mostro.io

Mostro is the data controller for personal data we collect about our own website visitors, enquirers, and clients. When we process personal data on behalf of our clients as part of delivering marketing services, we generally act as a data processor — see Section 7.

We are committed to processing personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. The personal data we collect

Depending on how you interact with us, we may collect:

Information you give us directly

• Identity and contact details — name, email address, phone number, company name, job title — when you contact us, request a proposal, or become a client.

• Correspondence — the content of messages you send us via email, contact forms, or other channels.

• Client account and billing information — details necessary to deliver services and manage our commercial relationship.

Information we collect automatically

• Technical and usage data — IP address, browser type, device information, the pages you visit on our website, and how you navigate the site.

• Cookies and similar tracking technologies — see our Cookies section (Section 6).

Information we process on behalf of clients

When delivering marketing services, we may process personal data belonging to our clients' customers, leads, and contacts (for example, contact lists, campaign audiences, or CRM data). We process this data only as instructed by the client and under a data processing agreement (see Section 7).

3. How we use your data and our legal basis

Under UK GDPR we must have a lawful basis for processing personal data. We rely on the following:

What we use data forLawful basisResponding to enquiries and providing requested informationLegitimate interests (responding to your request)Delivering marketing services to our clientsContract performanceManaging billing, accounts, and our client relationshipContract performance / Legal obligationSending you marketing about our own servicesConsent, or legitimate interests where permittedImproving and securing our websiteLegitimate interestsAnalytics and advertising cookiesConsentComplying with legal, tax, and accounting obligationsLegal obligation

Where we rely on legitimate interests, we have carried out a balancing assessment to ensure our interests do not override your rights. You can ask us about this at any time.

Where we rely on consent (for example, non-essential cookies or marketing emails), you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

4. Marketing communications

If you have consented or where we are otherwise permitted, we may send you information about our services. Every marketing email includes an unsubscribe link, and you can opt out at any time by clicking it or emailing hi@mostro.io. We will action your request promptly.

5. How we share your data

We do not sell your personal data. We may share it with:

• Service providers and sub-processors who help us run our business — for example, hosting providers, email and CRM platforms, analytics and advertising providers, and IT support. These parties act on our instructions and are bound by appropriate contractual obligations.

• Professional advisers such as accountants, lawyers, and insurers, where necessary.

• Authorities and regulators where we are legally required to disclose information.

• A buyer or successor in the event of a merger, acquisition, or sale of business assets.

The key providers we may rely on include Google (Workspace, Analytics, and Ads), Meta, and LinkedIn, alongside our email/CRM platform, website host, and accounting software.

6. Cookies and tracking technologies

Our website uses cookies and similar technologies to function, to understand how visitors use the site, and to support our advertising. We use:

• Essential cookies — required for the website to work. These do not require consent.

• Analytics cookies — Google Analytics, to understand site usage and improve our content.

• Advertising and remarketing cookies — Google Ads, the Meta (Facebook/Instagram) pixel, and the LinkedIn Insight Tag, used to measure ad performance and show relevant ads to people who have visited our site.

Non-essential cookies (analytics and advertising) are only set with your consent, which we collect via our cookie banner when you first visit. You can change your preferences at any time through the cookie settings on our site, and you can manage or block cookies through your browser settings.

7. Acting as a data processor for clients

When we provide marketing services, we often process personal data on behalf of our clients. In these cases, the client is the data controller and Mostro is a data processor. We:

• Process personal data only on the documented instructions of the client.

• Enter into a written data processing agreement with each client, as required by Article 28 UK GDPR.

• Apply appropriate technical and organisational security measures.

• Assist clients in responding to data subject requests and in meeting their own UK GDPR obligations.

• Engage sub-processors only with the client's authorisation and under equivalent obligations.

• Delete or return personal data at the end of our engagement, as instructed.

If your personal data has been processed by Mostro on behalf of one of our clients, you should direct any requests to that client as the data controller in the first instance, though you are welcome to contact us and we will assist.

8. International data transfers

Some of our service providers may process data outside the UK. Where personal data is transferred outside the UK, we ensure an appropriate safeguard is in place — such as an adequacy decision (UK "adequacy regulations"), the International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses — so that your data receives an equivalent level of protection.

9. How long we keep your data

We keep personal data only for as long as necessary for the purposes set out in this policy, including to satisfy legal, accounting, or reporting requirements.

• Enquiries that don't become clients: up to 24 months, then deleted.

• Client records and contracts: for the duration of the relationship and 7 years afterwards, to meet UK tax and contractual record-keeping requirements.

• Marketing contacts: until you unsubscribe or after 24 months of inactivity.

• Client-owned data we process: retained and deleted as instructed by the client under our data processing agreement.

10. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.

• Rectify inaccurate or incomplete data.

• Erase your data ("right to be forgotten") in certain circumstances.

• Restrict or object to certain processing, including direct marketing.

• Data portability — receive your data in a structured, machine-readable format.

• Withdraw consent at any time where we rely on it.

To exercise any of these rights, contact us at hi@mostro.io. We will respond within one month. There is normally no fee, though we may charge a reasonable fee or refuse requests that are manifestly unfounded or excessive.

11. How we protect your data

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse, and we review these measures regularly. No method of transmission over the internet is completely secure, but we work to protect your data and to respond appropriately to any data security incident.

12. Complaints

If you have a concern about how we handle your personal data, please contact us first at hi@mostro.io so we can try to resolve it. You also have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner's Office (ICO) Website: ico.org.uk Helpline: 0303 123 1113

13. Changes to this policy

We may update this privacy policy from time to time. The "Last updated" date at the top shows when it was last revised. Significant changes will be communicated where appropriate.

14. Contact us

For any questions about this privacy policy or how we handle your data:

Mostro Group Ltd 66 Paul Street, London, England, EC2A 4NA, United Kingdom Email: hi@mostro.io