Privacy Policy

The Peddler LLC (trading as The Peddler, "we", "us", "our") is a digital marketing agency registered in Kentucky, United States, with offices at 612 S Main St #201, Hopkinsville, KY 42240, United States. We are the controller of the personal information described in this policy.

If you have any question about this policy or how we handle your information, contact us at hello@thepeddler.agency or +1 (910) 390-5798.

We collect only the information we need to answer enquiries, deliver services and improve the website. This falls into four categories:

• Information you give us: name, business name, email address, phone number, website URL, budget range and anything else you type into a contact, audit-request or newsletter form.
• Information from client engagements: access to marketing platforms, analytics accounts, campaign data and any files you share with us during a project.
• Technical information: IP address, browser type and version, device type, operating system, referring URL and pages viewed, collected automatically through server logs and analytics.
• Communications: emails, call notes, meeting recordings (only with your explicit consent) and support messages.

We process personal information for the following purposes and no others:

• To respond to enquiries and prepare proposals or growth audits you request.
• To deliver contracted services, including managing advertising accounts and reporting on performance.
• To send service updates, invoices and account administration messages.
• To send marketing emails where you have opted in — you can unsubscribe from any message.
• To measure and improve website performance, content and conversion paths.
• To meet legal, accounting and tax obligations, and to establish or defend legal claims.

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (delivering services you have engaged us for); legitimate interests (responding to business enquiries, securing and improving the site, direct marketing to business contacts); consent (non-essential cookies and marketing emails to individuals); and legal obligation (retaining financial records).

Where we rely on consent you may withdraw it at any time without affecting processing that already took place.

We use a small number of essential cookies to make the site function, and optional analytics and advertising cookies that only load after you accept them in the consent banner. Full detail, including categories and retention periods, is set out in our Cookie Policy.

We never sell personal information. We share it only with service providers who help us operate, and only to the extent required:

• Hosting, email and productivity providers that store our business data.
• Analytics and advertising platforms used to run client campaigns.
• Payment processors and our accountants for billing and statutory reporting.
• Professional advisers and regulators where we are legally required to disclose.

Some of our providers are located in the United States and other countries. Where we transfer personal information out of the UK or European Economic Area, we rely on adequacy decisions or Standard Contractual Clauses together with appropriate technical safeguards.

Enquiry records are kept for 24 months from the last contact. Client records are kept for the duration of the engagement plus seven years to satisfy accounting and legal obligations. Marketing consent records are kept until you unsubscribe plus 12 months. Server logs are retained for 90 days.

Depending on where you live, you may have the right to access the personal information we hold about you, to have it corrected or deleted, to restrict or object to processing, to receive a portable copy, and to withdraw consent. California residents may additionally request disclosure of categories of information collected and opt out of any sharing that qualifies as a sale under the CCPA — we do not sell personal information.

To exercise any right, email hello@thepeddler.agency. We respond within 30 days and will never charge you or discriminate against you for making a request.

We protect information with encryption in transit, access controls limited to staff who need the data, multi-factor authentication on all business systems, and regular review of third-party access. No system is perfectly secure, but we notify affected individuals and regulators without undue delay if a breach affecting personal data occurs.

Our services are for businesses. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us information, contact us and we will delete it.

We review this policy annually and whenever our practices change. The current version was last updated on 1 July 2026. Material changes will be announced on this page before they take effect.