SpendClinic Privacy Policy

1. Controller

The data controller is WOH GROUP LTD., 128 City Road, London EC1V 2NX, United Kingdom. Privacy contact: hello@spendclinic.com.

2. Data categories

We process contact data, account data, billing data, company data, advertising campaign data, CSV imports, Google Ads integration data, technical logs and communication logs.

We do not request special category data. If a client provides such data, they must ensure they have a lawful basis.

3. Purposes

We use data to operate accounts, payments, invoices, onboarding, ad analysis, reporting, recommendations, implementation proposals, support, security and legal compliance.

4. Lawful bases

The lawful bases include contract performance, legal obligations, legitimate interests in operating and securing the service, and consent where required, including for some integrations or marketing communications.

5. Advertising data and Google Ads

When Google Ads is connected, we may process campaign, account, cost, click, conversion, conversion value and related performance data.

SpendClinic uses this data only to provide analysis, reports, recommendations and optimization proposals.

6. Recipients

Data may be processed by hosting, email, payment, analytics, advertising platform, security and accounting providers.

We share data only where necessary for the service or legal compliance.

7. International transfers

Data may be processed in the UK, EEA or other countries where technology providers operate.

Where required, we use safeguards such as adequacy decisions, standard contractual clauses or other lawful transfer mechanisms.

8. Retention

Account data is kept for the duration of the service and for periods needed for legal claims or compliance.

Billing records are kept according to tax requirements. Advertising data and reports are kept as needed to provide the service or until account deletion, unless law requires longer retention.

9. User rights

Users may request access, rectification, erasure, restriction, portability, objection and withdrawal of consent where processing is based on consent.

Requests can be sent to hello@spendclinic.com.

10. Complaints

Users may complain to a supervisory authority. In the UK this is the Information Commissioner’s Office (ICO). EU users may also contact their local data protection authority.

11. Automated analysis

SpendClinic may automatically analyse advertising data and generate recommendations. These recommendations do not automatically produce legal or similarly significant effects.

Campaign changes require client approval unless expressly agreed otherwise.

12. Security

We use technical and organisational measures such as HTTPS, access control, backups, logs and data access limitation.

13. Contact

Privacy questions: hello@spendclinic.com.