Legal

Privacy policy

Last updated: 19 August 2026

This policy explains what Drumlee Properties Limited does with the information handled by Drumlee, the internal console our team uses to run the advertising accounts we advertise through. It covers the console itself and this website.

01Who is responsible

The controller of the information described here is Drumlee Properties Limited, a private limited company registered in Northern Ireland under company number NI063033, registered office Fpm Chartered Accountants, 1–3 Arthur Street, Belfast BT1 4GA. Written enquiries about this policy go to support@drumlee.com.

Because we are established in the United Kingdom, the UK General Data Protection Regulation and the Data Protection Act 2018 govern this processing. Where the EU GDPR applies to a particular record, we apply the equivalent standard to it.

02Information we process

Advertising account data

Through the TikTok Marketing API we read, for each connected account: the advertiser ID, account name, currency and time zone; the identifiers, names, status and budgets of campaigns, ad groups and ads; and aggregate performance figures — spend, impressions, clicks and conversion counts. These are business records of accounts our own team holds. They are not records about members of the public, and we do not receive names, contact details or device identifiers of anyone who saw or clicked an advertisement.

Authorisation credentials

When an account is connected we receive an access token and a refresh token from TikTok. They are encrypted before storage, kept server-side, and are never displayed in the interface or written to logs.

Team member accounts

For each person with access to the console we hold a name, a work email address, a hashed password, the role assigned to them, and a record of the changes they make to connected accounts.

Technical and operational data

Server logs record the time of a request, the endpoint called, the outcome and the source IP address. They exist to diagnose failures and to detect abuse.

Correspondence

If you write to us we hold the message, your email address and our reply, so that we can answer and evidence that we did.

03Why we process it, and on what basis

• Running the console — reading account structure and performance, pacing spend against budget, and changing the status of campaigns. Lawful basis: legitimate interests, namely operating and controlling the cost of our own advertising.
• Keeping sessions alive — storing and refreshing tokens so a connected account can be read on the next daily sync. Lawful basis: legitimate interests.
• Access control and audit — knowing which member of the team made a change. Lawful basis: legitimate interests in the security and accountability of our own systems.
• Security and diagnostics — logs and monitoring. Lawful basis: legitimate interests in keeping the service secure and available.
• Answering enquiries — replying to messages sent to us, including rights requests. Lawful basis: legitimate interests, and legal obligation where the request is one we must answer.

We do not use this information for advertising to you, and we make no automated decision that produces a legal or similarly significant effect on any individual.

04TikTok data and platform rules

Data obtained through the TikTok Marketing API is used only to operate the connected accounts. We do not sell it, share it with advertising networks, data brokers or any other third party for their own purposes, use it to build profiles of individuals, or use it to train machine learning models. We do not attempt to access any account that has not been authorised in TikTok Ads Manager by the person who holds it, and we do not combine API data with data from other sources to identify individuals. Where the platform's own developer terms impose a stricter requirement than this policy, the stricter requirement applies.

05Who else sees it

Nobody buys this data from us, because we do not sell it. It is disclosed only to:

• members of our team who need it to do the work described above;
• the providers that host the application, its database and its backups, who process it on our written instructions and for no purpose of their own;
• TikTok itself, when we call the API on a connected account;
• a public authority, where we are legally required to disclose it and have satisfied ourselves that the request is valid.

06How long we keep it

• Account identity records — until the account is disconnected, then erased within 14 days.
• Campaign structure and performance figures — a rolling 18 months, then deleted.
• Access and refresh tokens — erased as soon as the authorisation is withdrawn.
• Team member accounts and the change log — for as long as the person has access, and for 12 months afterwards.
• Technical logs — 60 days.
• Encrypted backups — overwritten on their normal cycle, in no case later than 30 days.
• Correspondence — 24 months from the last message.

07Where it is processed

The application and its database are hosted in the United Kingdom and the European Economic Area. If a record is transferred outside the UK, we rely on UK adequacy regulations where they cover the destination, and otherwise on the International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, together with the technical measures set out below.

08Security

Traffic to the console and to this website is encrypted in transit. Tokens and other credentials are encrypted at rest. Access is limited to named accounts with individual passwords and a second factor, and privileges are granted by role rather than by default. Backups are encrypted. We keep a record of administrative access and review it. No system is beyond compromise, and we do not claim otherwise; if a breach occurs that is likely to result in a risk to people's rights, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it and tell those affected where the law requires.

09Your rights

Under the UK GDPR you may ask us to give you a copy of the personal data we hold about you, to correct it, to erase it, to restrict or object to how we use it, or to transfer it to another controller. Where we rely on legitimate interests you may object at any time, and we will stop unless we can show compelling grounds that override your objection.

Write to support@drumlee.com. We acknowledge within 3 working days and answer within one month; if a request is complex or there are several of them we may extend that by up to two further months, and we will tell you why within the first month. We do not charge for this, unless a request is manifestly unfounded or excessive.

10Complaints

If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, or through ico.org.uk. We would ask you to raise it with us first so we have the chance to put it right.

11California residents

We do not sell or share personal information as those terms are defined by the California Consumer Privacy Act, and we have not done so in the preceding twelve months. California residents may exercise the rights to know, delete, correct and opt out through the same address above, and we will not discriminate against anyone for exercising them.

12Children

Drumlee is a workplace tool for the members of our own team. It is not directed at children, we do not knowingly collect information about anyone under 18, and there is no route by which a child could create an account. If you believe we hold such information, tell us and we will delete it.

13Cookies

This website sets no cookies, loads no fonts, scripts or images from other domains, and carries no analytics or advertising tags. The console itself sets one strictly necessary session cookie, which keeps a signed-in team member signed in and is deleted when the session ends.

14Changes

If this policy changes we will update the date at the top and, where the change is significant, tell the people affected by email before it takes effect.

15Contact

Drumlee Properties Limited, company number NI063033
Fpm Chartered Accountants, 1–3 Arthur Street, Belfast BT1 4GA
support@drumlee.com