ASUM & Google Ads Tokens Policy

• Agencies to connect their Google Ads accounts and share advertising-account data with ClickTrain; and
• Agencies to be ranked using metrics such as Ad Spend Under Management (ASUM), certifications, reviews and activity metrics.

This policy currently covers only integrations with Google Ads. When we add integrations with other advertising platforms, we will update this ASUM Policy accordingly.

• Account identifiers and basic account information (e.g., account name, time zone, currency);
• Campaign configuration and performance metrics (e.g., ad spend, impressions, clicks, conversions, cost per result) required to compute ASUM and advertising analytics; and
• Google Ads certifications or badges associated with the agency.

Our application requests only the minimum permissions necessary to provide these features. The Google API Services User Data Policy requires developers to clearly explain who is requesting data, what data is requested and why. We do not request restricted-scope data (such as Gmail or sensitive scopes), and we will update this policy before requesting new categories of Google data.

• Overall ad spend and spend trends from connected Google Ads accounts;
• Certifications completed by agency staff (these certifications are manually marked by our independent assessment team solely to verify credentials);
• Reviews, including Google reviews and other publicly available ratings; and
• Activity metrics, such as number of active specialists and participation in our assessment programmes.

We do not collect demographic or sensitive data for agency ranking.

• Provide ASUM analytics – calculate ad-spend visibility, channel split and other metrics based on your Google Ads account data;
• Rank agencies – display an agency’s ranking on the Agency leaderboard and in AI-powered search results using the criteria described in Section 2.2;
• Provide performance insights – offer reports, dashboards and optimisation suggestions via our PPC Listenr and other tools;
• Verify certifications – confirm that agency staff have completed skills assessments and that certifications have been independently verified; and
• Comply with our legal obligations and enforce our agreements.

For information about how we use specialists’ skills, assessment results and matching criteria to match individuals to roles or rank specialists, please see the Recruitment & Skills Testing Policy.

We do not use Google Ads account data for unrelated advertising, profiling outside the ClickTrain service or resale to third parties. The Google API Services User Data Policy prohibits using Google user data for advertising or unrelated purposes.

• Performance of a contract – we need to access and process advertising-account data to provide ASUM analytics, ranking and insights as part of your subscription;
• Legitimate interests – we have a legitimate interest in analysing ad spend and performance to improve our services and provide benchmarking insights. We balance these interests against your rights and ensure that our processing does not override your privacy interests; and
• Consent – we rely on your consent to connect your Google Ads account via OAuth and to use marketing cookies for remarketing. You can withdraw consent at any time by revoking access in your Google account settings or adjusting your cookie preferences.

• When you connect a Google Ads account, the OAuth access and refresh tokens are stored in your browser’s local storage and encrypted at rest. We do not store these tokens on our servers.
• We use Firebase Authentication to manage user log-ins and do not store passwords or Google credentials ourselves. Passwords (if applicable) are stored by Firebase using secure hashing.
• Our server infrastructure runs in Google Cloud. Secrets are stored in Google’s secret-management service. We implement role-based access controls so that only authorised staff can edit or view advertising metrics.
• We use Cloudflare to help protect against distributed denial-of-service (DDoS) attacks and to monitor suspicious traffic.
• We keep all personal data in UK data centres, even if the agency is based in South Africa or Argentina. We rely on appropriate safeguards, such as UK standard contractual clauses, when transferring data to third-party service providers outside the UK.

• Advertising-account data: we hold ad-spend metrics and campaign performance data while your agency subscription remains active. When you disconnect your Google Ads account or terminate your subscription, we delete your advertising-account data within 30 days.
• Agency ranking data: we keep anonymised or aggregated ranking data for statistical purposes without time limits.
• Cookies: cookies expire in accordance with our Cookie Statement. You can delete them at any time in your browser settings.
• Certification records: we retain certification verification records for as long as necessary to confirm qualifications, after which we may anonymise them.

• Our independent assessment team: only for the purpose of marking skills tests and verifying certifications, as described above. The assessment team does not use or share Google Ads data beyond verifying agency certifications.
• Service providers: such as hosting providers (Google Cloud), analytics tools and security vendors (Cloudflare), who act on our behalf under strict confidentiality obligations.
• Legal or regulatory authorities: if required by law or to protect our rights.

We do not sell or rent Google Ads account data, certification records or personal information to third parties. We do not allow third parties to read Google Ads data except as necessary to operate our services, consistent with Google’s Limited Use policy.

• Access the personal information we hold about you;
• Rectify inaccurate or incomplete information;
• Withdraw consent at any time (e.g., revoke Google Ads access); withdrawing consent will not affect the lawfulness of processing before the withdrawal;
• Object to or restrict our processing of your personal data;
• Request deletion of your personal information; and
• Complain to the Information Commissioner’s Office (ICO) or another supervisory authority if you believe your data is being processed unlawfully.

Please see the “Your Legal Rights” section of our Privacy Policy for more details. To exercise these rights, email us at dpo@clicktrain.com.

By using the ASUM features or connecting your Google Ads account, you acknowledge that you have read and understood this ASUM & Google Ads Tokens Policy and agree to the practices described herein.