Privacy Policy

1. Who we are.RPM Agency Pty Ltd ("RPM Agency", "we", "us", "our") runs Google Ads campaigns for Australian automotive businesses, including mechanics, panel shops, detailers, 4WD shops, and auto electricians. RPM Agency Pty Ltd is a subsidiary of BluFire Pty Ltd.

This policy explains how we collect, use, store, and disclose personal information when you visit rpmagency.io, contact us, become a client, or use our client portal at portal.rpmagency.io.

If you have questions about this policy or how we handle your information, email info@rpmagency.io. Our Privacy Officer reviews and responds to all privacy enquiries.

2. What we collect. From website visitors. Information you submit through our forms (name, email address, phone number, business name, and anything you choose to write to us). We also collect standard technical information automatically, including IP address, browser type and version, device type, the page that referred you, and pages viewed on our site. We use Microsoft Clarity to record page interactions and generate heatmaps, and the Meta Pixel for advertising attribution. Both tools may collect information about how you interact with our site, including mouse movements, clicks, scrolls, and pages visited.

From clients. Business and contact details for you and any team members you nominate, account credentials and access tokens for the platforms you authorise us to manage on your behalf (Google Ads, Google Business Profile, Meta Ads, and similar), campaign performance data we read from those platforms, and leads generated through landing pages or forms we operate for you (which may include the personal information of your prospective customers).

What we don't collect.We don't ask for or store payment card numbers. Billing is processed by Stripe, which handles card details directly under its own privacy and security standards.

3. How we use your information. We use your information to:

• deliver the services you've engaged us for, including running, managing, and optimising your campaigns;
• send reports, notifications, and operational communications;
• respond to your enquiries and provide support;
• issue invoices and process payments through Stripe;
• maintain the security and integrity of our systems; and
• comply with our legal and regulatory obligations.

We use aggregated and de-identified data to improve our services and internal tools. We do not sell your personal information. We do not disclose it to third parties for their own marketing purposes.

4. Who else handles your information. We use a limited set of trusted service providers to operate our business, covering hosting and infrastructure, database storage, email delivery, analytics, payment processing, and the advertising platform APIs we operate on your behalf. These providers handle your information only on our instructions and only to the extent necessary to provide their service to us. We require each of them to maintain appropriate security and confidentiality standards.

Some of our providers may store or process data outside Australia, including in the United States and the European Union. Where this occurs, we take reasonable steps to ensure your information is handled in a manner consistent with the Australian Privacy Principles.

Google user data. Our use of information received from Google APIs is governed by the Google API Services User Data Policy, including the Limited Use requirements. We use Google data solely to operate the campaigns, reporting, and account management features you've authorised. We do not transfer Google user data to third parties except as necessary to provide or improve those features, comply with applicable law, or as part of a merger, acquisition, or sale of assets with notice to you. We do not use Google user data for advertising purposes unrelated to the services you've authorised, we do not sell it, and we do not use it to develop, improve, or train generalised AI or machine learning models.

We may also disclose your information where required by law, court order, or a valid request from a regulatory authority, or where necessary to protect our rights, property, or safety, or that of our clients or others.

5. Security. We take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, modification, or disclosure. These steps include access controls, encryption in transit, secure credential storage, and restricted internal access on a need-to-know basis. No system is perfectly secure, and we cannot guarantee absolute security; if we become aware of a data breach likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner in line with the Notifiable Data Breaches scheme.

6. Your rights and how long we keep things. Under the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the right to:

• request access to the personal information we hold about you;
• request correction of information that is inaccurate, out of date, incomplete, or misleading;
• request deletion of your information, subject to our legal and contractual obligations to retain it; and
• withdraw consent for optional processing where consent is the basis for that processing.

To exercise any of these rights, email info@rpmagency.io. We will respond within 30 days. We may need to verify your identity before actioning a request, and in limited circumstances we may decline a request where the law permits or requires us to do so; if we decline, we will explain why.

We retain your information for as long as we're providing services to you, and for a reasonable period afterward to meet our legal, accounting, and tax obligations (typically 7 years under Australian record-keeping requirements). After that period, we delete or de-identify the information.

If you're not satisfied with how we've handled your information or responded to a request, you can lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au or by calling 1300 363 992.

7. Cookies and tracking.We use cookies and similar technologies to operate our website, remember your preferences, measure traffic, and support advertising attribution. You can control cookies through your browser settings; disabling some cookies may affect site functionality. Where required, we'll request your consent before setting non-essential cookies.

8. Children.Our services are directed at businesses and are not intended for individuals under 18. We do not knowingly collect personal information from children. If you believe we've inadvertently collected information from a child, contact us and we'll delete it.

9. Updates to this policy.If our practices change in a way that affects this policy, we'll update the page and the "Last updated" date at the top. For material changes that affect active clients, we'll notify you by email. The current version is always available at rpmagency.io/privacy.

10. Contact.
RPM Agency Pty Ltd
Email: info@rpmagency.io
Privacy enquiries: info@rpmagency.io