1. Introduction

DnD Media (“we,” “us,” “our,” or the “Company”) is an Australian digital marketing and media business providing Google Ads management, Meta Ads management, Search Engine Optimisation (SEO), content strategy and creation, social media management, paid media campaigns, creative production, and related analytics and reporting services (collectively, the “Services”).

This Privacy Policy explains how we collect, hold, use, disclose, and protect personal information in accordance with the Privacy Act 1988 (Cth) (the “Privacy Act”) and the Australian Privacy Principles (“APPs”), when you (a “client,” “user,” “visitor,” or “you”) interact with our website, client portals, dashboards, and our Services — including where that information is processed by artificial intelligence (“AI”) and large language model (“LLM”) systems as part of campaign strategy, content generation, reporting, or optimisation.

Where you, or the individuals whose data we handle on a client’s behalf, are located in the European Union, the United Kingdom, or the United States, Sections 13.2 and 13.3 set out the additional rights that apply under the GDPR, UK GDPR, and applicable US state privacy laws.

By using our website or engaging our Services, you acknowledge that you have read and understood this Policy. If you do not agree with its terms, please do not use our website or Services.

2. Scope and Who This Policy Applies To

This Policy applies to:

Prospective, current, and former clients of DnD Media;
Authorised users of client accounts (e.g., marketing managers, business owners) who access our platforms or dashboards;
Visitors to our corporate website(s);
End-users/consumers whose data reaches us indirectly through client advertising accounts (e.g., Google Ads, Meta Ads audience or conversion data), where our client is the APP entity that originally collected that data and we act as its service provider.

Where we handle a client’s own customers’ data on that client’s behalf (for example, conversion data synced from a client’s CRM into an ad platform), a separate agreement or Data Processing Terms govern that relationship, and the client remains responsible under the Privacy Act as the entity that originally collected the data. This Policy applies to our own handling of client and platform-user personal information as an APP entity in our own right.

3. Data We Collect

3.1 Information You Provide Directly

Identity and contact details (name, business name, email, phone, billing address)
Account credentials and authentication data
Business information (industry, target audience, budget, marketing goals, brand assets, logos, ad copy)
Payment and billing information
Communications with us (support tickets, emails, call recordings, chat transcripts)
Prompts, inputs, and uploads submitted to AI-assisted tools (e.g., ad copy generation requests, SEO content briefs, campaign strategy questions, uploaded documents, images, or datasets)

3.2 Information Collected Automatically

Device and browser data, IP address, log files, cookies and similar technologies (see Section 9)
Platform usage and interaction data (features used, session duration, click paths)
Behavioural analytics used to improve our services and personalise reporting

3.3 Information from Connected Third-Party Platforms

Where you authorise us to connect your accounts, we may receive data from:

Google Ads, Google Analytics, Google Search Console, Google Business Profile
Meta Ads Manager, Meta Business Suite
Other ad networks, CRMs, e-commerce platforms, or analytics tools you connect

This may include campaign performance metrics, audience segments (aggregated/pseudonymised where provided by the platform), conversion events, and ad account structure data.

3.4 Sensitive Information

We do not intentionally collect sensitive information and ask that you do not submit it into prompts, uploads, or campaign targeting instructions unless it is strictly necessary and you have your own lawful basis to provide it to us. Where sensitive information is submitted to us, we will only collect, use, or disclose it with your consent, or as otherwise permitted by law.

4. How We Use Your Data

We use collected data to:

Deliver, operate, and improve the Services (campaign builds, SEO, content, reporting)

Generate ad copy, keyword strategies, content, and reports using AI-assisted tools (see Section 5)
Communicate with you regarding account status, support, and billing
Conduct internal analytics to improve service quality
Comply with legal, tax, and regulatory obligations
Detect, prevent, and investigate fraud, security incidents, or misuse
With your consent, or where otherwise permitted, send you direct marketing about our own Services

Under APPs 3 and 6, we only collect personal information that is reasonably necessary for our functions and activities, and we only use or disclose it for the primary purpose it was collected for, or a related secondary purpose you would reasonably expect — or otherwise with your consent or as authorised by law.

5. AI and LLM Data Processing

5.1 How AI Is Used

We use internal and third-party AI/LLM systems to support:

Ad copy, headline, and creative generation (Google Ads, Meta Ads)
SEO content drafting, keyword clustering, and content briefs
Campaign performance analysis and automated reporting narratives
Internal support and strategy assistance

When you submit a prompt, upload, or instruction to any AI-assisted feature, that content — along with relevant account and campaign context — is transmitted to the AI system processing your request.

5.2 What Is Processed

AI systems may process:

Text prompts and instructions you provide
Uploaded documents, briefs, images, or brand assets
Relevant campaign metadata needed for context
Interaction signals used to refine suggestions

5.3 Human Oversight

AI-generated outputs are treated as drafts and are reviewed by our team before being deployed live on your ad accounts or published, unless you have explicitly enabled a fully automated workflow.

6. Model Training: Opt-Out and Opt-In Rights

6.1 Our Default Position

By default, your prompts, uploads, campaign data, and usage data are not used to train, fine-tune, or align any AI model beyond the single session/request in which they are submitted.

6.2 Where Training Use May Occur

We may use de-identified, aggregated, or synthetic data derived from platform usage to improve our internal AI features, but only where such data cannot reasonably be used to re-identify you or your business.

If we ever introduce a feature allowing raw client content to be used for model improvement, it will be opt-in only (or clear opt-out) and never a condition of accessing core services.

6.3 How to Exercise Your Opt-Out

You may opt out of any AI-training-related data use at any time by emailing hello@dndmedia.com.au. Opting out will never disable or limit your access to core AI-assisted features.

7. Third-Party AI Sub-Processors, Infrastructure Providers, and Cross-Border Disclosure

We rely on third-party providers for AI features, cloud infrastructure, ad platform APIs, and analytics. Where we transmit client data to third-party AI providers, we do so under enterprise or business-tier agreements that contractually restrict the use of submitted data for training the provider’s foundation models and limit retention.

Before disclosing personal information to an overseas recipient, we take reasonable steps under APP 8 to ensure the recipient does not breach the APPs in relation to that information.

8. Automated Decision-Making and Profiling

Certain features may involve AI-assisted recommendations (e.g., bid/budget suggestions, audience targeting ideas, performance anomaly alerts). These are designed to surface recommendations for human review. You may request an explanation, human review, or correction of any automated recommendation by contacting hello@dndmedia.com.au.

9. Cookies, Tracking Technologies, and Direct Marketing

We use cookies and similar technologies for necessary functionality, analytics, and (where applicable) our own marketing. You can manage cookie preferences via your browser settings.

Where we send commercial electronic messages about our own Services, we comply with the Spam Act 2003 (Cth). You can unsubscribe at any time via the link in the message or by emailing hello@dndmedia.com.au.

10. Synthetic Data, De-Identification, and Anonymisation

Where we generate aggregated benchmarks or synthetic datasets, we apply de-identification techniques designed to prevent re-identification. De-identified information is only treated as no longer personal information where it cannot reasonably be used to re-identify an individual.

11. How We Share Your Data

We share personal data with:

Service providers (hosting, AI infrastructure, payment processing, analytics)
Ad platforms (Google, Meta, etc.) as necessary to run your campaigns under your authorisation
Professional advisors under confidentiality obligations
In connection with a business transfer, subject to continuity-of-protection commitments
Where required by law

We do not sell personal information.

12. Data Retention

Account and billing records — Duration of relationship + 7 years

AI prompts/uploads — 30–90 days unless needed for support or dispute
Campaign performance data — Duration of relationship + 24 months
Marketing communication data — Until unsubscribe or 24 months of inactivity
De-identified/aggregated data — Retained as long as it remains non-identifiable

We take reasonable steps to destroy or de-identify personal information once it is no longer needed, subject to legal retention obligations.

13. Your Privacy Rights

13.1 Australian Privacy Act Rights

You have the right to request access to, and correction of, the personal information we hold about you, and to lodge a complaint with us or the OAIC.

13.2 EU/UK GDPR Rights

If you are located in the EEA/UK, you have the right to access, rectify, erase, restrict or object to processing, data portability, and to withdraw consent.

13.3 US State Privacy Rights

Depending on your state of residence, you may have rights to know, delete, correct, opt out of sale/sharing, and non-discrimination.

13.4 How to Exercise Your Rights

Submit requests by emailing hello@dndmedia.com.au. We will verify your identity and respond within the timeframe required by applicable law.

14. Data Security and Notifiable Data Breaches

We implement administrative, technical, and physical safeguards appropriate to the sensitivity of the data. If we experience an eligible data breach under the Notifiable Data Breaches scheme, we will notify the OAIC and affected individuals as required by law.

15. Children’s Privacy

Our Services are intended for business use by individuals aged 18 or older. We do not knowingly collect personal information from children.

16. International Data Transfers

Where personal data is transferred outside Australia, we comply with APP 8 and take reasonable steps to ensure appropriate protections are in place.

17. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified via email or a prominent notice on our website, with an updated “Last Updated” date.

18. Contact Us and How to Complain

DnD Media

Email: hello@dndmedia.com.au

If you wish to make a complaint about how we have handled your personal information, please contact us using the details above. We will acknowledge your complaint and aim to resolve it within a reasonable period (ordinarily 30 days).

If you are not satisfied with our response, you may lodge a complaint with:

The Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au
Your local EU/UK Data Protection Authority, if the GDPR/UK GDPR applies
Your relevant state regulator, if a US state privacy law applies

DnD Media – Privacy Policy