Privacy Statement
We know you care about your privacy and security, so we treat your information with the highest standards of confidentiality and security.
We are committed to protecting your privacy. We will only use the information that we hold about you lawfully, in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), applicable changes introduced by the Data (Use and Access) Act 2025, and any other applicable regulatory requirements.
We do not seek to collect or process special category personal data. If we become aware that such data has been provided to us, we will handle it in accordance with data protection law and, where appropriate, delete or suppress it.
We take reasonable steps to support the accuracy of the personal data we hold, including validation, suppression, and industry-standard cleansing processes. However, as a significant proportion of the data we process is received from third party sources, we are unable to guarantee the accuracy of all data at the point of receipt. If you believe any information we hold about you is inaccurate, please contact us at compliance@auramediagroup.co.uk or writing to us at: Data Protection & Compliance Team, Aura Media Group Limited, Ground Floor, Suite F, Breakspear Park, Breakspear Way, Hemel Hempstead, HP2 4TZ, and we will endeavour to correct it.
Introduction
Aura Media Group Limited ("Aura Media Group" or "we"), company registration 11239047, registered in England and Wales. Registered office: Aura Media Group Ltd, c/o RSZ Accountancy Limited, Archdeacons House, Ipswich, Suffolk, IP1 3BX.
Aura Media Group is registered as a data controller with the Information Commission's Office (ICO) in the United Kingdom, registration number ZA324659. We seek to comply with the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and applicable changes introduced by the Data (Use and Access) Act 2025.
Aura Media Group operates as a data marketing agency. We receive consumer data from a range of sources and supply it to clients for use in their direct marketing activities. We also operate a number of consumer-facing brands and websites through which we may collect data directly. In all cases, we act as a data controller in respect of our own processing activities. Our clients are also independent data controllers in respect of their own use of the data we supply.
Our consumer-facing brands include:
- YourOffers.co.uk
- Switchyourprovider.co.uk
- Lovelifeinsurance.co.uk
- Familycomesfirst.co.uk
- Investinyourfamily.co.uk
- Compensationgenie.com
- Warrantywizards.co.uk
- PCPSearch.com
Each brand operates its own privacy policy covering the specific processing activities carried out under that brand. Where you have registered directly with one of these sites, please refer to that site's privacy policy for full details. This policy covers Aura Media Group's overarching data processing activities across all four routes described below.
Aura Media Group maintains a compliance framework for the sourcing of personal data. This includes due diligence processes, data protection assessments, and quality checks designed to support the fair and lawful collection of data by our sources. The depth and nature of these checks may vary depending on the source type, the client relationship, and the data being supplied.
How we receive your personal information
We receive personal information through the routes described below. One or more of these routes may apply to you, depending on how your information was collected and shared with us. The applicable route determines how we process your information and provide privacy information.
Route 1 — Registration through a partner website
You may have registered with one of our partner websites, such as an online competition, prize draw, offers, lifestyle or comparison site. This is sometimes called co-registration: registering on a partner website that shares your information with other organisations, as explained in its privacy information. Under this route, the website's privacy policy and fair processing notice identify Aura Media Group and/or YourOffers.co.uk as a recipient, and the information supplied to us includes your email address.
On receipt, we validate your name, telephone number and email address. We send you a transparency email within 24 hours of receiving your information. The email tells you that we have received your information, explains how it will be used and gives you a clear opportunity to opt out.
If you do not opt out, your data may be added to the YourOffers.co.uk database and may subsequently be shared with our third-party clients for direct marketing by telephone or post.
For full details of processing under this route, please refer to the YourOffers.co.uk privacy policy.
Route 2 — Data supplied without an email address
We may have received your personal information from a partner source, such as a partner website or list rental provider, without an email address being included. Under this route, we receive and validate the information, then pass it directly to the client using it. Your information may be added to the YourOffers.co.uk database.
Both Aura Media Group and the receiving client are named at the point your information is collected. As no email address is supplied to us, we cannot send you a transparency email.
Where providing individual privacy information would involve disproportionate effort, we rely on the exemption in Article 14(5)(b) UK GDPR. We have documented our assessment supporting reliance on this exemption for this route. We make information about our processing publicly available through this privacy policy and maintain records of the source and recipient of your information. You can contact us to ask where your information came from and who we supplied it to.
Route 3 — Telephone surveys and rented marketing lists
We may have received your personal information through a telephone survey operator or a list rental arrangement.
This route describes where your information originated. If it is supplied to us without an email address and passed directly to a client, the process described in Route 2 also applies.
Route 4 — Registration on one of our own websites
You may have registered directly on one of Aura Media Group's own consumer-facing brand websites — for example through a social media campaign, organic search, or other direct channel. In this case, Aura Media Group is the primary data collector and the transparency obligation is discharged at point of registration through the relevant site's own privacy policy and fair processing notice.
Data collected directly through our own websites may be used for the purposes set out in the relevant brand's privacy policy, which will specify the lawful basis, the channels through which you may be contacted, and your rights. Each of our brand websites maintains its own privacy policy — please refer to it for full details.
We retain personal information received and supplied under these routes only for as long as reasonably necessary for the purposes for which it was collected or received. Our approach is explained in How long we keep your personal data?.
Why Aura Media Group processes personal data
We process personal data to enable us to fulfil our function as a data marketing agency — receiving consumer data from a range of sources and supplying it to clients for use in their direct marketing activities — and to operate our own consumer-facing brand websites.
Marketing communications you may receive will come from our third party clients and their brands. Those clients may contact consumers by telephone or post. Where PECR consent has been obtained at source for email or SMS marketing, clients may also use those channels — but only where that consent is held by the client and meets the standard required by PECR. Aura Media Group does not supply data for email or SMS marketing on the basis of legitimate interests alone.
Lawful basis for processing
UK GDPR requires us to have a lawful basis for each processing activity. Aura Media Group generally relies on legitimate interests (Article 6(1)(f) UK GDPR) for its own receipt, validation, supply and quality-assurance processing. Where consent is obtained directly at the point of registration on one of our own brand websites, consent (Article 6(1)(a) UK GDPR) may be the lawful basis for the processing described in that brand's privacy information. We assess the lawful basis for Aura Media Group's own processing; a lawful basis relied on by a source or client does not automatically establish ours.
We have carried out a Legitimate Interests Assessment (LIA) and are satisfied that our interests are not overridden by the individual's rights and freedoms. Factors supporting this conclusion include:
- Data being received from sources where Aura Media Group is named or described as a recipient in the fair processing notice.
- Our data validation step, which supports accuracy before further processing takes place.
- For Route 1 data, our transparency email sent within 24 hours of receipt, providing a clear opportunity to opt out.
- For Route 2 data, our documented assessment supporting reliance on Article 14(5)(b) UK GDPR where providing individual privacy information would involve disproportionate effort, together with the measures described in Route 2 above.
- Screening of data against the Telephone Preference Service (TPS) and Mailing Preference Service (MPS) where required or appropriate.
- Our documented retention schedule and regular review of whether personal information is still required.
Aura Media Group maintains records of its legitimate interests assessments, source due diligence checks, and data supply records to support its reliance on legitimate interests where applicable.
Consumers have the right to object to processing based on legitimate interests at any time. See the How to opt out section below.
For completeness, the six lawful bases available under UK GDPR are: consent, contract, legal obligation, vital interests, public task, and legitimate interests.
What type of personal information do we hold about you?
We hold personal information received through partner registrations, telephone survey operators, rented marketing lists, or collected directly through our own brand websites. This may include, but is not limited to:
- Forename and surname
- Postal address
- Telephone number
- Email address (where provided by the source or collected directly)
- IP address and device type (where captured at point of collection)
- Age and gender (where provided)
- Lifestyle and demographic data provided as part of a survey or questionnaire
- Details of any complaint made
- Records of correspondence with us
We do not seek to process any data classified as special category or sensitive personal data under UK GDPR (such as racial or ethnic origin, political views, religious beliefs, health data, or sexual orientation). If we become aware that such data has been provided to us, we will handle it in accordance with data protection law and, where appropriate, delete or suppress it.
What do we use your data for?
Your data may be used by Aura Media Group, our clients, and their brands for the following purposes:
- Telemarketing — your telephone number may be made available to our clients for outbound telemarketing, subject to screening against the TPS and governed by agreed usage terms.
- Direct mail — your postal address may be made available to our clients for direct mail campaigns, subject to screening against the MPS and governed by agreed usage terms.
- Email and SMS marketing — only where PECR-compliant consent has been obtained at the point of data collection and is held by the client. Aura Media Group does not supply data for email or SMS marketing on the basis of legitimate interests alone.
- Verification and database enhancement — to help our clients keep their databases accurate.
- Segmentation and profiling — to provide relevant and targeted marketing by matching consumer profiles to appropriate offers and services.
- Data linking — data may be used to link offline data with online identifiers for targeting and identity resolution purposes.
- Identity verification and fraud prevention — to help our clients protect consumers and themselves from financial harm.
- Campaign performance analysis — see the Campaign performance data section below.
Campaign performance data
Aura Media Group receives campaign performance data back from clients following data supply. This data is used by Aura Media Group as a data controller in its own right — for quality assurance, source evaluation, and to inform targeting decisions for future campaigns.
This returned data typically includes outcome information against individual records — for example call outcomes, contact rates, or sales results. Where possible we ask clients to return data referenced by a unique record identifier (URN) rather than personal identifiers. However, clients may also return data containing name and telephone number. In all cases, data is shared securely.
The lawful basis for this processing is legitimate interests. Campaign performance data is not shared with any third party and is used solely for Aura Media Group's internal quality assurance and campaign planning purposes. It is retained in accordance with our documented retention schedule and is subject to the same security standards as other personal information we hold.
QA framework
Aura Media Group operates a compliance framework for the sourcing and supply of personal data. This includes processes for assessing data sources, reviewing opt-in quality, and monitoring how data is used by clients post-supply. The scope and frequency of these activities may vary depending on the source, client, and campaign in question.
Where applicable, Aura Media Group works with data sources and clients to review findings and address any concerns identified. Clients and agency partners who purchase data are expected, where required, to be registered with the ICO and to use personal data in accordance with applicable data protection and direct marketing laws.
How long do we keep your personal data?
We retain personal information only for as long as reasonably necessary for the purposes for which we collected or received it, including meeting legal, regulatory and reporting requirements.
When deciding how long to retain personal information, we consider its amount, nature and sensitivity; the potential risk of harm from unauthorised use or disclosure; the purposes for which we process it; whether those purposes can be achieved in another way; and any applicable legal or regulatory requirements.
We may retain relevant information for longer where reasonably necessary to respond to a complaint or regulatory enquiry, or to establish, exercise or defend a legal claim.
We maintain a documented retention schedule covering the different categories of personal information we process and review whether information is still required. When it is no longer needed, we delete or anonymise it securely.
We may retain a minimal suppression record for longer where necessary to respect an objection to direct marketing and prevent information from being reintroduced into our marketing processes.
Data protection and data security
Data protection law requires us to take appropriate measures to keep your personal data secure — protecting it against unauthorised or unlawful use, and against accidental loss, destruction, or damage.
We protect personal data through staff training, investment in technology, and handling and storage procedures appropriate to the nature of the data. We apply data encryption tools and have policies and contractual obligations in place designed to protect personal data from loss, damage, or unauthorised use. All data transfers are conducted over secure channels.
If you contact us, we will ask you to identify yourself before sharing any of your data with you.
International transfers
Most of your personal data is handled and stored within the UK, Channel Islands, and the Isle of Man. Where data is processed outside the UK or European Economic Area (EEA), we seek to satisfy ourselves that adequate safeguards are in place. Our suppliers are expected to incorporate appropriate technical and organisational measures to ensure data is transferred safely and in compliance with applicable law.
Your rights as a data subject
Data protection law gives you the following rights:
- The right to be informed — to be told how your data is used (this policy fulfils that obligation).
- The right of access — to request a copy of the personal data we hold about you (a Subject Access Request). We will respond within one calendar month and do not charge for a first request.
- The right to rectification — to ask us to correct inaccurate or incomplete data.
- The right to erasure — to ask us to delete your personal data in certain circumstances.
- The right to restrict processing — to ask us to limit how we use your data.
- The right to data portability — to receive your data in a structured, commonly used format.
- The right to object — to object to processing based on legitimate interests, including direct marketing. We will cease processing upon receipt of a valid objection to direct marketing.
- The right to withdraw consent — where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of prior processing.
- Rights relating to automated decision-making — to not be subject to solely automated decisions that produce legal or similarly significant effects.
To exercise any of your rights, please contact us using the details in the Contact us section below. If you are not satisfied with how we have handled your request, you have the right to lodge a complaint with the Information Commission's Office (ICO) at ico.org.uk/make-a-complaint.
Data accuracy
Our approach to data accuracy is set out in the Privacy Statement above. If you believe any information we hold about you is inaccurate, out of date, or incomplete, please contact us using the details in the Contact us section and we will endeavour to correct it.
Contact us
If you have any questions, comments, or complaints about how we handle your personal data, please contact us:
- Email: compliance@auramediagroup.co.uk
- Telephone: 01442 345005
- Post: Data Protection & Compliance Team, Aura Media Group Limited, Ground Floor, Suite F, Breakspear Park, Breakspear Way, Hemel Hempstead, HP2 4TZ
We aim to respond to all queries within 48 working hours of receipt.
How to opt out
If you have received marketing and would like to stop, or if you wish to object to your data being processed, please contact us using the details in the Contact us section above. You will receive a response within 48 working hours confirming your request has been received.
Upon receipt of your request, a member of our compliance team will, where applicable:
- Add your record to our internal suppression list, so that if your data is received again from another source it will not be passed to any client for marketing purposes.
- Contact any associated data source to request removal of your record from further onward sharing.
Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time by contacting us above or through the opt-out mechanism on the relevant brand website.
Right to erasure: You can ask us to delete your personal information. This right applies in certain circumstances. Where appropriate, we may retain a minimal suppression record solely to ensure that we respect your objection to direct marketing and do not reintroduce your details into our marketing processes.
Telephone Preference Service (TPS): To reduce unsolicited telemarketing from all organisations, register at www.tpsonline.org.uk. Aura Media Group screens telephone data against the TPS where required or appropriate.
Mailing Preference Service (MPS): To reduce unsolicited direct mail from all organisations, register at www.mpsonline.org.uk. Aura Media Group screens postal data against the MPS where required or appropriate.
Changes to this policy
We may amend this policy if the way we process your data, or the law relating to data protection, changes. The current version will always be available at this address.
This policy was last updated 27 October 2026.