Privacy Statement
We know you care about your privacy and security, so we treat your information with the highest standards of confidentiality and security.
We are committed to protecting your privacy. We will only use the information that we hold about you lawfully, in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), applicable changes introduced by the Data (Use and Access) Act 2025, and any other applicable regulatory requirements.
We do not seek to collect or process special category personal data. If we become aware that such data has been provided to us, we will handle it in accordance with data protection law and, where appropriate, delete or suppress it.
We take reasonable steps to support the accuracy of the personal data we hold, including validation, suppression, and industry-standard cleansing processes. However, as a significant proportion of the data we process is received from third party sources, we are unable to guarantee the accuracy of all data at the point of receipt. If you believe any information we hold about you is inaccurate, please contact us at compliance@auramediagroup.co.uk or writing to us at: DPO, Aura Media Group Limited, Ground Floor, Suite F, Breakspear Park, Breakspear Way, Hemel Hempstead, HP2 4TZ, and we will endeavour to correct it.
Introduction
Aura Media Group Limited ("Aura Media Group" or "we"), company registration 11239047, registered in England and Wales. Registered office: Aura Media Group Ltd, c/o RSZ Accountancy Limited, Archdeacons House, Ipswich, Suffolk, IP1 3BX.
Aura Media Group is registered as a data controller with the Information Commissioner's Office (ICO) in the United Kingdom, registration number ZA324659. We seek to comply with the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and applicable changes introduced by the Data (Use and Access) Act 2025.
Aura Media Group operates as a data marketing agency. We receive consumer data from a range of sources and supply it to clients for use in their direct marketing activities. We also operate a number of consumer-facing brands and websites through which we may collect data directly. In all cases, we act as a data controller in respect of our own processing activities. Our clients are also independent data controllers in respect of their own use of the data we supply.
Our consumer-facing brands include:
- YourOffers.co.uk
- Switchyourprovider.co.uk
- Lovelifeinsurance.co.uk
- Familycomesfirst.co.uk
- Investinyourfamily.co.uk
- Compensationgenie.com
- Warrantywizards.co.uk
- PCPSearch.com
Each brand operates its own privacy policy covering the specific processing activities carried out under that brand. Where you have registered directly with one of these sites, please refer to that site's privacy policy for full details. This policy covers Aura Media Group's overarching data processing activities across all data flows.
Aura Media Group maintains a compliance framework for the sourcing of personal data. This includes due diligence processes, data protection assessments, and quality checks designed to support the fair and lawful collection of data by our sources. The depth and nature of these checks may vary depending on the source type, the client relationship, and the data being supplied.
How we receive your data — the four data flows
Aura Media Group receives personal data via four distinct routes. The route through which your data was received determines how it is processed and what transparency measures apply.
Flow 1 — Co-registration data
You registered with one of our co-registration partner websites — such as an online competition, prize draw, offers, lifestyle, or comparison site. That site's fair processing notice and privacy policy named Aura Media Group and/or YourOffers.co.uk as a data recipient. Your data includes an email address.
On receipt, we validate your name, telephone number, and email address. We then send a transparency email to you within 24 hours, notifying you that your data has been received, explaining how it will be used, and giving you a clear opportunity to opt out before any marketing contact is made. If you do not opt out, your data is added to the YourOffers.co.uk database and may be supplied to our third party clients for direct marketing by telephone or post.
For full details of processing under this flow, please refer to the YourOffers.co.uk privacy policy.
Flow 2 — Pass-through supply (no email address)
We receive your data from a partner source — which may include co-registration sites or list rental providers — but your email address is not included in the data provided. In this case, we are unable to send you a transparency email directly.
On receipt, we validate your data and pass it to the relevant third party client, typically within two working days. Your data does not enter the YourOffers.co.uk database.
Where Aura Media Group is named in the source's privacy policy or fair processing notice, that notice serves as the primary transparency disclosure for your data being shared with us. Where the processing relies on legitimate interests and individual notification would involve a disproportionate effort — given that you had access to a privacy policy at the point your data was collected, and that the end client will make further disclosures at point of contact — Aura Media Group relies on the exemption provided by Article 14(5)(b) UK GDPR from the requirement to notify you individually. This publicly available policy fulfils Aura Media Group's transparency obligation under that exemption. We maintain records of data source and destination should you wish to enquire.
Flow 3 — Telesurvey and list rental data
We receive data collected via telephone survey operators or through list rental arrangements. In these cases, the lawful basis for processing is legitimate interests — relied upon either by Aura Media Group, the data source, or the end client, depending on the arrangement. The same data sharing model applies as above, including the Article 14(5)(b) position on individual notification.
Flow 4 — Direct registration on an Aura Media Group website
You may have registered directly on one of Aura Media Group's own consumer-facing brand websites — for example through a social media campaign, organic search, or other direct channel. In this case, Aura Media Group is the primary data collector and the transparency obligation is discharged at point of registration through the relevant site's own privacy policy and fair processing notice.
Data collected directly through our own websites may be used for the purposes set out in the relevant brand's privacy policy, which will specify the lawful basis, the channels through which you may be contacted, and your rights. Each of our brand websites maintains its own privacy policy — please refer to it for full details.
In all cases, Aura Media Group retains a log of data received and supplied, together with suppression records where applicable, for a period of 24 months from the date of original receipt.
Why Aura Media Group processes personal data
We process personal data to enable us to fulfil our function as a data marketing agency — receiving consumer data from a range of sources and supplying it to clients for use in their direct marketing activities — and to operate our own consumer-facing brand websites.
Marketing communications you may receive will come from our third party clients and their brands. Those clients may contact consumers by telephone or post. Where PECR consent has been obtained at source for email or SMS marketing, clients may also use those channels — but only where that consent is held by the client and meets the standard required by PECR. Aura Media Group does not supply data for email or SMS marketing on the basis of legitimate interests alone.
Lawful basis for processing
UK GDPR requires us to have a lawful basis for each processing activity. The lawful basis Aura Media Group relies on across its processing activities is legitimate interests (Article 6(1)(f) UK GDPR), except where consent is obtained directly at point of registration on one of our own brand websites, in which case consent (Article 6(1)(a) UK GDPR) is the lawful basis for that processing.
We have carried out a Legitimate Interests Assessment (LIA) and are satisfied that our interests are not overridden by the individual's rights and freedoms. Factors supporting this conclusion include:
- Data being received from sources where Aura Media Group is named or described as a recipient in the fair processing notice, or where a legitimate interest basis is established by the source or end client.
- Our data validation step, which supports accuracy before further processing takes place.
- For co-registration data, our transparency email sent within 24 hours of receipt, providing a clear opportunity to opt out before marketing contact is made.
- For pass-through and telesurvey data, our reliance on Article 14(5)(b) UK GDPR where individual notification would involve disproportionate effort, with transparency discharged via this publicly available policy.
- Screening of data against the Telephone Preference Service (TPS) and Mailing Preference Service (MPS) where required or appropriate.
- A maximum retention period of 24 months from the date of original receipt.
Aura Media Group maintains records of its legitimate interests assessments, source due diligence checks, and data supply records to support its reliance on legitimate interests where applicable.
Consumers have the right to object to processing based on legitimate interests at any time. See the How to opt out section below.
For completeness, the six lawful bases available under UK GDPR are: consent, contract, legal obligation, vital interests, public task, and legitimate interests.
What type of personal information do we hold about you?
We hold personal information received from our co-registration data partners, telesurvey operators, list rental providers, or collected directly through our own brand websites. This may include, but is not limited to:
- Forename and surname
- Postal address
- Telephone number
- Email address (where provided by the source or collected directly)
- IP address and device type (where captured at point of collection)
- Age and gender (where provided)
- Lifestyle and demographic data provided as part of a survey or questionnaire
- Details of any complaint made
- Records of correspondence with us
We do not seek to process any data classified as special category or sensitive personal data under UK GDPR (such as racial or ethnic origin, political views, religious beliefs, health data, or sexual orientation). If we become aware that such data has been provided to us, we will handle it in accordance with data protection law and, where appropriate, delete or suppress it.
What do we use your data for?
Your data may be used by Aura Media Group, our clients, and their brands for the following purposes:
- Telemarketing — your telephone number may be made available to our clients for outbound telemarketing, subject to screening against the TPS and governed by agreed usage terms.
- Direct mail — your postal address may be made available to our clients for direct mail campaigns, subject to screening against the MPS and governed by agreed usage terms.
- Email and SMS marketing — only where PECR-compliant consent has been obtained at the point of data collection and is held by the client. Aura Media Group does not supply data for email or SMS marketing on the basis of legitimate interests alone.
- Verification and database enhancement — to help our clients keep their databases accurate.
- Segmentation and profiling — to provide relevant and targeted marketing by matching consumer profiles to appropriate offers and services.
- Data linking — data may be used to link offline data with online identifiers for targeting and identity resolution purposes.
- Identity verification and fraud prevention — to help our clients protect consumers and themselves from financial harm.
- Campaign performance analysis — see the Campaign performance data section below.
Campaign performance data
Aura Media Group receives campaign performance data back from clients following data supply. This data is used by Aura Media Group as a data controller in its own right — for quality assurance, source evaluation, and to inform targeting decisions for future campaigns.
This returned data typically includes outcome information against individual records — for example call outcomes, contact rates, or sales results. Where possible we ask clients to return data referenced by a unique record identifier (URN) rather than personal identifiers. However, clients may also return data containing name and telephone number. In all cases, data is shared securely.
The lawful basis for this processing is legitimate interests. Campaign performance data is not shared with any third party and is used solely for Aura Media Group's internal quality assurance and campaign planning purposes. It is subject to the same 24-month retention limit and security standards as all other data we hold.
QA framework
Aura Media Group operates a compliance framework for the sourcing and supply of personal data. This includes processes for assessing data sources, reviewing opt-in quality, and monitoring how data is used by clients post-supply. The scope and frequency of these activities may vary depending on the source, client, and campaign in question.
Where applicable, Aura Media Group works with data sources and clients to review findings and address any concerns identified. Clients and agency partners who purchase data are expected, where required, to be registered with the ICO and to use personal data in accordance with applicable data protection and direct marketing laws.
How long do we keep your personal data?
Unless we are requested or legally obliged to retain data for longer, we aim to delete personal data we process within 24 months of the date it was originally received.
Data may be retained in our suppression files beyond this period solely for compliance purposes — to ensure that opted-out records are not reintroduced to processing if received again from another source.
Campaign performance data returned by clients is subject to the same 24-month retention period. We keep records of complaints for three years.
Data protection and data security
Data protection law requires us to take appropriate measures to keep your personal data secure — protecting it against unauthorised or unlawful use, and against accidental loss, destruction, or damage.
We protect personal data through staff training, investment in technology, and handling and storage procedures appropriate to the nature of the data. We apply data encryption tools and have policies and contractual obligations in place designed to protect personal data from loss, damage, or unauthorised use. All data transfers are conducted over secure channels.
If you contact us, we will ask you to identify yourself before sharing any of your data with you.
International transfers
Most of your personal data is handled and stored within the UK, Channel Islands, and the Isle of Man. Where data is processed outside the UK or European Economic Area (EEA), we seek to satisfy ourselves that adequate safeguards are in place. Our suppliers are expected to incorporate appropriate technical and organisational measures to ensure data is transferred safely and in compliance with applicable law.
Your rights as a data subject
Data protection law gives you the following rights:
- The right to be informed — to be told how your data is used (this policy fulfils that obligation).
- The right of access — to request a copy of the personal data we hold about you (a Subject Access Request). We will respond within one calendar month and do not charge for a first request.
- The right to rectification — to ask us to correct inaccurate or incomplete data.
- The right to erasure — to ask us to delete your personal data in certain circumstances.
- The right to restrict processing — to ask us to limit how we use your data.
- The right to data portability — to receive your data in a structured, commonly used format.
- The right to object — to object to processing based on legitimate interests, including direct marketing. We will cease processing upon receipt of a valid objection to direct marketing.
- The right to withdraw consent — where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of prior processing.
- Rights relating to automated decision-making — to not be subject to solely automated decisions that produce legal or similarly significant effects.
To exercise any of your rights, please contact us using the details in the Contact us section below. If you are not satisfied with how we have handled your request, you have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk.
Data accuracy
Our approach to data accuracy is set out in the Privacy Statement above. If you believe any information we hold about you is inaccurate, out of date, or incomplete, please contact us using the details in the Contact us section and we will endeavour to correct it.
Contact us
If you have any questions, comments, or complaints about how we handle your personal data, please contact us:
- Email: compliance@auramediagroup.co.uk
- Telephone: 01442 345005
- Post: DPO, Aura Media Group Limited, Ground Floor, Suite F, Breakspear Park, Breakspear Way, Hemel Hempstead, HP2 4TZ
We aim to respond to all queries within 48 working hours of receipt.
How to opt out
If you have received marketing and would like to stop, or if you wish to object to your data being processed, please contact us using the details in the Contact us section above. You will receive a response within 48 working hours confirming your request has been received.
Upon receipt of your request, a member of our compliance team will, where applicable:
- Add your record to our internal suppression list, so that if your data is received again from another source it will not be passed to any client for marketing purposes.
- Contact any associated data source to request removal of your record from further onward sharing.
Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time by contacting us above or through the opt-out mechanism on the relevant brand website.
Right to erasure: You have the right to ask us to delete your personal data entirely. Please be aware that exercising this right means we would not retain a record of your opt-out preference, which could result in your data being processed again if received from a new source. If your primary aim is to stop receiving marketing, we recommend exercising your right to object rather than erasure, so that your suppression record is preserved.
Telephone Preference Service (TPS): To reduce unsolicited telemarketing from all organisations, register at www.tpsonline.org.uk. Aura Media Group screens telephone data against the TPS where required or appropriate.
Mailing Preference Service (MPS): To reduce unsolicited direct mail from all organisations, register at www.mpsonline.org.uk. Aura Media Group screens postal data against the MPS where required or appropriate.
Changes to this policy
We may amend this policy if the way we process your data, or the law relating to data protection, changes. The current version will always be available at this address.
This policy was last updated 9 June 2026.