Privacy Policy | Access One

Who we are

Access One is a healthcare Google Ads agency based in Dubai, United Arab Emirates, operating the website at axcads.com. In this policy, "we", "us" and "our" mean Access One. We are the data controller for personal data collected through this website.

If you want to talk to us about anything in this policy, email growth@axcads.com or use the contact form.

Access One also develops and operates Access Ads API, an application that connects to the Google Ads API. If you are here because of that application, the section immediately below covers it in full.

Access One is the trading name used by Access Advertising LLC, which also trades as Access Marketing, registered at Sharjah Media City, Sharjah, United Arab Emirates. That company is the legal entity behind this website and the data controller referred to throughout this policy.

We also operate a Meta business application named AccessOne Ads Master, used to manage advertising on Facebook and Instagram for our clients. The section headed Meta advertising data covers that application in full, and Data deletion instructions explains how to have data removed.

Access Ads API, our Google Ads application

Access One develops and operates an application named Access Ads API, which connects to the Google Ads API. This section explains exactly what Google user data that application accesses, how it uses it, who it is shared with, how it is protected, and how long it is kept. It applies specifically to the application. The rest of this policy applies to the axcads.com website.

The application is developed and operated by Access One, Dubai, United Arab Emirates. There is no other developer or parent organisation involved.

What Google user data the application accesses

When you connect your Google account to Access Ads API, you are shown a Google consent screen listing the permissions being requested. If you approve, the application accesses only the following:

Your Google Ads accounts, through the Google Ads API scope https://www.googleapis.com/auth/adwords. This covers the Google Ads accounts and manager accounts your Google login is authorised to see.
Campaign configuration and performance data from those accounts: campaigns, ad groups, keywords, ads, assets, budgets, bidding settings, conversion actions, and the reporting metrics attached to them such as impressions, clicks, cost, conversions and conversion value.
Basic account identifiers: the Google Ads customer ID, account name, currency and time zone, so we can tell your accounts apart.
Your basic Google profile: the email address and name attached to the Google account you used to sign in, so we know who authorised the connection.

The application does not access Gmail, Google Drive, Calendar, Contacts, Photos, or any other Google Workspace service. It does not read your email. It does not access any Google account data beyond what is listed above.

How the application uses that data

To read the structure and performance of the Google Ads accounts you have authorised, so we can report on them.
To create, edit, pause and optimise campaigns, ad groups, keywords, ads and budgets in those accounts, where you have engaged us to manage them.
To upload offline conversions you send us, so that Smart Bidding can optimise against real bookings rather than form fills.
To build the performance reports and dashboards we provide to you.

That is the entire list. Google user data is used only to provide and improve these user-facing features.

What the application will never do with that data

Access One's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not and will not:

Sell Google user data, or provide it to data brokers or information resellers.
Use it for targeted, personalised, retargeted or interest-based advertising of our own.
Use it to determine credit-worthiness or for lending purposes.
Use it to build or sell databases.
Use it to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models. We do not feed Google user data into any AI or ML model.
Transfer it to any third party for any of the purposes above.
Allow humans to read it, except where you have explicitly asked us to for support, where it is necessary for security or to comply with the law, or where the data has been aggregated and anonymised.

Who the application shares Google user data with

We do not transfer or disclose Google user data to third parties for any purpose other than delivering the service you asked for. It is accessible only to the Access One team members working on your account, and to the hosting provider that stores it on our behalf. It is never shared with advertisers, never sold, and never passed to another client.

How the application protects Google user data

All data is transmitted over encrypted HTTPS connections.
OAuth tokens are stored encrypted and are never exposed in the application interface, in logs or in URLs.
We never ask for or store your Google account password. Authentication happens entirely on Google's own consent screen.
Access is restricted to named Access One team members who need it for your account, protected by individual credentials.
Administrative areas are not publicly listed and are access-controlled.
We request the minimum scopes the application needs to function, and nothing beyond them.

How long the application keeps it, and how to delete it

OAuth tokens are kept only while your connection is active. Revoke access and they are deleted within 7 days.
Campaign and performance data is retained for the duration of our engagement and for 12 months afterwards, so historical reporting stays available to you. After that it is deleted.
Account identifiers and your Google profile email are deleted when the connection is removed and the retention period above has passed.

You can disconnect at any time, either from within the application or by removing Access Ads API from your Google account permissions. Revoking access immediately stops any further data being accessed. To have everything already held deleted, email growth@axcads.com with "Delete my Google data" in the subject line. We action deletion within 30 days and confirm in writing when it is done. You do not need to give a reason.

Meta advertising data (AccessOne Ads Master)

We operate a business application named AccessOne Ads Master, connected to Meta Platforms. We use it to run advertising on Facebook and Instagram on behalf of our clients. This section explains what that application accesses, why, who it is shared with and how long it is kept. It applies specifically to Meta Platform Data. The rest of this policy applies to the axcads.com website.

Whose data we access

We only access assets that a client has explicitly authorised us to manage, through Meta Business Manager. A client grants that access themselves and can withdraw it themselves at any time. We never access an account we have not been given a permission for.

What the application accesses

Ad account campaign settings. Campaign, ad set and ad configuration for the accounts we manage.
Ad performance statistics. Spend, reach, impressions, clicks, results and the related reporting metrics.
Audience settings. Targeting configuration and audience definitions used by the client's campaigns.
Lead forms and leads. The instant forms attached to a client's ads, and the leads submitted through them.
Basic Page and Instagram account information. The profile details needed to run and attribute the advertising.

What we use it for

Meta Platform Data is used for one purpose only: to create, manage, optimise and report on advertising for the client who owns the account it came from. We do not use it to build our own audiences, to profile individuals, to train models, or for any purpose unrelated to that client's advertising.

Who we share it with

We do not sell Meta Platform Data and we do not share it with third parties, with three exceptions:

The client who owns it. The advertiser whose account the data came from.
Service providers under confidentiality. Only where needed to deliver the service, and only under a confidentiality obligation.
Where the law requires it. A binding request from a UAE authority or court.

How long we keep it

When a client ends its engagement with us, or removes our access from Meta Business Settings, we stop accessing that client's Meta assets immediately. We delete the related Meta Platform Data we hold within 30 days, unless we are legally required to keep it for longer.

How it is protected

Access is restricted to the team members working on that client's account. The application connects only through official Meta tools and the permissions the client has granted, never through scraping, shared logins or unofficial access. Permissions are reviewed when an engagement ends. The measures described under Security below apply to Meta Platform Data as well.

What we collect

Information you give us

Enquiry and audit forms. When you use the contact form or another enquiry form on this site, we collect your name, business name, business type, email address, phone number, website address and whatever you write in the message field.
Job applications. When you apply through careers, we collect your name, email address, phone number, your answers to the screening questions, and the CV file you upload. CVs are accepted as PDF, DOC or DOCX.
Talent registrations. If you register with our healthcare talent service, we collect your contact details, professional background, licensing status and your CV.
Downloads. If you request a guide or handbook, we collect the name and email address you provide.
Leads from ads and WhatsApp. If you submit a form through an advertisement we run on Facebook or Instagram, or message us on WhatsApp on +971 50 272 0550, we collect your name, phone number, email address, business name and your answers to the form questions. We use this only to respond to your enquiry. Where the advertisement was run for a client of ours, the lead belongs to that client and is passed to them.

Only give us what is needed. Please do not include medical information, identification document scans, salary details or anything else sensitive in a free-text message field.

Information collected automatically

Analytics. We use Google Analytics 4 to understand how the site is used: pages viewed, time on page, approximate location, device and browser type, and the source that brought you here. This is collected through cookies and similar technologies.
Server logs. Our hosting provider records IP addresses, request times, pages requested and error responses. These are used for security and troubleshooting.

Why we use it

To reply to your enquiry and prepare a proposal or audit.
To assess job applications and contact candidates.
To match registered healthcare professionals with hiring clinics, where you have asked us to.
To send you the material you specifically requested.
To measure how the website performs and improve it.
To keep the site secure and prevent abuse.
To meet our legal and accounting obligations.

We do not sell personal data. We do not share your details with advertisers. We do not send marketing to people who only enquired about a service, unless they asked to hear from us.

Legal basis

Where UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data applies, we process personal data on the basis of your consent, the performance of a contract or steps taken at your request before entering one, and our legitimate interests in operating and securing the website. Where the EU or UK GDPR applies to a visitor, we rely on the equivalent bases under those regulations.

Cookies and analytics

This website uses cookies for two purposes: keeping the site working correctly, and measuring traffic through Google Analytics 4. Analytics cookies tell us which pages are read, how people arrive and where they leave, in aggregate.

You can block or delete cookies in your browser settings. Blocking analytics cookies will not stop you using any part of this site. You can also install the Google Analytics opt-out browser add-on.

If we later run advertising or remarketing tags on this website, this section will be updated before those tags go live.

Who we share it with

We share personal data only with the service providers we need to run the business, and only for the purpose described:

Google. Website analytics.
Our hosting provider. Storage of the website and any files submitted through it.
Our email provider. Delivery of enquiry and application notifications to our inboxes.
Hiring clinics. Only for candidates who have registered with Access Medical Talent, our healthcare talent service, and only with that candidate's agreement. We tell you before we introduce you to anyone. Job applications made to Access One itself are never shared outside Access One.

We may also disclose personal data where we are legally required to by a UAE authority or court.

Where your data is stored

Form submissions, uploaded CVs and application records are stored on our web hosting infrastructure. Analytics data is processed by Google on its own infrastructure, which may sit outside the UAE. Where personal data is transferred outside the UAE, we rely on the transfer mechanisms permitted under the applicable data protection law and on the contractual protections offered by those providers.

How long we keep it

Enquiries and audit requests. Up to 24 months from the last contact, then deleted.
Job applications and CVs. Up to 12 months from the application date, so we can consider you for other roles. Tell us at any time and we will delete them sooner.
Talent registrations. Two years from your last contact with us, unless you ask us to delete sooner or to keep it longer.
Client records. Kept for the duration of the engagement and for as long afterwards as UAE accounting and tax rules require.
Meta Platform Data. Kept only while we are actively managing the client's advertising. When the engagement ends or the client removes our access, we delete it within 30 days unless the law requires otherwise. See Meta advertising data.
Leads from ads. Passed to the client who owns the advertisement and retained by us for up to 12 months for reporting and dispute resolution, then deleted.
Analytics. Retained according to the retention period set in Google Analytics, currently 14 months.

Your rights

Subject to the conditions in the applicable law, you can ask us to:

Tell you what personal data we hold about you, and give you a copy.
Correct anything that is wrong or out of date.
Delete your data, including your CV.
Restrict or object to how we are using it.
Withdraw consent you previously gave, without affecting anything done before you withdrew it.
Receive your data in a portable format.

Email growth@axcads.com and we will respond within 30 days. We may need to confirm your identity first. If you are not satisfied with our response, you have the right to complain to the UAE Data Office.

These rights apply under UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and they cover personal data we hold through our Meta business application as well as data collected through this website. To exercise any of them, email growth@axcads.com or send a WhatsApp message to +971 50 272 0550. If your request is specifically to have data deleted, the Data deletion instructions below set out exactly what to send.

Security

The site is served over HTTPS. Access to form submissions, application records and uploaded CVs is restricted to the Access One team members who need it. Administrative areas of the site are not publicly listed and are access-controlled.

We maintain reasonable technical and organisational measures to protect personal data against unauthorised access, loss or disclosure. Access is granted on a need-to-use basis and removed when someone stops working on the relevant account. Advertising platforms are accessed only through official tools and the permissions the client has granted, never through shared logins or credentials belonging to a client.

No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will notify you and the relevant authority as required by law.

Access Medical Talent

Access Medical Talent is our healthcare recruitment service, operated by Access One. It has its own privacy notice covering what we collect from professionals and clinics, how consent to share a profile works, and what the service costs. That notice is the one that governs the talent service. This policy covers everything else, including cookies and analytics, legal basis, international transfers and how to complain, and it applies to the talent service as well.

For anything about a talent profile or CV, email talent@axcads.com. For everything else, email growth@axcads.com.

Other websites

This site links to other websites, including client sites, Google's Partner Directory and social platforms. We are not responsible for how those sites handle your data. Read their policies before submitting anything to them.

Data deletion instructions

To request deletion of your data, including any data obtained through our Meta application AccessOne Ads Master, email growth@axcads.com or send a WhatsApp message to +971 50 272 0550 with the subject "Data Deletion Request". Include your name and the phone number or email address you used, so we can find your record.

We will confirm receipt and complete the request within 30 days. You do not need to give a reason.

If you are a client of ours, you can also remove our access at any time from Meta Business Settings. Doing so immediately stops our application from accessing your assets. We then delete the related Meta Platform Data we hold within 30 days, as described under Meta advertising data.

For deletion of data connected to our Google Ads application, see the Access Ads API section above. For talent profiles and CVs, email talent@axcads.com.

Children

This website is intended for businesses and working professionals. We do not knowingly collect personal data from anyone under 18. If you believe a child has submitted data to us, email us and we will delete it.

Changes to this policy

We update this policy when our practices change or when the law requires it. The date at the top of this page shows when it was last changed. Material changes will be reflected here before they take effect.

The latest version of this policy is always the one published on this page, and the "Last updated" date shown at the top of the page always reflects the most recent change. We do not maintain a separate archive of earlier versions, so please check this page if you need the current terms.

Contact

Access One
Dubai, United Arab Emirates
Email: growth@axcads.com

Access Advertising LLC, trading as Access Marketing and as Access One
Sharjah Media City, Sharjah, United Arab Emirates
Phone and WhatsApp: +971 50 272 0550
Email: growth@axcads.com

For anything relating to your personal data, email growth@axcads.com with "Privacy" in the subject line and it will be routed to the person responsible for data protection at Access One. For talent profiles and CVs, use talent@axcads.com.