Privacy Policy | Access One

Who we are

Access One is a healthcare Google Ads agency based in Dubai, United Arab Emirates, operating the website at axcads.com. In this policy, "we", "us" and "our" mean Access One. We are the data controller for personal data collected through this website.

If you want to talk to us about anything in this policy, email growth@axcads.com or use the contact form.

Access One also develops and operates Access Ads API, an application that connects to the Google Ads API. If you are here because of that application, the section immediately below covers it in full.

Access Ads API, our Google Ads application

Access One develops and operates an application named Access Ads API, which connects to the Google Ads API. This section explains exactly what Google user data that application accesses, how it uses it, who it is shared with, how it is protected, and how long it is kept. It applies specifically to the application. The rest of this policy applies to the axcads.com website.

The application is developed and operated by Access One, Dubai, United Arab Emirates. There is no other developer or parent organisation involved.

What Google user data the application accesses

When you connect your Google account to Access Ads API, you are shown a Google consent screen listing the permissions being requested. If you approve, the application accesses only the following:

Your Google Ads accounts, through the Google Ads API scope https://www.googleapis.com/auth/adwords. This covers the Google Ads accounts and manager accounts your Google login is authorised to see.
Campaign configuration and performance data from those accounts: campaigns, ad groups, keywords, ads, assets, budgets, bidding settings, conversion actions, and the reporting metrics attached to them such as impressions, clicks, cost, conversions and conversion value.
Basic account identifiers: the Google Ads customer ID, account name, currency and time zone, so we can tell your accounts apart.
Your basic Google profile: the email address and name attached to the Google account you used to sign in, so we know who authorised the connection.

The application does not access Gmail, Google Drive, Calendar, Contacts, Photos, or any other Google Workspace service. It does not read your email. It does not access any Google account data beyond what is listed above.

How the application uses that data

To read the structure and performance of the Google Ads accounts you have authorised, so we can report on them.
To create, edit, pause and optimise campaigns, ad groups, keywords, ads and budgets in those accounts, where you have engaged us to manage them.
To upload offline conversions you send us, so that Smart Bidding can optimise against real bookings rather than form fills.
To build the performance reports and dashboards we provide to you.

That is the entire list. Google user data is used only to provide and improve these user-facing features.

What the application will never do with that data

Access One's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not and will not:

Sell Google user data, or provide it to data brokers or information resellers.
Use it for targeted, personalised, retargeted or interest-based advertising of our own.
Use it to determine credit-worthiness or for lending purposes.
Use it to build or sell databases.
Use it to develop, improve or train generalised or non-personalised artificial intelligence or machine learning models. We do not feed Google user data into any AI or ML model.
Transfer it to any third party for any of the purposes above.
Allow humans to read it, except where you have explicitly asked us to for support, where it is necessary for security or to comply with the law, or where the data has been aggregated and anonymised.

Who the application shares Google user data with

We do not transfer or disclose Google user data to third parties for any purpose other than delivering the service you asked for. It is accessible only to the Access One team members working on your account, and to the hosting provider that stores it on our behalf. It is never shared with advertisers, never sold, and never passed to another client.

How the application protects Google user data

All data is transmitted over encrypted HTTPS connections.
OAuth tokens are stored encrypted and are never exposed in the application interface, in logs or in URLs.
We never ask for or store your Google account password. Authentication happens entirely on Google's own consent screen.
Access is restricted to named Access One team members who need it for your account, protected by individual credentials.
Administrative areas are not publicly listed and are access-controlled.
We request the minimum scopes the application needs to function, and nothing beyond them.

How long the application keeps it, and how to delete it

OAuth tokens are kept only while your connection is active. Revoke access and they are deleted within 7 days.
Campaign and performance data is retained for the duration of our engagement and for 12 months afterwards, so historical reporting stays available to you. After that it is deleted.
Account identifiers and your Google profile email are deleted when the connection is removed and the retention period above has passed.

You can disconnect at any time, either from within the application or by removing Access Ads API from your Google account permissions. Revoking access immediately stops any further data being accessed. To have everything already held deleted, email growth@axcads.com with "Delete my Google data" in the subject line. We action deletion within 30 days and confirm in writing when it is done. You do not need to give a reason.

What we collect

Information you give us

Enquiry and audit forms. When you use the contact form or request a free audit, we collect your name, business name, business type, email address, phone number, website address and whatever you write in the message field.
Job applications. When you apply through careers, we collect your name, email address, phone number, your answers to the screening questions, and the CV file you upload. CVs are accepted as PDF, DOC or DOCX.
Talent registrations. If you register with our healthcare talent service, we collect your contact details, professional background, licensing status and your CV.
Downloads. If you request a guide or handbook, we collect the name and email address you provide.

Only give us what is needed. Please do not include medical information, identification document scans, salary details or anything else sensitive in a free-text message field.

Information collected automatically

Analytics. We use Google Analytics 4 to understand how the site is used: pages viewed, time on page, approximate location, device and browser type, and the source that brought you here. This is collected through cookies and similar technologies.
Server logs. Our hosting provider records IP addresses, request times, pages requested and error responses. These are used for security and troubleshooting.

Why we use it

To reply to your enquiry and prepare a proposal or audit.
To assess job applications and contact candidates.
To match registered healthcare professionals with hiring clinics, where you have asked us to.
To send you the material you specifically requested.
To measure how the website performs and improve it.
To keep the site secure and prevent abuse.
To meet our legal and accounting obligations.

We do not sell personal data. We do not share your details with advertisers. We do not send marketing to people who only enquired about a service, unless they asked to hear from us.

Legal basis

Where UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data applies, we process personal data on the basis of your consent, the performance of a contract or steps taken at your request before entering one, and our legitimate interests in operating and securing the website. Where the EU or UK GDPR applies to a visitor, we rely on the equivalent bases under those regulations.

Cookies and analytics

This website uses cookies for two purposes: keeping the site working correctly, and measuring traffic through Google Analytics 4. Analytics cookies tell us which pages are read, how people arrive and where they leave, in aggregate.

You can block or delete cookies in your browser settings. Blocking analytics cookies will not stop you using any part of this site. You can also install the Google Analytics opt-out browser add-on.

If we later run advertising or remarketing tags on this website, this section will be updated before those tags go live.

Who we share it with

We share personal data only with the service providers we need to run the business, and only for the purpose described:

Google. Website analytics.
Our hosting provider. Storage of the website and any files submitted through it.
Our email provider. Delivery of enquiry and application notifications to our inboxes.
Hiring clinics. Only for candidates who have registered with Access Medical Talent, our healthcare talent service, and only with that candidate's agreement. We tell you before we introduce you to anyone. Job applications made to Access One itself are never shared outside Access One.

We may also disclose personal data where we are legally required to by a UAE authority or court.

Where your data is stored

Form submissions, uploaded CVs and application records are stored on our web hosting infrastructure. Analytics data is processed by Google on its own infrastructure, which may sit outside the UAE. Where personal data is transferred outside the UAE, we rely on the transfer mechanisms permitted under the applicable data protection law and on the contractual protections offered by those providers.

How long we keep it

Enquiries and audit requests. Up to 24 months from the last contact, then deleted.
Job applications and CVs. Up to 12 months from the application date, so we can consider you for other roles. Tell us at any time and we will delete them sooner.
Talent registrations. Two years from your last contact with us, unless you ask us to delete sooner or to keep it longer.
Client records. Kept for the duration of the engagement and for as long afterwards as UAE accounting and tax rules require.
Analytics. Retained according to the retention period set in Google Analytics, currently 14 months.

Your rights

Subject to the conditions in the applicable law, you can ask us to:

Tell you what personal data we hold about you, and give you a copy.
Correct anything that is wrong or out of date.
Delete your data, including your CV.
Restrict or object to how we are using it.
Withdraw consent you previously gave, without affecting anything done before you withdrew it.
Receive your data in a portable format.

Email growth@axcads.com and we will respond within 30 days. We may need to confirm your identity first. If you are not satisfied with our response, you have the right to complain to the UAE Data Office.

Security

The site is served over HTTPS. Access to form submissions, application records and uploaded CVs is restricted to the Access One team members who need it. Administrative areas of the site are not publicly listed and are access-controlled.

No system is perfectly secure. If a breach occurs that is likely to affect your rights, we will notify you and the relevant authority as required by law.

Access Medical Talent

Access Medical Talent is our healthcare recruitment service, operated by Access One. It has its own privacy notice covering what we collect from professionals and clinics, how consent to share a profile works, and what the service costs. That notice is the one that governs the talent service. This policy covers everything else, including cookies and analytics, legal basis, international transfers and how to complain, and it applies to the talent service as well.

For anything about a talent profile or CV, email talent@axcads.com. For everything else, email growth@axcads.com.

Other websites

This site links to other websites, including client sites, Google's Partner Directory and social platforms. We are not responsible for how those sites handle your data. Read their policies before submitting anything to them.

Children

This website is intended for businesses and working professionals. We do not knowingly collect personal data from anyone under 18. If you believe a child has submitted data to us, email us and we will delete it.

Changes to this policy

We update this policy when our practices change or when the law requires it. The date at the top of this page shows when it was last changed. Material changes will be reflected here before they take effect.

Contact

Access One
Dubai, United Arab Emirates
Email: growth@axcads.com

For anything relating to your personal data, email growth@axcads.com with "Privacy" in the subject line and it will be routed to the person responsible for data protection at Access One. For talent profiles and CVs, use talent@axcads.com.