Privacy Policy

UP TREE MARKETING SDN. BHD. (Company No. 1005333-V) (“UPT”, “we”, “us”, “our”) respects your privacy. This Privacy Policy explains what personal data we collect, how we use it, and the choices you have. It applies to our website at uptreemarketing.com, our landing pages, our marketing services, and the software tools we operate for our clients (including our Google Ads API application, “UPT Marketing”).

We process personal data in accordance with the Malaysian Personal Data Protection Act 2010 (PDPA) and, where applicable, the Singapore Personal Data Protection Act 2012.

1. Who we are

UP TREE MARKETING SDN. BHD. is a digital marketing agency headquartered at Wisma Up Tree, 5, Jalan Bandar 2, Taman Melawati, 53100 Kuala Lumpur, Malaysia, with an office at 68 Circular Road, #02-01, Singapore 049422.

Contact for privacy matters: zhiyang@uptreemarketing.com

2. Personal data we collect

2.1 Data you give us

• Enquiry and proposal forms — name, email address, company name, phone / WhatsApp number, the services you are interested in, and anything you write in the message field.
• Direct contact — information you share with us by email, WhatsApp, phone, social media or in meetings.
• Client onboarding — business details, billing details, brand assets and access credentials that a client provides so we can deliver services.

2.2 Data collected automatically

• Usage and device data — IP address, browser type, device type, pages viewed, referring URL, time on page and similar analytics data.
• Cookies and tracking technologies — see Section 6.

2.3 Data from advertising and analytics platforms

When we manage advertising accounts on behalf of a client, we access campaign, performance and lead data held in that client’s Google Ads, Meta (Facebook / Instagram), TikTok and similar accounts. This may include lead form submissions containing personal data of the client’s customers. We process this data only as a service provider to that client and under the client’s instructions.

3. How we use personal data

• To respond to your enquiry and prepare a proposal.
• To deliver, manage, measure and report on marketing services for our clients.
• To operate, secure and improve our website and tools.
• To send service updates and, where you have agreed, marketing communications. You can opt out at any time.
• To comply with legal obligations and enforce our agreements.

4. Google API Services and Google Ads data

UPT operates an application registered with Google (“UPT Marketing”) that uses the Google Ads API to manage and report on Google Ads accounts linked to our agency manager account. This section describes how that application handles Google user data.

4.1 What we access

With authorisation from the account owner (OAuth 2.0, scope https://www.googleapis.com/auth/adwords), the application reads and, where instructed, writes Google Ads data such as campaigns, ad groups, keywords, ads, budgets, bids, conversion data, search terms and performance reports for the accounts we are authorised to manage.

4.2 How we use it

• Building and optimising campaigns for the client that owns the account.
• Generating performance reports and keyword research for that client.
• Internal quality checks and change logs so we can show the client what was changed and when.

4.3 What we do not do

• We do not sell Google user data.
• We do not use Google user data for advertising that is unrelated to the client’s own campaigns, nor to build user profiles.
• We do not share Google user data with third parties except as required to deliver the service to that client (for example, a report sent to the client), to comply with law, or with the client’s explicit permission.
• We do not use Google user data to develop, improve or train generalised AI and/or machine-learning models.
• We do not allow humans to read Google user data except (a) with the account owner’s consent, (b) for security purposes such as investigating abuse, (c) to comply with law, or (d) after the data has been aggregated and anonymised for internal operations.

4.4 Limited Use

UPT’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4.5 Revoking access

An account owner can revoke the application’s access at any time from their Google Account at myaccount.google.com/permissions, or by removing our manager account’s link inside Google Ads.

5. Who we share data with

Recipient	Purpose
Our clients	Reports, leads and campaign data relating to their own accounts.
Advertising platforms (Google, Meta, TikTok, Xiaohongshu)	Running and measuring campaigns.
Service providers (web hosting, analytics, CRM, email and messaging tools, cloud storage, AI assistants used to prepare reports)	Operating our business, under confidentiality obligations.
Professional advisers and authorities	Where required by law or to protect our legal rights.

Some providers are located outside Malaysia. Where personal data is transferred overseas we take reasonable steps to ensure it is protected to a standard comparable to the PDPA.

6. Cookies and tracking

Our website uses cookies and similar technologies (including Google Analytics and Google Tag Manager, and advertising measurement tools such as Google Ads conversion tracking and Meta Pixel) to understand how visitors use the site and to measure advertising. You can control cookies through your browser settings. Blocking some cookies may affect how the site works.

7. Data retention

We keep personal data only as long as needed for the purposes above, to meet legal, accounting or reporting requirements, or as instructed by the client that owns the data. Enquiry data that does not lead to an engagement is normally deleted within 24 months. Google Ads data accessed through the API is retained in our reporting records for the duration of the client engagement plus a reasonable period for audit, after which it is deleted or anonymised.

8. Security

We use appropriate technical and organisational measures to protect personal data, including access controls, encrypted connections, restricted staff access and audit logs. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights

Subject to applicable law, you may request access to, correction of, or deletion of your personal data, withdraw consent, or limit how we process it. To exercise these rights, email zhiyang@uptreemarketing.com. We may need to verify your identity before acting on a request.

If you are a customer of one of our clients and your data reached us through that client’s advertising account, please contact the client directly; we will assist them in responding.

10. Children

Our services are intended for businesses. We do not knowingly collect personal data from anyone under 18.

11. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top shows when it was last revised. Material changes will be posted on this page.