Privacy Policy

LAST UPDATED: SEPTEMBER 26, 2026

Performance Digital Marketing LLC ("we," "us") operates pdmrocks.com and requests.pdmrocks.com from Kennewick, Washington. This policy explains what we collect, why, and the choices you have. The short version: we collect what you give us and what standard analytics record, we use it to run our agency and serve our clients, and we don't sell it.

What we collect

Information you submit through our forms — name, business name, email, phone number, project details, and any files you upload. Standard website analytics (pages visited, device type, general location) when analytics tools are active. Call and text records when you communicate with us.

How we use it

To respond to your requests, prepare quotes, deliver services, send invoices, and communicate about work in progress. We may use trusted service providers to process this information on our behalf — including our CRM and messaging platform (LeadConnector/HighLevel), website hosting (Netlify), and analytics providers. We do not sell your personal information.

Text messaging (SMS)

If you provide your phone number, you agree that we may contact you by call or text about your inquiry or project — including replies to work requests, appointment reminders, and service updates. Message frequency varies. Message and data rates may apply. Reply STOP to opt out at any time, or HELP for help. Consent to receive texts is not a condition of purchasing any service. We do not share your mobile number or SMS consent with third parties or affiliates for their marketing purposes.

Retention & your choices

We keep project records as long as needed to serve you and meet legal obligations. You can ask us to correct or delete your information at any time — email or call us using the details below and we'll take care of it.

---

Information Security & Data Privacy Policies

EFFECTIVE DATE: SEPTEMBER 26, 2026 · POLICY OWNER: MIKE MORGAN, OWNER · REVIEWED AT LEAST ANNUALLY

This document sets out how Performance Digital Marketing ("PDM") protects the systems and data it uses to run client marketing campaigns, including client account access, campaign data, and any personal data PDM processes on a client’s behalf. It is written for PDM’s actual size and operations — a small agency where the owner holds day-to-day security responsibility — and is meant to be a working document PDM actually follows, not a paperwork exercise.

1. Information Security Policy

PDM protects the confidentiality, integrity, and availability of its own business data and the data of the clients it serves.

Responsibility

Mike Morgan, Owner, is responsible for information security at PDM: setting these policies, deciding what tools and access are used, and responding to any security issue. Any PDM staff member or contractor who notices a possible problem reports it to him immediately — see Section 4, Incident Response Plan.

Baseline practices

• Every person with access to a PDM or client system uses their own individual login — logins are never shared.
• Screens are locked when a device is left unattended, on both office and remote work setups.
• Passwords are unique per account and, wherever a platform supports it, protected with two-factor authentication.
• Work computers run current antivirus/anti-malware protection and receive operating system and browser security updates promptly.
• Client ad accounts and reporting tools are only accessed over PDM’s own devices and networks, or over a secured connection when working remotely.

This policy is reviewed at least once a year, and sooner if PDM’s tools, staff, or client data handling change materially.

2. Access Control Policy

Access to client data and client-owned platforms (Google Ads, Meta, TikTok, Google Analytics, QuickBooks, and similar) is granted only to the PDM staff or contractors actively working on that account.

• New access is granted by Mike Morgan, and only for the specific accounts a person needs for their current work.
• Access is removed within 24 hours of a person leaving PDM or being reassigned off an account.
• Nobody uses a shared or generic login for a client platform — each person is added under their own identity (an individual user, or a named seat on the platform’s own user-management system).
• Where a client platform supports it, two-factor authentication is turned on for every PDM user.
• Who has access to what is reviewed at least once a year, and access no longer needed is removed at that review even if nobody flagged it.

3. Data Classification & Encryption Policy

PDM sorts the data it handles into three categories:

Public — material meant to be seen publicly (PDM’s own marketing content, published client ads and creative).

Internal — PDM’s own business records that aren’t client-confidential (internal notes, general process documentation).

Confidential / Client Data — anything client-specific or sensitive: ad account credentials, campaign performance data, contact or audience lists, invoices, and any personal data belonging to a client’s customers.

Confidential / Client Data is handled under these rules:

• It is only transmitted over encrypted connections — secure (HTTPS/TLS) websites and platforms, never plain unencrypted channels.
• It is only stored in encrypted or access-controlled systems — the client portal, PDM’s cloud storage and accounting systems, or password-protected files — never on an unsecured personal device or shared drive.
• Account credentials are never sent as plain text in email or chat; they’re shared through the platform’s own user-invite system or a password manager.
• Contact and audience lists used for ad targeting (for example, CRM audience uploads) are deleted from any working file once they’ve been loaded into the ad platform, and are not kept longer than needed for that campaign.

4. Incident Response Plan

A security incident is any event where PDM has reason to believe client data, a client’s ad account, or PDM’s own systems were accessed, used, or disclosed without authorization — including a compromised account, a lost device with access to client systems, or a phishing attempt that succeeded.

Steps

1. Report — Anyone who suspects an incident tells Mike Morgan immediately, however it was noticed.
2. Contain — Mike revokes or resets the access involved (passwords, API keys, platform sessions) to stop further exposure.
3. Assess — Mike determines what data or accounts were affected, and which clients or platform partners (Google, Meta, TikTok, etc.) that touches.
4. Notify — Any client or platform partner whose data was actually affected is notified without unreasonable delay once the facts are confirmed, generally within 72 hours of confirming a breach affecting their data.
5. Document — Mike records what happened, what was affected, and what was done about it, and reviews whether a process or policy needs to change as a result.

5. Personal Data Protection Policy

PDM processes personal data only as needed to deliver the marketing services a client has engaged PDM for — for example, campaign analytics, ad audience data, and CRM contact lists a client provides for targeted advertising.

• Personal data is used only for the client’s own marketing purposes. PDM does not sell it, and does not share it with anyone outside the platforms directly used to run that client’s campaigns.
• If a platform partner (such as TikTok) or an individual asks PDM to access, correct, update, or delete personal data PDM holds on a client’s behalf, PDM will help fulfill that request within a reasonable time, working with the client where the data is theirs to control.
• When a client’s contract with PDM ends, PDM deletes that client’s data from its own working systems within 30 days, except where a copy must be kept for legal, accounting, or active platform obligations.
• If PDM suspects a breach involving personal data, it follows the Incident Response Plan above, which includes notifying the platform partner or client.

This policy is kept up to date as PDM’s tools and client work change, and is reviewed at least annually alongside the other policies in this document.

Adopted by:

Mike Morgan, Owner — Performance Digital Marketing LLC

8350 W. Grandridge Blvd, #200-470, Kennewick, WA 99336

Contact

Performance Digital Marketing LLC · Kennewick, WA
(509) 410-3219 · mike@pdmrocks.com

This page is provided for transparency and is not legal advice.