Prebo Digital

Featured Articles

Stay ahead with our latest insights and proven strategies

SEOCROWeb DesignGoogle AdsMarketing for AmazonSocial Media Ads
Get a Quote

Latest Articles

google-ads-agency — google-ads heroGoogle Ads

Google Account Delegated Access Management in South Africa: The Grant, Review and Revoke Playbook for Ad Accounts

The Stellenbosch Scenario: A Retainer Ends, and Three Logins Outlive It A hypothetical B2B software firm in Stellenbosch ends a six-month retainer with a freelance Google Ads buyer. Three months later, the marketing manager finds the contractor still holds Standard access to Google Ads, a stale OAuth token is pushing conversion data into a third-party dashboard, and the freelancer is a delegated owner on Search Console. None were granted maliciously - they were simply never revoked. This is the delegate-to-revoke gap South African marketing teams must close systematically. Delegated access management is not about trusting partners less. It is about building a lifecycle - grant, review, revoke - that survives staff turnover, agency changes and the common SA pattern of an in-house team working alongside one agency and one freelancer on the same account. What 'Delegated Access' Actually Means Across Four Google Surfaces Google uses the word 'access' across four distinct systems, each with its own permission model, revocation path and failure mode. Surface What You Delegate Where It Is Set Common Roles Google Ads Campaigns, billing and users Tools & settings → Access and security Admin, Standard, Read-only, Emails-only Search Console Property data and settings Settings → Users and permissions Owner, Full, Restricted Google Workspace Admin roles, email delegation, API scopes Admin console → Directory / Security Super admin, delegated admin, Gmail delegate Google Business Profile Listing management Business Profile Manager Primary owner, Manager Grant Access Without Handing Over the Keys: The Client-Owned Account Model The most effective control is structural: the client retains ownership of the Google Ads account, and the agency operates from its own manager account (MCC) with access granted. Never reverse this. When the client owns the account, revocation is one action - removing the MCC link - and data, billing profile and change history stay under client control. This is how Prebo Digital's Google Ads practice operates: the client holds the account, the agency holds delegated access, and the relationship can end cleanly without a migration project. Rule of thumb: if the agency created the account, request ownership transfer before the first invoice. A client-owned account also keeps billing on the client's payment profile, simplifying POPIA accountability and VAT documentation. The Minimum Viable Access Matrix: Matching Role to Permission Level Over-granting is the default failure mode. A reporting analyst does not need Standard access; a media buyer should not hold billing rights. Use this matrix as a starting point and document every exception. Role Google Ads Level Search Console Notes Reporting analyst Read-only Restricted No billing, no user management Media buyer Standard (billing off) Full Can edit campaigns, cannot change payment Strategy lead Standard Full Same as buyer; no admin rights Billing / owner Admin Owner Named client staff only, never agency Watch the Emails-only level. It looks harmless, but still exposes the account email address and can receive account notifications - a subtle exposure point when a contractor leaves. Remove it alongside Standard access. Why .co.za Workspace Domains and Consumer Gmail Logins Behave Differently Many South African marketing teams run the Ads account on a consumer Gmail address rather than a verified .co.za Workspace domain. A consumer login has no admin console, so there is no central place to revoke OAuth grants or audit app access. With Workspace, an admin can control app access by organisational unit and see login events. On a personal Gmail, the only revocation path is the owner visiting myaccount.google.com/connections - and if that owner has left, it becomes a recovery problem. Where possible, migrate the Ads account to a Workspace group email (e.g. ads@yourcompany.co.za ) so access follows the role, not the person. The Grant Checklist: What to Confirm Before Day One of a Retainer Second admin exists on the client side, with 2-Step Verification confirmed. Access is granted to a Workspace group email, not an individual's personal Gmail. Billing profile remains under client ownership and is not shared with the agency. MCC link is recorded in the access register with date and requesting party. Search Console ownership stays with the client; agency receives Full or Restricted. Third-party tools connect via a shared service account, not a personal OAuth token.

Nov 7, 20267 min read
Read more
google-ads-services — google-ads heroGoogle Ads

Google Account Data Export Tool for South Africa: Mapping the Five Export Surfaces Before You Buy

The Melrose Arch Meeting Where Three Dashboards Disagreed (Hypothetical Scenario) Picture a marketing director at a Johannesburg consumer brand opening a Monday finance review. The Ads UI shows R412,000 of attributed revenue for the month. GA4 shows R368,000. The CRM shows R341,000. Nobody is hacking the account. All three numbers are technically honest, and none of them can be reconciled quickly because the exports behind each dashboard were pulled on different days, from different surfaces, with different definitions of a conversion. The phrase "google account data export tool" implies a single switch that dumps everything into one tidy file. In practice, a Google account is a federation of surfaces, each with its own export mechanism, its own owner, and its own idea of what a session or a conversion is. The Five Export Surfaces, Side by Side Before comparing vendors, map what you are actually exporting. South African teams typically touch five surfaces: Google Takeout - a personal-account archive covering Gmail, Drive, Calendar and more. Useful for data-subject requests and offboarding, not for marketing reporting. Google Ads - campaign, cost and conversion data pulled via the Ads API or scheduled reports. Versioned and retired on a rolling schedule. GA4 - event-level data, best exported to BigQuery rather than CSV, because sampling and thresholds distort large pulls. Search Console - query and page performance, available through the bulk export to BigQuery or the API for smaller volumes. Workspace - admin-level exports of org data, governed by admin roles and audit logs rather than marketing definitions. Each surface has a different format, refresh cadence and access model. A tool that handles Ads well may not touch Search Console bulk export at all. That is why the buying question is not "which tool exports Google data" but "which surfaces does it cover, and how does it reconcile them". Why the Numbers Diverge: Definitions, Timing and Consent The Melrose Arch gap is rarely a bug. Ads reports at click time with the longest attribution window. GA4 applies consent-mode modelling and session-based deduplication, so a user who converts across two sessions may be counted once or modelled rather than observed. The CRM reflects refunds and returns that were never back-fed to Google. Add time-zone mismatches - a property set to UTC versus a team reporting in SAST - and a month boundary alone can shift a day of revenue. Documenting these causes is the difference between a reconciled number and a monthly argument. Vetting a Third-Party Export Tool Against POPIA Under POPIA, exporting personal data to a third-party tool makes that vendor an operator, and section 21 requires a written contract with security safeguards. Ask four questions before signing: which OAuth scopes does the tool request (read-only versus write access); where does the data land geographically; does it retain raw event data and for how long; and can it answer a data-subject access or deletion request within a reasonable window? A tool that cannot answer these in writing is a compliance risk, not a shortcut. What to Compare on the Shortlist Score candidates on surface coverage (all five or a documented subset), export destination (cloud storage versus local download), scheduling and retry behaviour, credential handling, and total annual cost in ZAR including FX and VAT. A cheaper monthly headline can lose on the annual figure once connector fees and BigQuery storage are added.

Nov 7, 20265 min read
Read more
seo-and-google-ads-integration — google-ads heroGoogle Ads

Google Account Linked Services Audit for South Africa: A Handover Playbook for Ad Accounts

The Umhlanga Scenario: A New Agency, an Old Token, and a Reporting Number Nobody Trusts A KwaZulu-Natal consumer-goods brand moves its paid media to a new agency. This is a hypothetical scenario. The marketing director hands over admin access on a consumer Gmail identity, campaigns look healthy, yet reported conversions in the new agency's dashboard are roughly double what the brand's order data suggests. The cause is often mundane: a previous agency's reporting tool still holds OAuth scopes over that login, a GA4 property link survived the handover, and nobody mapped the payments profile. That gap between platform-reported and true numbers is why a Google account linked services audit matters before anyone touches bids. It is not a security product, and Google publishes no native 'linked services audit report' - you build the inventory yourself from four distinct screens. What a Linked Services Audit Is - and What It Is Not A linked services audit is a written inventory of every external app, service link, tenant-level grant and billing surface attached to a Google login that controls ad spend or measurement. It is not activity forensics, a billing setup guide, or a Workspace build - those are separate disciplines. Do the inventory before you grant or revoke anything. Revoking a link you don't understand can break reporting or billing mid-flight. Layer 1: Third-Party OAuth Connections at myaccount.google.com/connections This screen lists every app and service a person has granted access to their Google Account. It is per-identity, not per-organisation - which is why a marketing director's personal Gmail is often the riskiest login in the estate. Auditing it means reading each grant's scopes, not just its name. How to Read an OAuth Grant: Scopes, Send-As and the 'Analytics Readonly' Problem A grant labelled 'Analytics Readonly' sounds harmless until you notice it also carries Gmail send-as or Google Ads edit scope bundled into the same consent. Scope creep is the norm. Record, per grant: the app name, the scopes listed, the date last used, and whether the business still holds a contract with that vendor. myaccount.google.com/connections # OAuth grants per identityads.google.com > Admin > Access # who can enter the Ads accountgoogle.com/analytics > Admin > Product linksadmin.google.com > Security > API controls > App access controlpay.google.com > Settings # payments profile ownership Layer 2: Google Ads and GA4 Service Links That Outlive the Login Separate from OAuth, Google Ads holds its own linked-account relationships: Analytics, Merchant Center, Search Console, YouTube, Business Profile and Play. GA4 holds product links of its own. These links persist beyond individual user access - removing a person from the Ads account does nothing to sever a GA4 property still feeding conversions into the campaign. Check both directions and note which links are still commercially intended. Reconciling the Four Layers: What Each Can Do in the Wrong Hands Layer What it can do if left in the wrong hands Who normally owns the fix Where the screen lives OAuth app grants Read mail, pull Analytics, or write to Ads via a stale token The individual account holder myaccount.google.com/connections Ads / GA4 links Skew conversion data, retain visibility of spend and audiences Ads admin or GA4 admin Ads Admin; GA4 Admin > Product links Workspace app access Tenant-wide data exposure across the .co.za domain Workspace super admin Admin Console > Security > API controls Payments profile Control of ZAR billing, cards and spend continuity Finance owner or brand pay.google.com > Settings If you'd rather have the paid-media side handled alongside the audit, see our Google Ads management service .

Nov 6, 20265 min read
Read more
Electrical meter and fuse box on a white wall in Cape Town, South Africa, for energy monitoring or billing.Google Ads

Google Account Activity Monitoring in South Africa: A Change-Forensics Playbook for Ad Accounts

The Sandton Scenario: A ROAS Drop, a Former Contractor, and a 2am Budget Rule A Sandton-based e-commerce brand sees ROAS tumble from 4.2 to 2.8 over a weekend. The team blames creative fatigue. Then someone notices a campaign budget was doubled at 02:13 on Saturday - by an account that still carried a former contractor's email. The contractor had been offboarded from payroll three months earlier, but nobody revoked their Google Ads access. This is not a login problem; it is a change-integrity problem. The same pattern repeats across South African marketing teams: a GA4 configuration change, a GTM tag paused, or a budget rule altered without a record of who did it. Monitoring Google account activity is how you rebuild that record. Warning: Monitoring logs can themselves contain personal information. Under POPIA, define a lawful purpose, tell staff what is logged, and set a retention limit. This article is not legal advice; consult counsel before implementing monitoring. What 'Google Account Activity Monitoring' Actually Means Across the Three Accounts in Play The phrase is overloaded. In South African ad teams it usually refers to one of three distinct surfaces, each answering a different question: Personal activity (My Activity): What a signed-in user did across Google services - searches, YouTube views, location history, ad personalisation. It is a consumer privacy dashboard, not an audit trail for business changes. Security and Workspace logs: Login events, admin actions, Drive changes, and the Security Investigation Tool. This answers “who accessed what, from where, and when” at the identity layer. Marketing change forensics: Google Ads Change history, GA4 Change history, and GTM Version history. This answers “what changed in the campaign or measurement setup, by which user, at what time.” The Sandton scenario lives in the third category, but you need the second to prove who the user was, and the first only if you are investigating a personal account’s broader activity. The table below compares the surfaces. Surface What it records Who can see it Retention Best for My Activity Personal searches, YouTube, location, ad personalisation The signed-in user (and admins only via investigation tools on some editions) User-set auto-delete (3, 18, or 36 months) Privacy hygiene, not campaign forensics Workspace Admin log events Admin actions, login events, Drive log events Workspace super admins and delegated admins Edition- and setting-dependent; check your Admin console Identity and access investigations Google Ads Change history Budget, bid, targeting, status changes with user and timestamp Anyone with Ads account access Rolling window; verify in-product for current length Attribution of performance shifts to specific edits GA4 Change history Admin edits to properties, data streams, key events GA4 admins and editors Limited; export or screenshot for long-term records Measurement configuration audits GTM Version history Container versions, tags, triggers, variables, workspaces GTM account users with publish rights Version history retained until deleted; workspaces are temporary Tracking pipeline forensics The Personal Trail: My Activity and Activity Controls Explained Without Fear-Mongering My Activity is where a user reviews and deletes their own Google service history. Activity Controls let them pause Web & App Activity, Location History, YouTube History, and Ad Personalisation, and set auto-delete at 3, 18, or 36 months. For a South African marketing team, this is relevant in two narrow cases: (1) a staff member uses a personal Gmail for work and you need to understand what data exists, and (2) an investigation requires the user to export their own activity. It is not a substitute for business-grade logging. Do not ask employees to hand over personal account credentials; instead, move work to Workspace accounts where admin logs apply. The Workspace Trail: Admin Log Events, Login Events and the Security Investigation Tool If your team uses Google Workspace, the Admin console under Reports > Audit and investigation is the identity backbone. Admin log events show who granted Ads access, changed a group, or altered an organisational unit. Login events show authentication attempts and suspicious sign-ins. The Security Investigation Tool (available on premium editions) lets you query these logs across users and time ranges. Use it to answer: did the former contractor’s account log in after offboarding, and from which IP range? Pair this with the Google Account “Recent security activity” page for individual users. This is the evidence layer that makes the marketing trail credible.

Nov 6, 20267 min read
Read more
Professional google ads strategies south africa imageGoogle Ads

Managing Google Account Billing in South Africa: The Payments Profile, VAT and Card Playbook

The Midrand Scenario: A Card Decline the Week of a Seasonal Push A Midrand direct-to-consumer brand, mid-way through a Black Friday build, sees its ads stop serving on Wednesday. Nobody touched the campaigns. The cause is a declined card on a Google Payments profile set up two years ago by a staff member who has since left. The card has expired and finance does not know which Google login owns the money layer. That is a billing-governance failure, and it is the problem this playbook addresses. Which Google Billing Are You Actually Managing? A Disambiguation Table South African finance teams regularly conflate three separate systems. Before changing anything, identify which one is on the credit card statement. Billing type What it charges Where it is managed Typical owner Google Ads Ad spend on Search, Shopping, PMax, YouTube Google Ads > Billing > Settings Performance marketer or agency Google Workspace Per-seat licence fees Admin console subscriptions IT or Workspace super admin Google Cloud Compute, storage, API usage Cloud console billing accounts Engineering This article covers the first row only: the Google Ads payments layer, where most South African budget surprises originate. The Payments Profile Is the Money Layer, Not the Login A payments profile is the standalone Google record holding the legal business name, billing address, currency, tax status and payment methods. It is not your Gmail login and not your Google Ads account. One profile can fund several Google products; one Ads account can move between profiles only within limits. This separation lets you hand ad-spend control to an agency without handing over the card, provided profile ownership is structured correctly. What Lives Inside a Payments Profile: Legal Name, Currency, Tax Status, Cards Four fields drive almost every reconciliation headache in South Africa: Legal name and address - must match the entity claiming the expense. Currency - the billing currency on every invoice. Tax status - whether a VAT number is attached. Payment methods - primary card plus, ideally, a secondary. Currency lock-in warning: the profile currency is fixed at creation. A ZAR profile cannot simply be switched to USD in place - you generally need a new profile. Set this deliberately on day one and confirm current rules in Google's documentation, since billing screens change. Automatic vs Manual Payments: Choosing by Cash-Flow and FX Exposure Automatic payments charge your card after you spend past a billing threshold or at month-end, whichever comes first. Manual payments are prepaid: you load credit, then spend it. For SA advertisers this is a cash-flow and FX decision as much as a convenience one. Factor Automatic payments Manual payments Cash-flow timing Pay after spend; less upfront cash Pay before spend; needs working capital FX exposure Rate set at charge date, varies monthly Rate fixed at top-up; predictable Risk of pause Higher if a card declines Lower; stops only when credit runs out A predictable ZAR budget line usually favours manual; a scaling account chasing demand favours automatic plus a funded backup card. See how this fits a wider reconciliation process in Prebo Digital's reporting approach . Entering a South African VAT Number and Downloading Tax Documents Services invoiced by Google Ireland typically carry VAT at the standard 15% rate, and a valid VAT number on the payments profile lets the tax treatment be reflected correctly on the tax document. Retrieve tax documents from Billing > Documents in Google Ads; statements live in the payments profile under Transactions. Download them monthly - older statements are easier to lose when staff change. Tax caveat: VAT treatment depends on your entity, VAT registration status and current rules. Treat this as a pointer to the right screens, not tax advice. Confirm with a registered tax practitioner and check the SARS VAT guidance .

Nov 6, 20266 min read
Read more
core web vitals seo web design south africa — seo heroSEO

Google Workspace Admin Console Tutorial for South African Teams: A First-14-Days Setup Playbook

The Cape Town Scenario: Twenty Staff, One Super Admin, and an Agency Knocking on the Door Picture a hypothetical Cape Town e-commerce business - around twenty staff, a .co.za domain, Shopify checkout - that has just bought Workspace through a local reseller. A performance agency has been hired to run Google Ads and GA4, and the founder has forwarded the reseller's handover email to the one person who signed up. That person is now the only super admin. This playbook sequences the first fourteen days so that gap closes before something breaks. Create a second super admin before you change a single role or policy. Role edits and 2SV enforcement can lock out the only super admin, and recovery through a reseller may take days. What the Admin Console Actually Controls - and What It Does Not Sign in at admin.google.com with a super admin account. The console governs the identity layer: who exists in the directory, how they authenticate, what apps they may install, what sharing posture their Drive inherits, and who can audit what happened. It does not govern ad performance. Ads bidding, GA4 events and Merchant Center feeds live in their own products; the console only decides who gets in. Admin Console vs Google Ads Console vs GA4 Admin: Clearing Up the Three-Way Confusion Console Governs Who should hold it admin.google.com Identities, OUs, 2SV, app access, audit logs Two super admins plus scoped admins ads.google.com Campaigns, billing, account access levels Marketing lead and named agency users GA4 Admin Properties, data streams, role grants Marketing lead; agency as Editor Day 1: Logging In, Verifying the .co.za Domain, and Creating a Second Super Admin Domain verification adds a TXT or CNAME record in the control panel of whichever registrar holds the .co.za domain - a local registrar in most South African cases. Google supplies the exact record. Verify ownership before creating users, because users created on an unverified domain sit in a fragile state if the reseller's relationship lapses. If a reseller holds super admin from handover, ask them to grant you super admin, sign in, then remove their elevated role - they do not need to remain a super admin to keep billing you. Note that Google quotes subscriptions in USD while local resellers may invoice in ZAR; treat any ZAR figure as an estimate that shifts with the exchange rate. The second super admin should be a role-based Workspace account (for example admin@yourdomain.co.za), never a personal Gmail address belonging to one employee. How Organisational Units Become Your Policy Engine (With a Marketing-Team OU Design) Organisational units are the main lever for per-team policy. Design them before adding users, so nobody needs moving later. OU Workspace access Drive sharing posture Marketplace installs Device management Permanent staff Full core apps External sharing allowed, warned Allow-listed only Managed Agency / freelance Gmail only, no Drive No external sharing Blocked Unmanaged Contractors Gmail, Calendar Internal only Blocked Unmanaged Finance Full core apps Restricted Allow-listed only Managed Days 2-3: Creating Users and Groups Without Creating Chaos Add users individually or in bulk with a CSV, placing each into the correct OU at creation rather than afterwards. Create groups for functional mailboxes - marketing@, finance@ - so access survives staff turnover. Groups are also the cleanest way to grant Docs and Drive permissions: add the agency to a shared group, then remove one membership when the contract ends. Days 4-7: Email Authentication Records - SPF, DKIM and DMARC Explained for Local Admins In the current Admin console under Apps and Gmail settings, generate the DKIM key for your .co.za domain and publish the TXT record at your registrar. Then set a single SPF TXT record that includes Google's sending hosts, and publish a DMARC TXT record at _dmarc starting at p=none while you read reports, then tighten. Without these, invoices from your domain land in spam and phishing spoofing becomes trivial.

Nov 5, 20266 min read
Read more
Professional google ads optimization south africa imageGoogle Ads

Google Account Two-Factor Authentication Setup in South Africa: A Team-Wide 2SV Playbook for Ad Accounts

The Johannesburg Scenario: One Admin, One Second Factor, One Unreachable Week A Johannesburg e-commerce brand has a single Google Ads admin whose phone is the only device with 2-Step Verification (2SV) enabled. They go on leave to the Drakensberg for a week and a critical campaign needs a bid adjustment. The team has the password but not the second factor, so the account is effectively locked. A team-wide 2SV playbook - standardised factors, provisioned recovery paths, and enforcement via Google Workspace admin controls - prevents this. Prebo Digital, a Google Premier Partner (2022-2026), regularly helps South African advertisers avoid this kind of operational stall. 2-Step Verification vs Two-Factor Authentication: What Google Actually Calls This Google calls its two-factor implementation 2-Step Verification (2SV) : something you know (password) plus something you have (a second factor). Google accounts accept Google prompts, authenticator app codes, security keys, or backup codes. The terminology matters when following support documentation and configuring Workspace policies. Google is gradually moving away from SMS and voice codes as primary factors, favouring prompts, authenticator apps, and security keys. Plan your standard accordingly. Which Second Factor Should a South African Ad Team Standardise On? The choice depends on team size, budget, and risk tolerance. Factor How it works Best for Considerations Google prompt Tap “Yes” on a signed-in device Teams with company-managed phones Requires data connection; device must be enrolled Authenticator app Generate a time-based code Hybrid or remote teams Works offline; codes expire quickly; app must be backed up Security key (FIDO) Physical USB/NFC key High-value accounts (large budgets, admin roles) Low hundreds to a few hundred rand per key (estimate); store securely Backup codes One-time codes generated in advance Emergency access Print and store in a safe; single-use For most South African SMEs, an authenticator app balances security and practicality: it does not rely on mobile networks (unreliable during load-shedding) or extra hardware. Teams spending over R100,000 a month should consider security keys for admin accounts. The Setup Path, Step by Step: Enrolling Your First Admin Account Start with the primary admin account. Go to Google Account Security and sign in. Under “Signing in to Google,” select 2-Step Verification . Choose your factor: Google prompt, authenticator app, security key, or backup codes. Follow the prompts to enrol it. Generate and securely store backup codes. Repeat for each team member with access to Google Ads, GA4, or Merchant Center. Enable 2SV first on the account managing your Google Ads MCC (My Client Center) - often the single point of failure. Do not skip backup codes. They are your safety net if you lose your phone or security key. Securing Recovery Email and Recovery Phone Before You Need Them Recovery options are separate from 2SV but equally critical. Set a recovery email (preferably on a different domain) and a recovery phone number. For teams, use a shared inbox monitored by multiple people (e.g., security@yourcompany.co.za) and avoid personal numbers on shared accounts. Test recovery options periodically and keep them accessible to more than one trusted team member.

Nov 5, 20265 min read
Read more
Professional google ads specialist campaigns for corporations south africa imageGoogle Ads

Google Account Recovery Options in South Africa: A Restoration Playbook for Locked-Out Marketing Teams

The Pretoria Scenario: Locked Out of the Account That Owns the Campaign Picture a lean in-house marketing team in Pretoria running about R80,000 a month across Search, Shopping and Performance Max. This is an illustrative scenario, not a real client. Their single company Google account is the sole admin on the Google Ads account and the GA4 property, registered years ago against a personal recovery email and a prepaid SIM that has since been recycled. One Monday nobody can sign in. The ad account keeps spending, nobody can pause it, and conversion data feeding bid strategies starts to drift. This playbook is a decision tree for which recovery route fits your lockout, what breaks it in a South African context, and how to confirm spend and attribution survived. Google offers no paid or premium recovery tier and no route with a guaranteed outcome. Every method below helps you prove ownership, not override it. Recovery Is Not One Flow: The Five Routes Google Actually Offers Self-service password recovery via recovery email, recovery phone, or a device already signed in. "Try another way" to switch verification methods when the default prompt fails. The Account Recovery form when no standard method works, asking about recent passwords, creation date, devices and recovery contacts. Recovery options configured in advance, which only help if current. 2SV backup methods: backup codes, backup security key, device prompts or an Authenticator app. Two further routes matter for businesses: Workspace admin-assisted recovery, where a super admin resets a user password; and Google Ads access reinstatement, where an existing ad account admin grants entry even if your Google account is blocked. Which Recovery Route Fits Your Lockout? A Decision Table Lockout scenario Recommended route What breaks it Realistic effort Forgotten password, recovery phone/email active Self-service reset or "Try another way" Recycled prepaid SIM; dead recovery inbox Minutes 2SV prompt on a phone you no longer have Backup codes or backup security key Codes never exported to the team Minutes to hours Former employee held all recovery details Account Recovery form Weak answers on device history and old passwords Days, limited attempts Workspace user locked out, admin available Super admin password reset Admin unknown or also locked out Same day Ads access lost but Google account works Existing Ads admin reinvites you; Ads support You are the only admin Hours Scenario Guide: What Each Method Is Good For and What Breaks It Self-service reset is fastest and least forensic, working when recovery details still belong to the business and failing when they live on a personal handset or ex-staffer's inbox. The Account Recovery form is deepest and most fragile: Google weighs recent passwords, dates, devices and contacts, and repeated misfires weaken your signal. 2SV backups only exist if stored centrally. Workspace admin recovery bypasses the consumer flow but rests on someone holding the super admin role. Ads-side reinstatement is your lifeline when the ad account is fine and only your sign-in is dead. Consumer Account vs Google Workspace: Why the Route Changes Entirely A free Gmail-based account puts the burden on individual recovery details. A Workspace account on a .co.za domain brings governance: a super admin can reset without the user's old device. If the admin account itself is lost, a domain-verification-based Workspace admin recovery applies, which is why domain records must be owned by the business, not a departed web developer. Limiting this risk starts with good setup; our strategy consulting work routinely starts with who actually controls the domain.

Nov 5, 20266 min read
Read more
Professional google ads specialist management for companies south africa imageGoogle Ads

Google Account Privacy Settings Guide for South Africa: What Each Toggle Really Shares

Hypothetical scenario: a Durban e-commerce brand hands Google Ads and GA4 access to a new agency. A staff member asks the obvious question - now that the agency is 'inside' Google, can it see my personal Gmail and YouTube history? Here is the honest answer, mapped layer by layer. The Durban Scenario: A New Agency Gets Ads Access and the Team Asks What Else It Can See A retailer agrees to grant a working agency access to its Google Ads account and GA4 property. Most of the team is relieved. One person is not: their personal Gmail address is also the login for the admin account. They want to know what a third party with Ads visibility can actually read. The answer separates cleanly. Ads access does not open an inbox. But the same Google login surface hosts consumer privacy toggles, ads-account data sharing and admin visibility - and those are managed in different places by different people. Confusing them creates both privacy anxiety and genuine gaps. The Privacy Surface Map: Three Layers of Google Data Control Layer What it governs Where it lives Typical owner One - consumer activity Personal search, YouTube, location and ad personalisation data My Activity, My Ad Center The individual Two - ads and analytics governance Ad account data, audience lists, product linking Google Ads, GA4, Merchant Center Marketing lead Three - admin visibility Who can see and export ad and audience data User management and manager accounts Business owner Layer One: Consumer Activity Controls - My Activity, Web & App Activity, Location and YouTube History At myactivity.google.com a user can pause Web & App Activity, YouTube History and Location History, review what has been saved, and set an auto-delete window. This governs personal data tied to that login - not ad account data. Location History (surfaced as Timeline) affects how Google Maps personalises for that individual. It has only an indirect bearing on local marketing signals, and stopping it does not restrict what an advertiser can target. What the Ad Personalisation Toggle in My Ad Center Actually Changes (And What It Does Not) Inside My Ad Center , switching off personalised ads stops Google using that account's activity to target advertising. It does not stop ads appearing, and it does not touch a business's Google Ads account. Separate consumer privacy from ad performance. Disabling personal ad personalisation does not materially damage a campaign's ROAS - Ads relies on its own signals and consented conversion data, not one employee's YouTube history. Third-Party App Access: Reading Scopes Before You Approve 'Sign in with Google' Each 'Sign in with Google' grant carries scopes - read-only calendar access differs sharply from full Gmail or Drive access. Before approving, read the scope list. Full permission audits are a separate discipline; full permission audits sit on layer one and belong to the individual, not the ad account.

Nov 4, 20265 min read
Read more
google-ads-agency — google-ads heroGoogle Ads

Google Account Security Tips for South Africa: Protecting Ad Spend, Data and Attribution

The Stellenbosch Scenario: How a Hijacked Google Account Drains an Ad Budget Picture a Stellenbosch online store selling outdoor gear. The owner runs Google Ads personally, pays via company EFT, and uses SMS as the second factor because it was the default. A SIM swap happens over a weekend. The attacker resets the login, adds a new admin, raises budgets on a display campaign pointing to an off-site checkout clone, and swaps the Merchant Center payment profile. By Monday, the first evidence shows up in the bank feed, not the inbox. For a business that buys media, a Google login is a spending instrument. It holds the billing card, the Merchant Center payment profile, the analytics pipeline and, through Search Console, the visibility data behind pricing decisions. Treating it as an email account with a password is where most South African risk begins. SMS-based 2FA is the weakest link in a SIM-swap environment. If that is your only factor, you are one port request away from a takeover. Why a Google Account Is a Financial and Data Asset, Not Just an Inbox Three things sit behind that login that owners rarely file under 'security': the ad budget, the payment instrument, and the conversion data the attribution model depends on. A takeover does not just lock you out - it corrupts the data that tells you which channels are profitable. The South African Threat Surface: SIM Swap, Load-Shedding Phishing and .co.za Admin Local threat patterns differ from global ones. SIM-swap fraud is a live operational risk that makes SMS 2FA a liability. Phishing emails imitating 'account suspended' or 'billing failed' notices spike around load-shedding and payment disruptions, when recipients expect payment problems and act quickly. And .co.za domain and hosting admin is often held by a contractor or former employee, so recovery routes lead outside the business entirely. Lock the Front Door: Passkeys, Authenticator Apps and Advanced Protection Move past SMS wherever possible. Passkeys bind access to a device you hold and are phishing-resistant by design. An authenticator app removes the SIM dependency while keeping recovery manageable. The Advanced Protection Program adds hardware-key enforcement for accounts where a takeover would be materially damaging - typically any account with live ad spend or Merchant Center access. Security Factor Comparison: What Each Google 2SV Method Resists Method Resists SIM swap Resists phishing Resists remote attacker SMS code No Weak Partial Phone prompt Partial Weak Partial Authenticator app Yes Moderate Yes Passkey Yes Strong Yes Hardware security key Yes Strong Yes Lock the Recovery Path: Recovery Email, Recovery Phone and the Lockout Trap Recovery is the soft entry point most businesses overlook. Recovery email is frequently a staff member's personal Gmail rather than a business-controlled address. Move it to an address on your own domain, ideally on Workspace and shared with a second accountable person. Otherwise, a departing employee or a stolen personal inbox becomes your reset button. Set the recovery email to a company-domain mailbox on Workspace, not a personal Gmail. Then verify that a second admin can complete recovery independently. Billing Controls for Google Ads and Merchant Center: Separating the Money From the Login Separate the billing instrument from the login. Use a dedicated card for ad spend with a limit, not the operational EFT card. Configure spend alerts and change notifications. For Merchant Center, ensure the payment profile is owned by a finance-controlled account, not the media buyer's personal one.

Nov 4, 20266 min read
Read more
Professional google ads specialist management for companies south africa imageGoogle Ads

Search Advertising Agency South Africa: How to Brief, Hand Over and Hold a Paid-Search Specialist Accountable

Picture a mid-sized Cape Town distributor of industrial components: roughly R1.2m a year of media spend, an in-house marketer wearing six hats, and a generalist agency running Google Ads alongside social, display and email for three years. The distributor is plateaued. Branded queries are expensive, non-brand growth has stalled, and nobody can explain which keywords produced quotes. The marketing lead wants to move search to a specialist without waking up to find the agency holding the admin keys, billing card and historical change log. This is the playbook for that handover. What 'Search Advertising' Actually Covers - and What It Doesn't Search advertising is text advertising on search engines: Google Search campaigns, Shopping and Performance Max where retail applies, and Microsoft Advertising. It excludes social, display, video and influencer. Buyers often conflate 'paid media' with 'search', then brief a scope too broad to be done well. Google's documentation on Search campaigns is the reference point. A specialist should explain match-type strategy, negative keyword architecture and query hygiene - not just campaign naming. If the brief can't test that, it won't separate specialists from generalists. Why South African Buyers Say 'Search Advertising' and Not 'Google Ads' Microsoft Advertising still carries meaningful desktop and enterprise search volume in South Africa, particularly for B2B and professional services, so a Google-only brief leaves inventory untouched. Importing US terminology ('PPC', 'SEM') also signals imported expectations - offshore benchmarks, dollar ROAS targets, advice that ignores local delivery economics. A search advertising agency in South Africa should price in ZAR, apply VAT correctly and recognise that card failures and courier realities shape e-commerce conversion rates. The Engagement Brief That Separates a Specialist From a Generalist Write the brief around craft, not deliverables. A specialist brief asks for a documented match-type transition plan after broad match expansion; a negative keyword architecture with account, campaign and ad-group tiers; an explicit policy on brand protection versus competitor bidding; a decision on Search Partner and Display Network expansion (defaults are almost always on and almost always wrong); and a named owner for Microsoft Advertising. A generalist brief asks for 'monthly reports' and 'campaign optimisation', which cannot be verified. Specialist Search Shop vs Full-Service Agency vs Freelancer: Which Suits Which Buyer Buyer profile Best fit Why In-house team offloading execution, keeping strategy Specialist search shop Craft depth plus a collaborative operating rhythm Mid-market e-commerce or B2B SaaS wanting full search ownership Specialist, with CRO and feed support Search interacts with landing pages and Merchant Center Scaling brand with a generalist, needing search craft Full-service agency with a dedicated search pod Avoids splitting attribution across two vendors What a Search Advertising Agency Should Cost in South Africa: Fee Models and ZAR Ranges (Estimates) Figures are illustrative ranges, not quotes, and exclude VAT. Management fees are subject to VAT, so a R25,000 retainer is R28,750 to the client. Model Typical structure Watch for % of media spend Commonly 10-20% (estimate) Rewards spend, not efficiency Flat retainer R15,000-R60,000/month by complexity (estimate) Scope creep; check account count Hybrid with performance component Base plus bonus on agreed CPA targets Defining 'qualified' precisely Hourly Project or audit work No continuity of learning The First 90 Days: Handover, Access and Guardrails The client must retain admin ownership of Google Ads, Merchant Center, Microsoft Advertising and billing. Grant the agency standard or operating access, not admin. Keep a shared change log and require written approval for structural changes in the first month. Transparent reporting should be established before optimisation begins. Safe Access Handover: A Working Checklist Naming convention: [client]-[channel]-[market]-[owner] e.g. acme-google-za-inhouse acme-msads-za-agency Checklist: [ ] Client owns Google Ads admin + billing [ ] Agency: standard access only [ ] Merchant Center under client login [ ] Microsoft Advertising account client-owned [ ] Conversion actions documented [ ] Change log shared (Google Sheets) [ ] Rollback: revoke agency access, retain history If an agency insists on owning the Google Ads account 'for billing convenience', that is a red flag. Historical data belongs to the client. Explore the framework Prebo Digital applies to Google Ads engagements, including access structures built for clean handovers.

Nov 4, 20266 min read
Read more
local-advertising-strategies — google-ads heroGoogle Ads

Google Ads Conversion Tracking: The Technical Audit That Fixes Revenue Gaps

Context: The B2B SaaS Team Whose 'Conversions' Were Mostly Form Starts (Hypothetical Scenario) A subscription SaaS company runs Google Search campaigns for demo requests. Google Ads reports 180 conversions last month, GA4 shows 140 key events, and the CRM logged 60 qualified demos. CPA looks healthy in the platform and alarming in the board deck. Nothing is 'broken'-the tag fires-but the conversion actions have drifted from what the business actually sells. This is a measurement design problem, not a tagging failure. Why Google Ads, GA4, and Your CRM Never Match (By Default) Each system counts a different thing, at a different moment, for a different purpose. Google Ads credits conversions to a click within its attribution model; GA4 models sessions and events; the CRM counts business outcomes. Add consent-driven signal loss, cross-device journeys and differing attribution windows, and a gap is expected. An audit's goal is not to force the numbers identical-it is to understand the gap, bound it, and confirm the platform optimises toward the outcome you care about. Prebo Digital manages conversion tracking audits as a Google Premier Partner (2022-2026), giving direct visibility into how Google's own definitions and diagnostics behave. The Conversion Action Inventory: Your First Audit Artefact Before touching a setting, export every conversion action with its type, counting method, value, attribution window and filter. This table is the audit's backbone. Action Source Primary? Count Value Demo request GA4 import Yes One Static R1,200 Form start GA4 import Yes (flagged) Every None Newsletter Google tag No One Static R50 Here 'form start' is a primary conversion counted on every interaction-so single-page scrolling generates multiple conversions per prospect. Smart Bidding, told form starts are valuable, optimises for cheap form starts rather than qualified demos. Primary vs Secondary Settings: The Silent CPA Distorter Only primary conversion actions feed bidding and appear in the Conversions column; secondary actions are observable but do not influence bidding. Primary should contain only actions of genuine business value-purchase, qualified lead, booked call. Micro-actions (form starts, video views, brochure downloads) belong as secondary. Count Settings: 'One' vs 'Every' and the Value Trap 'One' counts a single conversion per click; 'Every' counts each occurrence. For leads, 'One' almost always matches economic reality. For e-commerce, 'Every' can double-count repeat submissions unless deduplicated on order ID. Pair this with value logic: dynamic order value for purchases, static or value-per-action for leads. Static values must reflect the CRM's average deal value-not an arbitrary round number. Attribution Windows: Google Ads vs GA4 Lookback Differences Google Ads defaults to a 30-day click window and 1-day view (display/video); GA4's reporting defaults differ and are configurable. Two systems with different windows will never reconcile to the rand. Pick windows deliberately, document them, and align them where reporting must be comparable. Instrumenting Values Correctly: Dynamic Order Value vs Static Lead Values For e-commerce, dynamic values from the data layer (revenue with a consistent tax definition) avoid the classic double-count where gross revenue is reported but margin funds bids. For lead businesses, use value-per-action modelling or offline imports tied to CRM stage. Precision on values turns a tROAS target into a profitability target rather than a vanity number.

Nov 3, 20266 min read
Read more

Browse by Category

SEO

We deliver data-driven SEO strategies that blend technical excellence, high-quality content, and AI-powered optimisation – ensuring your brand performs across search engines and AI-driven discovery platforms.

CRO

Unlock the full potential of your website’s performance with our comprehensive CRO solutions, tailored to drive conversions and maximise ROI.

Web Design

We develop strategically designed websites that maximizes user experience and drives conversions.

Google Ads

Let us curate a data-driven Google Ads strategy based on your business objectives, geared for results.

Marketing for Amazon

Let us curate a data-driven Amazon marketing strategy based on your business objectives, geared for results.

Social Media Ads

Let us curate a data-driven paid social media ads strategy based on your business objectives, geared for results.

Why Choose Us

500+ Expert Articles

A content hub covering SEO, paid media, CRO and web design for South African businesses.

200+ Success Stories

Campaigns and builds delivered across retail, services, B2B and ecommerce.

200+ Happy Clients

Businesses that trust Prebo Digital with their digital growth.

4.9 Average Rating

Rated 4.9 out of 5 across verified Google reviews.

24h Response Time

Questions answered within one business day, every time.

Google Premier Partner

Premier Partner status since 2022, placing us in the top 3% of agencies.

Amazon Verified Partner

One of the first verified Amazon Ads partners in South Africa.

Meta Business Partner

Certified to run paid social across Facebook, Instagram and beyond.

Get a Quote

Fill out the form below and our team will get back to you within 24 hours

What Our Clients Say

Hear from businesses we have helped succeed

“Great service and professional team.”

ES
Emelda Schuster

“Shout out to Leesha @Prebo Digital for great diligence and care handling our Google Ads account. Other agencies take your money and do nothing until you ask. Not Leesha & Prebo Digital. They do what they say and show up with a friendly face. Work to fix issues. Highly recommended.”

BS
Bradley Schmidt

“Excellent service and support.”

DB
Des Brown

“Very skilled and knowledgeable in the digital industry and you understand the importance of budgets. Start-ups do not have hundreds of thousands to spend at first and you guys really make the most of every budget provided.”

CS
Cat street

“Prebo will take your business to the next level. Extremely smart people, great service. Always go above and beyond.”

MG
Mike Gray

“A dedicated, knowledgeable and enthusiastic team of individuals that are determined to see your brand grow!”

AW
Alastair Waldeck

“A great agency to work with that always provides excellent service. Very professional and dedicated team.”

LV
Lynelle van Niekerk

“In the 4 months since we joined hands with Prebo our leads quantity and quality has increased with much more direct impact on our target market. The team is on point and forever in contact with new ideas and solutions to maximize our potential within the set budget cap. Very innovative group of people!”

RB
Rikus Booyens

“Great service from Prebo Digital team.”

MC
Mothusi Calvin Mogorosi

“Great Agency - growth-minded, a diverse team of talented individuals with collaborative success at its heart”

DD
David Delaney

“Outstanding digital marketing services.”

DD
DUNCAN DUNSHAM

“Industry experts!”

RB
Ricardo Banda

“Excellent work and professional service.”

MM
Menzi Mohale

“Expertise, ethos, excellence”

AJ
Andrew Johnson

“Professional and reliable service.”

ED
Ebert Du Plessis
5.0/ 5
·15 reviews