There are plenty of firms that don't do paid ads or any sort of data-based retargeting of users (think content firms), but the problem likely is that without some sort of analytics, it will be really hard for them to gauge the impact of their work.
For example, a content firm wouldn't need user data to write a blogpost for your company, but they would need some sort of event tracking to measure how many signups came from users who discovered your company via the blogpost.
Figuring out a way to setup attribution and basic event tracking without being invasive or sharing user data with third parties would probably make it easier to find a firm.
