Privacy Policy
This policy explains what personal data Adlumen Ad Agency collects, why we collect it, how long we keep it and what you can require us to do with it. It covers this website and the work we do for advertisers.
01Who we are
The controller of the personal data described in this policy is:
| Company | OÜ ADLUMEN, trading as Adlumen Ad Agency |
| Registry code | 17533350 |
| Registered office | Kooli tn 3-2, Laagri alevik, Saue vald, 76401 Harju maakond, Estonia |
| mail@adlumen.ai | |
| Telephone | +372 5562 7009 |
We have not appointed a Data Protection Officer, because we are not required to under Article 37 of the GDPR. Privacy questions go to the address above and are handled by our management.
02What this policy covers
This policy applies to:
- visitors to adlumen.agency;
- people who send us a brief, write to us or call us;
- the representatives of our clients and suppliers, whose contact details we hold in order to work together.
It does not cover other websites we link to, including the websites of the advertising platforms we buy media on. It also does not cover the personal data we handle on behalf of a client — section 4 explains that separately, because the law treats it differently.
03Data we collect and why
We collect only what we need, and each purpose below has a legal basis under Article 6 of the GDPR.
The brief form
When you send a brief through this website you give us your name, a Telegram handle or an email address (or both), a link to your product, an indication of your monthly advertising budget and the countries and target cost per result you have in mind. We use this to prepare a media plan and a forecast and to reply to you. If you give us both contact methods, we contact you on Telegram first.
Legal basis: Article 6(1)(b) — steps taken at your request before entering into a contract. Where you write on behalf of a company rather than as an individual, the basis is our legitimate interest in responding to a business enquiry, Article 6(1)(f).
The budget and target figures you give us are commercial information about your business. We treat them as confidential and do not share them outside the people who need them to prepare your answer.
Correspondence
Email, Telegram messages, calls and meeting notes are kept so that we can answer you, keep track of what was agreed and defend ourselves if a dispute arises later.
Legal basis: Article 6(1)(b) where it concerns a contract or a prospective contract, otherwise Article 6(1)(f).
Client and supplier records
If we work together, we hold the contact details of the people who represent the company, together with contracts, invoices, payment records and campaign reporting.
Legal basis: Article 6(1)(b) for performing the contract, and Article 6(1)(c) for the accounting and tax records Estonian law requires us to keep.
Technical records of your visit
Our hosting provider records the usual server information — IP address, browser type, the page requested, the date and time — in order to serve the site and to detect abuse. These logs are not used to build a profile of you.
Legal basis: Article 6(1)(f), our legitimate interest in a site that works and is not attacked.
Measurement
We do not run any analytics or advertising trackers on this website unless you have accepted them through the cookie banner. If you accept, we load Google Analytics 4 (measurement ID G-BFV20FX4R4) to measure page views and interactions. Google may receive approximate location and browser/device information. We also store the first and latest advertising-link parameters in your browser for up to 30 days and may attach them to a brief. If you decline, analytics stays off and no campaign attribution is stored.
Legal basis: Article 6(1)(a), your consent, which you can withdraw at any time through the "Cookie settings" link in the footer.
04Campaign data: when we are not the controller
This section matters if you are our client rather than a visitor.
When we run campaigns for you, some of the data that moves through the work is personal data belonging to your customers — for example the conversion records you send us so that campaigns can be optimised on revenue rather than clicks, including where those records are supplied to us in hashed form.
For that data you are the controller and we are a processor acting on your documented instructions. We put a data processing agreement in place under Article 28 of the GDPR before any such data is exchanged. Under it we will:
- process that data only to deliver the services you have engaged us for;
- impose confidentiality on everyone we allow to handle it;
- use only sub-processors you have approved, and remain answerable for them;
- help you respond to requests from your own customers and to security incidents;
- return or delete the data when the engagement ends, as you choose.
The advertising platforms are a separate matter. Meta, Google, TikTok, Bigo and Unity determine their own purposes for the data they receive and act as independent controllers, or as joint controllers with the advertiser where their own terms say so. Their handling of that data is governed by their terms, not by this policy.
05Cookies and browser storage
The site stores your choices and, only after consent, campaign attribution in your browser's local storage. The optional analytics tag may set Google Analytics cookies such as _ga.
| What | Why | Kept for |
|---|---|---|
| adlumen_analytics_consent | Remembers whether you accepted or declined optional analytics and attribution | Until you clear it or change it |
| adlumen-language | Remembers the language you chose | Until you clear it |
| adlumen-ui-theme | Remembers the light or dark setting | Until you clear it |
| adlumen_campaign_attribution | Remembers first and latest advertising-link parameters after consent; may be included with a brief | Up to 30 days |
Your consent choice, language and theme are functional settings. Campaign attribution is optional, created only after you accept, and cleared when you withdraw consent. Google Analytics cookies load only after acceptance. Use Cookie settings in the footer to change your choice, or clear site data in your browser.
06Who we share data with
We do not sell personal data and we do not share it for anyone else's marketing. We disclose it only to:
- Service providers who work for us — website hosting and bot protection by Vercel, database storage by Neon, Google Analytics, and notification delivery to our private Telegram group. Our team members who can access that group may read the brief and the notification. We may also disclose data to accounting and legal advisers where needed.
- Advertising platforms — Meta, Google, TikTok, Bigo and Unity, where campaign delivery requires it, on the footing described in section 4.
- Authorities — where we are legally obliged to, or where we need to establish or defend a legal claim.
- A buyer — if the business is sold or reorganised, in which case the data follows the business and this policy continues to apply until the buyer tells you otherwise.
07Transfers outside the EEA
We are based in Estonia and keep data in the European Economic Area wherever we can. Some of the advertising platforms and service providers we work with process data in the United States or in Asia.
Where that happens, the transfer is covered by one of the safeguards Chapter V of the GDPR allows: an adequacy decision of the European Commission, including certification under the EU–US Data Privacy Framework where the recipient is certified, or the European Commission's Standard Contractual Clauses together with any additional measures the transfer requires. You can ask us which mechanism applies to a specific recipient and we will tell you.
08How long we keep data
| Data | Kept |
|---|---|
| A brief that does not lead to an engagement | While needed to respond and follow up, then deleted when no longer needed, subject to unresolved claims and legal duties. The form database does not currently enforce an automatic expiry period. |
| Correspondence with a prospective client | As long as needed to respond, follow up, resolve disputes or meet legal duties |
| Contracts, invoices and accounting records | 7 years from the end of the financial year, as the Estonian Accounting Act requires |
| Campaign and customer data processed for a client | As stated in the applicable data processing agreement; returned or deleted at the end as instructed |
| Vercel function runtime logs | 3 days under Vercel's current default log retention |
| Record of your consent choice, language and theme | In your browser only, until you change or clear it |
Where a claim is pending or reasonably expected, we keep what the claim requires until it is resolved, and no longer.
09Your rights
Under the GDPR you can require us to:
- tell you what we hold about you and give you a copy (Article 15);
- correct anything inaccurate or incomplete (Article 16);
- delete data we no longer have a reason to keep (Article 17);
- restrict what we do with it while a dispute about it is resolved (Article 18);
- hand it over to you or to another provider in a machine-readable form, where we hold it on the basis of consent or a contract (Article 20);
- stop processing based on our legitimate interests, if your situation outweighs them (Article 21).
Where we rely on your consent, you can withdraw it at any time. Withdrawing it does not make what we did before it unlawful.
Write to mail@adlumen.ai and we will answer within one month. If the request is complex we may take up to two months more, and we will tell you within the first month if that happens. We do not charge for this unless a request is manifestly unfounded or excessive.
10Automated decisions
We do not make decisions about you by automated means alone, and we do not profile you.
11Security
We keep data on services that encrypt it in transit and at rest, we restrict access to the people who need it for their work, we require confidentiality from everyone who has access, and we review those arrangements periodically. If a breach occurs that is likely to put your rights at risk, we will notify the Data Protection Inspectorate within 72 hours and tell you directly where the law requires it.
12Children
Our services are sold to businesses. This website is not directed at children and we do not knowingly collect data from anyone under 18. If you believe a child has sent us personal data, write to us and we will delete it.
13Changes
We update this policy when what we do with data changes. The version number and dates at the top always show the current text. If a change materially affects your rights, we will say so on this page and, where we have your contact details and the change warrants it, tell you directly.
14How to contact us
OÜ ADLUMEN · Tallinn, Estonia · registry code 17533350
mail@adlumen.ai · +372 5562 7009
This policy is published in English. Any translation is provided for convenience, and the English text governs.