Privacy Policy

Last updated: 16 September 2026

1. Who we are

This policy describes how ANOTHER AGENCY S.R.L. ("we", "the agency") processes data through the application Alta Agentie Ads API ("the application"). We are the data controller for the processing described here.

2. What the application is

Alta Agentie Ads API is an internal back-office tool. It is used only by employees and contractors of the agency to report on, and manage, the advertising accounts that our clients have contracted us to run. It has no public sign-up, is not offered or sold to third parties, and is not accessible to anyone outside the agency.

3. What data the application processes

What the application does not process

• It does not collect or store personal data about people who see or click our clients' advertisements.
• It does not upload, build or manage customer lists or audience segments containing personal data.
• It does not read anyone's email, files, calendar, contacts or any Google Workspace content.
• This website sets no cookies, runs no analytics and no advertising trackers, and does not profile visitors.

4. Why we process it and on what legal basis

• To deliver our services to clients — producing performance reports and managing campaigns on accounts our clients have mandated us to run. Legal basis: performance of a contract (Article 6(1)(b) GDPR) with the client, and our legitimate interest (Article 6(1)(f)) in operating the agency efficiently.
• To authenticate and audit internal users — knowing which employee made which change. Legal basis: our legitimate interest (Article 6(1)(f)) in the security and accountability of changes made to client advertising accounts.
• To meet legal and contractual obligations — retaining records needed for accounting and for demonstrating what was done on a client account. Legal basis: legal obligation (Article 6(1)(c)) and legitimate interest (Article 6(1)(f)).

5. Use of Google user data

The application requests the https://www.googleapis.com/auth/adwords scope, which allows it to read and manage the Google Ads accounts linked to our manager account. Data obtained through Google APIs is used solely to provide and improve the reporting and campaign management functions described in this policy.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, we do not transfer this data to others except as necessary to provide or improve the application, to comply with applicable law, or as part of a merger, acquisition or sale of assets with the user's explicit consent; we do not use it for advertising purposes of our own; and we do not allow humans to read it except with the user's explicit consent, for security purposes, to comply with applicable law, or where the data is aggregated and used for internal operations.

6. Use of Meta platform data

The application uses the Meta Marketing API with the ads_read, ads_management and business_management permissions to read performance data from, and manage campaigns on, the advertising accounts our clients have shared with our business portfolio. We use this data only to operate those accounts on our clients' behalf. We do not sell it, do not transfer it to data brokers, and do not use it to build advertising profiles of individuals.

7. Who we share data with

We do not sell data and we do not share it for anyone else's marketing. Data is disclosed only to:

• The client the data belongs to, in the form of reports and dashboard access.
• Our infrastructure providers, acting as processors on our instructions: the hosting provider that runs our servers and database. They are bound by written data processing terms.
• Google and Meta, as the platforms the data originates from and is written back to.
• Public authorities, where we are legally required to disclose.

Data is hosted within the European Union. We do not transfer personal data outside the European Economic Area for the purposes described in this policy.

8. How long we keep it

• Advertising performance data: up to 36 months, so that year-on-year comparisons remain possible, then deleted.
• Audit log entries: 24 months.
• Authentication credentials: for as long as the integration is active; revoked and deleted when a client relationship ends or the integration is retired.
• Records we must keep for accounting purposes: for the period required by Romanian law.

9. How we protect it

• All communication with Google and Meta is over HTTPS/TLS.
• Developer tokens, OAuth client secrets and refresh tokens are stored in the encrypted secret store of our deployment platform. They are never committed to source control and never exposed to a browser.
• The database is not publicly reachable; access is limited to the application and to named agency staff.
• Access to the internal dashboard requires Google Workspace single sign-on restricted to the alta-agentie.ro domain.
• Every write operation on a client account is logged with the acting user, timestamp, resource and before/after values.

10. Your rights

If we hold personal data about you, under the GDPR you have the right to request access to it, to have it corrected or erased, to have processing restricted, to object to processing based on our legitimate interests, and to receive it in a portable format. You may also withdraw any consent you have given, without affecting processing carried out before the withdrawal.

To exercise any of these rights, write to leonard@alta-agentie.ro. We respond within 30 days. See also our data deletion instructions.

If you believe we have handled your data unlawfully, you may lodge a complaint with the Romanian supervisory authority, the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, Bucharest — dataprotection.ro.

11. Children

The application is a business tool used by agency staff. It is not directed at children and we do not knowingly process the personal data of children through it.

12. Changes to this policy

If we change how the application processes data, we will update this page and change the "last updated" date above. Material changes affecting clients will also be communicated to them directly.

13. Contact

Questions about this policy, or about how the application handles data:
ANOTHER AGENCY S.R.L., Calea Domnească nr. 330, Târgoviște, județul Dâmbovița, Romania
leonard@alta-agentie.ro