What happens to your data.

Controller identity

For the processing described in this Privacy Policy, the controller is generally:

Conflorens d.o.o., operating the AdGranted brand
Blanje 65, 10090 Zagreb (Podsused), Croatia
OIB: 24751171929
VAT ID: HR24751171929
MBS: 081385420
Registered with: Commercial Court in Zagreb (Trgovački sud u Zagrebu)
General contact: info@adgranted.com
Privacy and data-rights contact: privacy@adgranted.com

This Policy concerns personal data for which Conflorens determines the purposes and means of processing. Where Conflorens processes personal data solely on behalf of an AdGranted client as processor, the relevant client normally remains the controller for that processing and the AdGranted Data Processing Agreement governs Conflorens’ processor obligations.

1. Scope

This Policy applies when you interact with AdGranted in a business or organizational context, including when you:

• visit the AdGranted website;
• submit the qualification form or quiz;
• subscribe to newsletter or marketing communications;
• book or attend a discovery or client meeting;
• communicate with AdGranted;
• represent an organization considering or purchasing AdGranted services;
• sign contractual documents;
• receive or pay invoices; or
• otherwise interact with AdGranted as an organizational representative, prospect, client contact, supplier contact, or other business contact.

AdGranted services are sold business-to-business / business-to-organization and are not offered to individuals purchasing as consumers.

2. Personal data we may process

Depending on your interaction, we may process the following categories.

Identity and contact data

• name;
• business email address;
• organization;
• job title or organizational role;
• telephone or other business contact information where supplied.

Qualification and CRM data

• qualification-form or quiz answers;
• organization and website information;
• lifecycle/status information;
• human qualification decisions and reason codes;
• meeting attendance, follow-up, and sales history;
• communications and CRM audit records.

Marketing and preference data

• newsletter or nurture subscription status;
• marketing-consent evidence;
• subscription source and timestamp;
• unsubscribe/suppression status;
• email engagement data where enabled and lawful;
• communication preferences.

Commercial and contract data

• offers and selected services;
• contractual documents and signatures;
• signatory identity and signing audit-trail information;
• invoices, payment state, transaction references, and accounting records.

Client-delivery information

• organizational registration and eligibility information;
• Google account identifiers;
• domain and website information;
• account-access metadata;
• support and delivery communications;
• information reasonably required to perform contracted services.

Technical, website and security data

Depending on the live website and connected systems, we may process IP address, device/browser data, log data, page/referral information, cookie and consent information, conversion/event data, security records, and similar technical information.

3. Purposes and legal bases

The table below describes our principal controller purposes and legal bases. A different basis may apply where required by the specific circumstances or applicable law.

Purpose	Main personal data	Legal basis
Responding to direct enquiries and communicating with organizational representatives	Identity/contact, communications	Legitimate interests in responding to business enquiries and administering business communications; steps before contract where Article 6(1)(b) GDPR applies to the individual
Qualification and Discovery	Identity/contact, qualification, organization/website information, meeting records	Legitimate interests in assessing organizational fit, preventing unsuitable sales, and managing the B2B sales process; steps before contract where applicable
Preparing and administering contracts and client relationships	Identity/contact, contract, delivery data	Legitimate interests in administering organizational contracts; contract where Article 6(1)(b) applies to the individual; legal obligations where applicable
Delivering AdGranted services in our own controller capacity	Contact, delivery, access metadata, communications	Legitimate interests in delivering, documenting, securing, and supporting services purchased by the organization
Invoicing, accounting and tax compliance	Identity/contact, invoice/payment/accounting records	Legal obligation and legitimate interests in payment administration and financial recordkeeping
Newsletter and standard AdGranted marketing nurture	Identity/contact, marketing preferences, engagement data	Consent for the standard AdGranted newsletter/nurture route and any other permission required by applicable electronic-marketing law
Researching organizations that may fit the service and contacting a relevant staff member by business email (B2B prospecting)	Business identity/contact (name, role, business email), public organization and website information, research and outreach records	Legitimate interests in identifying nonprofit organizations that may benefit from the service and offering it to the person responsible for the relevant area, in line with applicable electronic-marketing rules for business recipients; an objection ends the contact permanently
Maintaining suppression/opt-out records	Email/contact identifier, opt-out record	Legitimate interests and compliance interests in ensuring marketing objections and withdrawals continue to be honored
Website analytics and advertising/measurement technologies that require consent	Online identifiers, device/browser data, events/conversions	Consent where required
Strictly necessary website/security operation	Technical and security data	Legitimate interests in operating, securing, preventing abuse of, and troubleshooting the website and systems; legal obligation where applicable
Fraud, security and incident management	Contact, technical, access, security and audit data	Legitimate interests in protecting systems, clients, users and legal rights; legal obligations where applicable
Establishing, exercising or defending legal claims	Relevant contract, communications, security, payment and other evidential records	Legitimate interests in protecting legal rights; legal obligations where applicable
Service/process improvement using minimized business data	Relevant operational and usage records	Legitimate interests in improving standardized services and internal operations, balanced against individual rights

Where we rely on legitimate interests, the relevant interests generally include operating and protecting the AdGranted business, assessing whether organizations fit the service, communicating with organizational representatives, administering contracts, preventing fraud and abuse, maintaining evidence, and improving service operations. We consider the nature of the data, the business context, reasonable expectations, and the potential effect on individuals before relying on that basis.

Where consent is the basis, you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

4. Marketing communications

The standard AdGranted newsletter and automated nurture route uses an auditable consent record.

Where consent is required, we do not treat GDPR legitimate interests by itself as permission to send electronic direct marketing that separately requires prior consent under applicable electronic-communications or e-commerce rules.

AdGranted may send a short series of business emails to a staff member of a nonprofit organization whose work suggests the service may be relevant, using a business email address the organization publishes. These prospecting emails are sent through Smartlead from a separate AdGranted sending domain, not through MailerLite. Each one identifies AdGranted and why it was sent, and includes a simple way to object. An objection, including a reply asking not to be contacted, is recorded on a suppression list, and no further prospecting email is sent to that address.

We currently use MailerLite for approved newsletter and marketing-email activity. MailerLite may provide ordinary delivery and engagement information, such as delivery/open/click data, where enabled and lawful.

You may unsubscribe using the unsubscribe mechanism in the message or by contacting us at privacy@adgranted.com. Withdrawal from marketing does not automatically delete business, contract, security, or legal records that we have another lawful reason to retain.

We retain minimum suppression information where reasonably necessary to prevent future marketing from being sent contrary to your opt-out.

5. Sources of personal data

We usually receive personal data directly from you or from the organization you represent.

We may also receive relevant business information from:

• public nonprofit, charity, business, or company registers;
• the organization’s public website;
• public organizational materials;
• Google, Goodstack, or other service communications supplied or authorized by the client;
• connected business platforms used in the relationship;
• authorized representatives of your organization; and
• service providers acting on our behalf.

Where we obtain personal data indirectly, the categories are generally business identity/contact information, organizational role, public organization information, and information relevant to qualification or service administration.

6. Required and optional information

Some information is required to evaluate or provide a requested service. For example, we may require:

• organization and website details for qualification;
• an authorized contact and billing information to enter and administer a contract;
• eligibility documents or declarations where needed for Google for Nonprofits or Google Ad Grants work;
• required account access to perform accepted technical work; and
• payment information necessary to process an invoice or payment.

Where requested information is necessary to enter into or perform the organizational service and it is not provided, we may be unable to qualify the organization, issue or complete an Order Form, begin work, continue affected work, or provide the relevant service component.

Information marked optional in a form or communication is not required for the stated transaction unless we later explain why it has become necessary for a specific requested service.

7. Automated processing and AI assistance

AdGranted may use approved automation and commercial/API AI services to assist with tasks such as organizing submitted information, drafting or personalizing business communications, summarizing information, or supporting internal workflow.

When AdGranted researches whether an organization may fit the service, automated tools may read the organization’s public website and draft an assessment, and may sort replies to prospecting emails and draft answers. A person at AdGranted reviews every organization before any contact is made and approves every answer before it is sent.

The standard AdGranted MQ/suitability decision is human reviewed. We do not use solely automated decision-making that produces legal effects or similarly significant effects on an individual as part of the standard qualification process.

Where this changes in a way that triggers additional transparency obligations under applicable law, this Policy and the relevant process will be updated before that use is introduced.

Consumer ChatGPT or Claude accounts are not approved for processing AdGranted lead, client, or client-controlled personal data. Approved AI processing involving personal data must use authorized commercial/API environments and appropriate data-minimization controls.

8. Service providers and recipients

We use service providers and business systems to operate AdGranted. Depending on the activity, these currently include:

• Cloudflare for website infrastructure;
• Cookiebot for cookie consent management;
• MailerLite for marketing email;
• Calendly and Google Workspace for scheduling and communications;
• Google Meet for meetings;
• DocuSign for electronic signatures;
• solo.com.hr / COAX d.o.o. for invoicing;
• Stripe for payment processing;
• Firecrawl for reading the public pages of an organisation’s website;
• Bouncer for checking that a business email address can receive mail;
• Smartlead for sending business prospecting email;
• Make for automation;
• ClickUp for CRM;
• Google Workspace / Shared Drive for file storage;
• LastPass for credential management;
• Hetzner for dashboard infrastructure; and
• approved commercial/API OpenAI and Anthropic services where AI processing is authorized and appropriate.

We may also disclose information to professional advisers, insurers, auditors, authorities, courts, payment networks, or other recipients where reasonably necessary for legal compliance, security, claims, or the requested business transaction.

Some providers act as our processors, while others may act as independent controllers or have mixed roles for specific processing. We assess the role based on the actual processing activity rather than treating every vendor identically.

ClickUp AI is disabled for AdGranted CRM personal data.

9. Payments

Stripe may process payment-related personal data in processor and/or independent-controller roles depending on the payment activity. Stripe independently handles certain processing required for payment networks, fraud prevention, security, and legal/regulatory purposes under its own applicable documentation.

We do not intentionally store full payment-card credentials in the AdGranted CRM.

10. International transfers

Some service providers may process personal data outside the European Economic Area.

Where a restricted international transfer occurs, we use or rely on an applicable lawful mechanism such as:

• an adequacy decision;
• an applicable Data Privacy Framework where legally available;
• Standard Contractual Clauses together with supplementary measures where required; or
• another lawful transfer mechanism.

You may request information about the safeguard relevant to your personal data, including how to obtain a copy of applicable contractual safeguards where disclosure is legally and contractually permitted, by contacting privacy@adgranted.com.

11. Retention

Our current controller retention approach includes:

• invoices and required accounting records: 11 years or longer where legally required;
• signed MSA, Order Forms, DPA, and material contract evidence: 5 years after final termination or closure;
• active client CRM data: for the duration of the active relationship;
• former-client CRM/commercial records: 5 years after final closure, after which non-required personal data is deleted or anonymized;
• unsuccessful Discovery/Opportunity records: 24 months after closure;
• Non-MQ and closed Lead records: 24 months after last meaningful activity;
• B2B prospecting records that did not become a Lead or client relationship: 12 months after the last prospecting email or, where no email was sent, after the record was created, after which the personal data in them is deleted, except the minimum suppression record;
• active newsletter subscriber information: while subscribed;
• minimum suppression information: for as long as reasonably necessary to honor the opt-out;
• marketing-consent evidence: while relied upon plus an appropriate evidential period after withdrawal or cessation;
• client eligibility/application working documents: 12 months after final engagement closure unless longer retention is justified;
• temporary credentials: removed or revoked as soon as no longer required;
• AdGranted-controlled dashboard personal data after hosting ends: deleted or irreversibly de-identified within 30 days unless limited retention is justified; and
• residual dashboard backups: targeted to expire within 90 days.

A record may be retained longer where necessary for law, accounting, security, dispute resolution, fraud prevention, or the establishment, exercise or defense of legal claims. Where possible, retained data is minimized for that purpose.

12. Security

We use organizational and technical measures designed to provide security appropriate to the relevant risk. Depending on the system, these include access restrictions, secure credential handling, authenticated systems, encryption in transit, server-side handling of secrets, tenant/client separation, data minimization, controlled vendor access, access revocation, and incident-response procedures.

No organization can guarantee absolute security, but we review controls as the service and risk environment change.

13. Your rights

Where the GDPR or similar law applies, you may have rights including:

• access to your personal data;
• correction of inaccurate data;
• erasure in applicable circumstances;
• restriction of processing;
• objection to processing based on legitimate interests;
• an absolute right to object to direct marketing;
• data portability where applicable;
• withdrawal of consent; and
• complaint to a competent supervisory authority.

Requests should be sent to privacy@adgranted.com.

We may need to verify your identity before acting on a request. Rights are subject to the conditions, limitations, and exemptions in applicable law.

14. Complaints

You may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP) or another competent supervisory authority where applicable.

Contacting us first is not a condition of your right to complain, but you may contact privacy@adgranted.com if you want us to investigate the issue directly.

15. Cookies and tracking technologies

The current AdGranted website tracking implementation includes, where deployed on the relevant page or journey:

• Google Analytics 4 for analytics;
• Google Ads conversion tracking for advertising/conversion measurement;
• Meta Pixel for Meta advertising/measurement;
• Microsoft Advertising tracking for Microsoft Ads measurement; and
• Microsoft Clarity for website usage/session analytics.

Strictly necessary technologies may operate without consent where legally permitted. Non-essential analytics, advertising, or measurement technologies that require consent must not be activated before the applicable consent is obtained.

The website should provide a consent-management interface that identifies the categories and allows users to make and change consent choices where required. The current provider/category summary and the requirement for a live individual cookie/storage list are described in the AdGranted Cookie & Tracking Notice.

MailerLite may also use email-specific delivery and engagement technologies in marketing messages as described in section 4.

Any future material tracker addition or change must be reviewed before deployment and reflected in the applicable cookie/consent information where required.

16. Website legal information

Additional company and website-provider information required for the AdGranted website is maintained in the AdGranted Website Legal Notice / Company Information.

17. Changes to this Policy

We may update this Policy where our processing, providers, services, or legal obligations change. The current published version will display its effective date.