Last updated: November 9, 2026
At Space Ads, we take your privacy seriously. This policy outlines how we collect, use, and protect your personal information in compliance with GDPR, CCPA/CPRA, and applicable data protection laws.
If you are a California or US resident, you have specific privacy rights under state law. Please see the US Privacy Rights and California-Specific Rights sections below.
Do Not Sell or Share: We do not sell your personal information for money. However, we share data with advertising partners (Google, Meta) for targeted advertising. You can opt out via our Cookie Preferences.
Section 1
Your personal data is processed by Space Ads spółka z o. o. with its registered office in Warsaw (address: ul. Plac Bankowy 2, 00-095 Warsaw, Poland; registration: District Court for the capital city of Warsaw in Warsaw, company/reg. no.: 0001011955; tax ID number: PL 5252938464; share capital: PLN 10 000; the "Controller") in accordance with the Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation; the "GDPR") and with other applicable data protection laws.
Section 2
The Controller has not appointed a data protection officer; You, as the Data Subject, may contact the Controller in matters relating to the processing of your Personal Data and in order to exercise the rights provided for in the GDPR or other applicable provisions of the law on the protection of personal data at the following e-mail address: partners@
Section 3 - Data We Collect
The processing carried out by the Controller may involve certain data, the provision of which is necessary for:
communication by way of a contact form (processed via our secure API hosted on Vercel Serverless Functions; data includes: first and last name, e-mail address, telephone number, message content, and the URL of the page the form was submitted from, including any campaign/UTM parameters);
scheduling consultations and recruitment interviews via our self-hosted booking system (name, email address, optionally website URL and message, time zone — selected automatically). We use US-based providers Vercel and Neon; the booking application and database are configured in Frankfurt regions. The provider’s location and possible access from outside the EEA are separate from the infrastructure region; transfer safeguards are described in this Privacy Policy. Meetings take place via Google Meet (Google Workspace);
preparation and conclusion of an agreement for consultations, audits or other services provided by the Controller (first and last name, physical and email address, telephone number, tax ID number, company information);
analytics and website usage via Google Analytics 4 and Microsoft Clarity (IP address, browser type, device information, pages visited, time spent on pages, referring website, session recordings, heatmap data);
targeted advertising (cookie identifiers, ad interaction data, conversion data).
as well as other information relating to You as an identified or identifiable natural person ("Personal Data") that you decide to disclose, transfer or otherwise freely and knowingly make available to the Controller.
Section 4 - Legal Basis
As a general rule, your Personal Data will be processed on the basis of consent (Article 6.1.a GDPR), contract (Article 6.1.b GDPR), legal obligation (Article 6.1.c GDPR), or legitimate interests (Article 6.1.f GDPR).
Section 5 - Consent
Website analytics and advertising require separate permission (GDPR Article 6(1)(a) and Article 399 of Poland’s Electronic Communications Law). Electronic direct marketing additionally requires prior permission under Article 398. Enquiries and meeting logistics instead rely on Article 6(1)(b), where you request a service or pre-contractual steps, or Article 6(1)(f) for contact with a business representative. Declining tracking does not block forms, bookings or requested service emails.
If the legal basis for processing is consent (Article 6.1.a of the GDPR), the Controller will ensure that Your consent to processing is freely given, specific, informed, and unambiguous. You have the right to withdraw your consent at any time. The withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.
Section 6 - Contract & Legal Obligations
If the legal basis for processing is a contract (Article 6.1.b of the GDPR), the Controller will process your Personal Data to the extent necessary for the performance of a contract to which You are a party, or in order to take steps at Your request prior to entering into a contract. The processing of your Personal Data may also take place in order to comply with legal obligations incumbent on the Controller, resulting in particular from tax and accounting regulations (Article 6.1.c of the GDPR).
Section 7 - Legitimate Interests
The Controller may process your Personal Data for the purpose of direct marketing, fraud prevention, system security, and defense against possible claims (Article 6.1.f of the GDPR). Our legitimate interests include maintaining the security and integrity of our systems and improving our services.
Authorised clients and team members may access private Space Ads services using Google, Microsoft, or a sign-in link sent to their email address. We process account identifiers supplied by the sign-in provider, an email address and display name where supplied, the access permissions assigned by Space Ads, and session and security records such as sign-in time, IP address and browser information. We use this information to authenticate users, provide their authorised services and protect accounts against misuse.
For sign-in, we request identity information only. Signing in does not grant us access to your Google or Microsoft mailbox, files, contacts or calendar. Any separate integration, such as booking meetings, has its own purpose and permissions. We do not collect your Google or Microsoft password. Google and Microsoft process authentication under their own privacy policies, available at Google Privacy Policy and Microsoft Privacy Statement.
Access is limited to accounts authorised by Space Ads. Signing in does not create an entitlement to another client’s information. Hosting and database providers listed below process the account and security records needed to operate these services.
Private services use necessary authentication and security cookies. Session and sign-in cookie lifetimes depend on the service. For private client reporting, OAuth sign-in cookies expire after ten minutes and a signed-in session can last up to 24 hours. Email sign-in links are valid for fifteen minutes. A linked Microsoft account remains connected until disconnected or the local account is deleted. Security and sign-in history are stored separately from active sessions; ending a session does not erase that history. Contact partners@
Section 8
The Controller may use external service providers and their resources to conduct activities that involve your Personal Data. Your Personal Data may be disclosed to:
Hosting & Infrastructure
Vercel Inc. (AWS edge network), Neon Inc. (PostgreSQL)
Analytics
Google Analytics 4, Microsoft Clarity
Advertising Platforms
Google Ads, Meta (Facebook) Ads
Scheduling, Newsletter, Lead Magnets
Self-hosted forms platform (forms.spaceads.agency · Vercel + Neon), Google Meet (Google Workspace), Amazon SES (email delivery)
Internal Team Notifications
Slack (Slack Technologies, part of Salesforce) — our team messaging tool. When a new enquiry or meeting request arrives, a short notification goes to an internal team channel: your name, your company or website domain, the source of the enquiry (for a meeting request: the meeting type and time) and a link to our admin panel. We do not send your email address, phone number or message text. Slack acts as our processor (Article 28 GDPR). The notification stays in Slack under our workspace retention settings and is not deleted automatically when we delete the enquiry from our own system, so we delete it manually if you ask us to erase your data.
Newsletter & Welcome Pack
The 2027 Playbook is a welcome bonus for explicitly joining the newsletter. The form requires an initially unticked consent box for newsletter insights, case studies and information about our services, followed by email confirmation. You can unsubscribe at any time without shortening the granted 30-day pack access; a request to erase your data may end access linked to that data. Unconfirmed orders are deleted when the verification link expires, during the next automatic cleanup (the link is valid for 7 days after the request). Confirmed order data is kept until the 30-day resource access expires. Deleting an order does not delete an independent newsletter subscription. Newsletters and marketing sequences require prior consent (GDPR Art. 6(1)(a) and Art. 398 of the Polish Electronic Communications Law); we record the consent wording version and confirmation evidence. Operational meeting and webinar messages support the services you requested.
To tailor manual newsletters, we may classify an organization’s business type (for example, a business or an agency/freelancer) using the email domain and the company’s public website. We record the source and verification date, and an operator can correct the classification. We do not infer private or sensitive personal characteristics from this information. Classification does not replace marketing consent. Withdrawal of consent or an objection ends use of the data for marketing, including this content tailoring. An individual assignment is deleted with the newsletter profile.
Section 9
The above-mentioned recipients represent the current service providers with whom the Controller shares Personal Data. The Controller will provide the most up-to-date list of recipients at your request, submitted by e-mail to the Point of Contact.
Section 9a - Advertising & Analytics Recipients: GDPR Roles & Safeguards
The data depends on the purpose. Google Analytics and Clarity receive site-use information after analytics consent; we do not send form email addresses or phone numbers to GA4. With advertising permissions, Google Ads and Meta may receive event IDs, page URLs without private parameters, IP addresses, browser details and cookie/click identifiers. Submitted email or phone details may also be normalised and SHA-256 hashed for conversion matching. Hashing is pseudonymisation, not anonymisation: a platform may match a hash to data it already holds. We do not send message bodies, booking notes or access tokens.
Google — Google Ireland Ltd (US: Google LLC)
For Google Analytics 4 and Enhanced Conversions data, Google acts as a processor under the Google Ads Data Processing Terms. Other advertising operations may be governed by controller-to-controller terms. The role depends on the service and processing operation. Transfers to a certified US recipient may rely on the EU–US Data Privacy Framework while the adequacy decision remains in force; other transfers require appropriate safeguards, such as SCCs and a transfer assessment.
Privacy Policy · Ads Controller-Controller Terms · Ads Data Processing Terms
Meta (Facebook, Instagram) — Meta Platforms Ireland Ltd (US: Meta Platforms, Inc.)
For the Meta Pixel and the Conversions API, Meta and the Controller are joint controllers (Article 26 GDPR) for collecting and transmitting the event data; Meta is an independent controller for its subsequent use. Transfers to the US rely on the EU-U.S. Data Privacy Framework (Meta Platforms, Inc. is certified) and Standard Contractual Clauses. The essence of the joint-controller arrangement is set out in Meta's Controller Addendum.
Meta Lead Ads (instant forms). If you submit one of our instant forms on Facebook or Instagram, Meta passes us the details you entered (for example name, email address, phone number, company and answers to the form questions), the Meta lead ID and the identifiers of the ad and form. We handle them like any other enquiry (Article 6(1)(b) GDPR, or Article 6(1)(f) for contact with a business representative) and keep them for the same period. To measure which ads bring relevant enquiries and to optimise their delivery, we report the stage of your enquiry back to Meta through the Conversions API: the Meta lead ID, the stage (new, qualified, meeting booked, meeting held, no-show, not a fit, won or lost), the time of the change, and your email address and phone number hashed with SHA-256. We do not send your answers, messages or our notes. Unlike website measurement, which relies on consent, this reporting relies on our legitimate interest in measuring and improving our advertising (Article 6(1)(f) GDPR); the joint-controller arrangement above covers its collection and transmission. You can object at any time by writing to the Point of Contact, and we will stop reporting stages for your enquiry.
Microsoft Clarity — Microsoft Ireland Operations Ltd (US: Microsoft Corporation)
Microsoft Clarity provides heatmaps and session replay. Microsoft is an independent controller (not our processor) and uses the data for its own purposes, including improving its products and advertising. Transfers to the US rely on the EU-U.S. Data Privacy Framework (Microsoft Corporation is certified) and intra-group Standard Contractual Clauses. Clarity loads only after you grant analytics consent.
Our hosting, infrastructure and internal messaging providers (Vercel Inc., Neon Inc., Amazon Web Services / Amazon SES, Slack) act as our processors under Article 28 GDPR data-processing agreements. Where a transfer relies on the EU-U.S. Data Privacy Framework, it does so for as long as the European Commission's adequacy decision of 10 July 2023 remains in force.
Section 10
Your Personal Data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States, through our use of service providers such as Vercel Inc., Google (Analytics, Ads, Calendar), Meta, Microsoft (Clarity), and Slack (internal team notifications). Our primary data regions are in the EEA; this does not exclude provider access or support from outside the EEA: our database in Neon (Frankfurt, Germany, eu-central-1) and outbound email in Amazon SES (Dublin, Ireland, eu-west-1).
These transfers are protected by appropriate safeguards, including:
Standard Contractual Clauses (SCCs) approved by the European Commission;
EU-U.S. Data Privacy Framework certification (where applicable);
Other appropriate safeguards as required by applicable data protection laws.
You may obtain a copy of the safeguards in place by contacting us at partners@
Section 11
We retain your Personal Data only for as long as necessary to fulfill the purposes for which it was collected. Specific retention periods include:
Meeting logistics data
The form shows the booking mode: host approval, automatic confirmation or email verification. Host-reviewed requests await a decision until the deadline displayed after submission, taking business hours and the meeting start into account. Email-verification links are valid for one hour. Expired-request data is deleted seven days after expiry; declined requests follow the cancelled-booking retention period. Cancelled records are kept for up to 30 days after cancellation, no-show records for up to 30 days after the meeting ends, and basic meeting logistics history for up to 12 months after the meeting ends. IP and browser details are removed after 30 days from the request, and messages, additional answers and notes within 90 days after the meeting, or earlier when the booking is erased.
These rules cover meeting logistics, including recruitment interview appointments. Candidate assessment and employment documentation require their own purpose and retention period. Booking does not subscribe you to the newsletter or grant permission for future recruitment. The basis is arranging a meeting or service or taking steps before a contract at your request (GDPR Article 6(1)(b)), or our legitimate interest in contact with a company representative (Article 6(1)(f)). Necessary evidence, complaints and actual client records follow separate, justified periods; exceptions are limited to necessary data and subject to review.
Erasure covers local booking data and redaction of associated logs. Recipient addresses in operational sending logs are retained for up to 90 days or less on erasure, raw feedback and diagnostics for up to 30 days, and limited technical metrics for up to 12 months. Removal or minimisation of Google Calendar copies is handled separately after verifying the original calendar. Provider trash, mailboxes and independent recipient copies have their own cycles. Technical identifiers of erased bookings are retained for up to 13 months to prevent ID reuse, restoration of erased data and late-event data resurrection. For a broader data protection request, we also review independent CRM, newsletter and controlled external records; newsletter withdrawal does not cancel a meeting.
Contact Form Submissions
2 years or until the inquiry is resolved, whichever is longer
Client Contracts & Service Data
5 years after contract termination (for tax and legal compliance purposes)
Analytics & Marketing Data
Retention depends on the purpose and the relevant service’s retention settings, independently of cookie lifetime. We remove our own data when its purpose ends, with separate limited retention for necessary evidence. Advertising-platform data also follows the providers’ linked policies. You can request details of the applicable settings and periods.
Cookie Consent Records
Up to 12 months, then re-requested
When a resource order is deleted, its sending jobs and access links are removed and its recipient address and detailed associated mail logs are redacted. Technical feedback that cannot be linked to a recorded send loses its recipient, raw payload and diagnostics after 30 days. Limited operational sending and delivery records may remain for up to 12 months; pseudonymisation does not mean full anonymity. Technical identifiers of deleted orders, without an email, name, IP or token, are retained for 13 months to prevent identifier reuse. A suppression list retains only what is needed to respect an opt-out, complaint or delivery block; IP and browser identifiers on that list are removed after 30 days. Newsletter consent evidence follows separate retention rules. Deletion from the active database does not mean immediate deletion from rotating backups or independent provider systems; applicable deletions and suppression are reapplied when restoring data.
After the retention period expires, we will securely delete or anonymize your Personal Data, unless a longer retention period is required or permitted by law.
Section 12
Where the GDPR applies to our processing, you have the following rights:
Right of Access
Request a copy of your personal data
Right to Rectification
Correct inaccurate data
Right to Erasure
Request deletion of your data
Right to Data Portability
Receive data in portable format
Right to Restriction
Limit how we process your data
Right to Object
Object to certain processing
Section 13 - Response Time
The Controller will respond to your request without undue delay and in any event within one month of receipt. This period may be extended by two further months where necessary, taking into account the complexity and number of requests. We explain an extension and its reasons within the first month.
Section 14 - How to Exercise Your Rights
To exercise any of these rights, please contact us at partners@
Newsletter subscribers, lead-magnet recipients, and webinar registrants can exercise the right to erasure (Article 17 GDPR) directly — every marketing email contains an "Unsubscribe" link, and the unsubscribe page offers a mailbox-verified option to delete your marketing records, resource requests and eligible form records; business records requiring retention or review are handled separately. Only your address is retained on a suppression list so we cannot accidentally re-email you after an import.
Section 15 - Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority, in particular in the Member State where you reside, work, or where an alleged infringement of the GDPR occurred. In Poland, the supervisory authority is the President of the Personal Data Protection Office (UODO).
Section 16
If you are a resident of certain U.S. states (including Virginia, Colorado, Connecticut, Utah, and Montana), you may have additional privacy rights under state law, including:
Right to confirm whether we process your personal data and access that data
Right to correct inaccuracies in your personal data
Right to delete your personal data
Right to obtain a copy of your personal data in a portable format
Right to opt out of targeted advertising, sale of personal data, and profiling
Section 17 - Exercising Your Rights
To exercise these rights, please email partners@
Section 18 - Non-Discrimination
We will not discriminate against you for exercising any of your privacy rights under state law.
Section 19 - Your California Rights
If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
Right to Know
Request disclosure of personal data collected, used, disclosed, or sold
Right to Delete
Request deletion of personal data
Right to Correct
Request correction of inaccurate personal data
Right to Portability
Receive a copy of your data in portable format
Right to Opt-Out
Opt out of sale/sharing of personal data
Right to Limit
Limit use of sensitive personal data
Section 20 - Categories of Personal Information
We collect and process the following categories of personal information:
• Identifiers: Name, email address, IP address, cookie identifiers
• Commercial Information: Products/services purchased or considered
• Internet Activity: Pages and interactions on our website, not your browser history across other sites
• Professional Information: Company name, job title, business contact information
Section 21 - Sale and Sharing of Personal Information
We do not sell your personal information for monetary consideration. However, we do "share" personal information with advertising partners (Google, Meta) for cross-context behavioral advertising, which may be considered a "sale" under California law.
Categories shared: Identifiers (cookie IDs, IP addresses), Internet Activity (browsing behavior, ad interactions)
Section 22 - How to Opt-Out of Sale/Sharing
To opt out of the sharing of your personal information for targeted advertising purposes, you can:
• Use our Cookie Preferences tool (available in the footer)
• Disable analytics and advertising cookies in the cookie banner
• Email us at partners@
Section 23 - Response Time & Verification
We will respond to your request within 45 days. For access, correction or deletion, we may request proportionate identity verification. Opting out of advertising sharing does not require an account or identity verification; Global Privacy Control is honoured for the browser sending it. You may designate an authorized agent to make requests on your behalf by providing written authorization.
Section 24 - Non-Discrimination
We will not discriminate against you for exercising any of your CCPA/CPRA rights. This means we will not deny you goods or services, charge different prices, provide a different level of service, or suggest you will receive a different price or level of service.
Section 25 - California Shine the Light Law
California Civil Code Section 1798.83 permits California residents to request information regarding disclosure of personal information to third parties for direct marketing purposes. We do not provide marketing mailing lists to third parties for their own direct marketing. Consent-based advertising disclosures are described above.
Section 26
We implement appropriate technical and organizational security measures to protect your Personal Data from unauthorized access, use, disclosure, alteration, or destruction. These measures include:
Encryption
Data encryption in transit (SSL/TLS) and at rest
Access Controls
Strict authentication and authorization mechanisms
Secure Infrastructure
Enterprise-grade hosting with Vercel Edge Network
Regular Monitoring
Continuous security monitoring and audits
Section 27 - Data Breach Notification
We notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of a personal data breach, unless it is unlikely to risk individuals’ rights and freedoms (GDPR Article 33). If a breach is likely to result in a high risk, we also notify affected individuals without undue delay, subject to the exceptions in Article 34.
Section 33
Our services are intended for business use and are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 18 years of age.
If we become aware that we have collected personal data from a child under 18 without parental consent, we will take steps to delete such information as soon as possible. If you believe we have collected information from a child under 18, please contact us at partners@
Section 34
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. However, our advertising partners (Google, Meta) may use automated systems for ad targeting and optimization on their platforms, subject to their own privacy policies.
Section 35
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. The "Last updated" date at the top of this policy indicates when it was last revised. If we make material changes that significantly affect how we process your personal data, we will notify you by posting a prominent notice on our website or by sending you an email (if we have your email address). We encourage you to review this policy periodically.
If you have any questions about this Privacy Policy, how we handle your personal data, or wish to exercise your privacy rights, please don't hesitate to contact us.