Privacy Policy

1. Who is responsible for your data

Adcure Agency, Beneluxlaan 59, 2871 HE Schoonhoven, the Netherlands (Chamber of Commerce 89821211) is the controller for the processing of personal data described in this Privacy Policy. You can reach us about privacy matters at service@adcure.agency. Adcure has not appointed a data protection officer, because it is not required to do so; privacy questions are handled by the owner.

2. Whom this policy applies to

This policy applies to:

visitors of adcure.agency and the pages linked to it;
contact persons, owners and staff of businesses that request information, become clients or use the Portal;
affiliates who take part in the Adcure affiliate programme;
anyone who emails us, opens a support ticket or otherwise contacts us.

Adcure provides its services to businesses. The personal data we process therefore mostly concern the people who represent or work for those businesses. Adcure does not process personal data of the end users who see or click on the client's advertisements; that data stays with the advertising platform and with the client, who is responsible for it.

3. What data we process and where it comes from

Identification and contact data: name, business email address, telephone number, job title, company name, Chamber of Commerce number, VAT number, business address.
Account and login data: user ID, password hash, two-factor authentication settings, login timestamps, IP address and browser information.
Contract and billing data: plan, subscription status, invoices, payment status, bank account number shown on incoming transfers, the last four digits and brand of a card as reported by Stripe (we never store full card numbers), wallet balance and transaction history.
Ad account data: the identifiers of the ad accounts made available to you, the business name and website linked to them, top-up amounts and dates, and the status reported by the supplier or the platform.
Communication data: emails, support tickets, chat messages with the AI assistant and with our team, and notes we make about your requests.
Affiliate data: referral link, referred clients, commission calculations, payout details and self-billing invoices.
Website data: pages visited and technical events, only if you consent to analytics (see section 9).

We receive this data from you, from the person who registers your business, from Stripe and our bank when you pay, from our supplier and the platforms about the status of ad accounts, and from public registers such as the Chamber of Commerce when we verify a business. Providing identification, contact and billing data is necessary to enter into an agreement with us; without it we cannot provide our services.

4. Purposes and legal bases

We process personal data for the following purposes and on the following legal bases under article 6 of the General Data Protection Regulation (GDPR).

Providing the Portal, ad accounts, wallet and top-ups, and managing your subscription: necessary for the performance of the agreement (article 6(1)(b)).
Invoicing, payment processing, bookkeeping and tax filings: legal obligation (article 6(1)(c)), in particular Dutch tax and accounting law, and performance of the agreement.
Support, including answers from the AI assistant and from our team: performance of the agreement and our legitimate interest in handling your requests efficiently (article 6(1)(f)).
Verifying that you are a business, preventing fraud, abuse, chargebacks and misuse of ad accounts, and protecting our standing with platforms and our supplier: legitimate interest (article 6(1)(f)) and, where applicable, legal obligation.
Securing our systems, logging, backups and detecting unauthorised access: legitimate interest (article 6(1)(f)).
Sending service messages about your account, balance, invoices, maintenance and changes to our terms: performance of the agreement.
Sending occasional information about our own similar services to existing clients by email: legitimate interest (article 6(1)(f)) in line with the Dutch Telecommunications Act; every such email contains an unsubscribe link and you may object at any time.
Running the affiliate programme, calculating and paying commissions and issuing self-billing invoices: performance of the agreement with the affiliate and legal obligation.
Website analytics: consent (article 6(1)(a)), which you may withdraw at any time via "Cookie settings".
Handling disputes, complaints and legal claims, and enforcing our terms: legitimate interest (article 6(1)(f)).

Where we rely on legitimate interest, we have weighed our interest against your interests and rights and concluded that the processing is limited to what a business contact reasonably expects. You may ask us for more information about this assessment.

5. The AI support assistant

The Portal contains an AI support assistant that is available around the clock. When you ask it a question, your message and the relevant data of your own account (such as your plan, wallet balance, transactions, ad account status and previous tickets) are sent to the provider of the language model, which processes them in the United States. The assistant has read-only access: it cannot change data, move money, execute top-ups or contact platforms. That provider acts as our processor, is bound by a data processing agreement and, under its commercial terms, does not use our data to train its models. Conversations are stored in our own database so that our team can follow up. Our human support team can see the conversation. If you prefer not to use the assistant, you can email service@adcure.agency instead.

6. Recipients and processors

We share personal data only with parties that we need in order to run our business. Processors act on our instructions and are bound by data processing agreements.

Our database, authentication and file storage provider for the Portal. The database is hosted in the European Union.
Our hosting provider for the website and the Portal, and, with your consent, its privacy-friendly website analytics.
Stripe Payments Europe, Ltd. and Stripe, Inc.: subscription billing, card payments and the billing portal. Stripe also acts as an independent controller for its own fraud prevention and regulatory obligations; see Stripe's privacy policy.
Moneybird B.V.: bookkeeping and invoicing.
bunq B.V.: our business bank; bunq processes the details of transfers you make to us as an independent controller under banking law.
Our email delivery provider, for transactional and service emails.
The provider of the language model behind the AI support assistant (section 5).
Our suppliers of advertising accounts, where an account is not opened by Adcure itself: they receive the business name, website, platform and account identifiers needed to open, fund and manage an ad account for you, and the top-up amounts. They do not receive your login credentials or payment details.
The advertising platforms (Meta Platforms Ireland Ltd., Google Ireland Ltd., TikTok Technology Ltd. and their affiliates): the ad accounts are held with them and they process the data you enter in those accounts under their own terms and privacy policies, as independent controllers.
Professional advisers (accountant, lawyer), collection agencies and authorities where required by law or to defend our rights.

If we introduce customer messaging through WhatsApp Business, Meta Platforms Ireland Ltd. will process the message data as our processor and as an independent controller for the WhatsApp service itself. We will update this policy before we start.

We name the parties you deal with directly and describe the others by role, because our supplier relationships are commercially sensitive. A current list of the processors we use, with their identity and country of establishment, is available on request by emailing service@adcure.agency.

We do not sell personal data and do not share it with data brokers or advertising networks.

7. Transfers outside the European Economic Area

Some of our processors are established in the United States or use infrastructure there. For those transfers we rely on the following safeguards under Chapter V GDPR:

Stripe, Inc. and our hosting and email delivery providers are certified under the EU-U.S. Data Privacy Framework, which the European Commission has recognised as providing adequate protection (article 45 GDPR). Their data processing agreements additionally contain the European Commission's Standard Contractual Clauses.
The provider of the language model behind the AI support assistant processes data in the United States under a data processing agreement that incorporates the European Commission's Standard Contractual Clauses (article 46(2)(c) GDPR).
Our database is stored in the European Union; where sub-processors of that provider may access data from outside the EEA, its data processing agreement applies the Standard Contractual Clauses.
Where a supplier of advertising accounts is established outside the EEA, its data processing agreement incorporates the European Commission's Standard Contractual Clauses.

You can request a copy of the relevant safeguards by emailing service@adcure.agency.

8. How long we keep data

Invoices, payment records, wallet transactions and other data that form part of our accounts: seven (7) years after the end of the financial year in which they were created, as required by Dutch tax law.
Account, contract and ad account data: for the duration of the agreement and up to two (2) years afterwards, so that we can handle questions, balance repayments and claims; data that is part of the accounts falls under the seven-year period.
Support tickets and AI assistant conversations: two (2) years after the ticket is closed.
Security and access logs: up to twelve (12) months.
Affiliate data and self-billing invoices: for the duration of the affiliate agreement and seven (7) years afterwards for the invoices.
Enquiries from prospects that do not become clients: twelve (12) months after our last contact.
Your cookie choice: stored in your browser for twelve (12) months.
Backups: overwritten on a rolling basis within thirty (30) days of deletion from the live system.

Where a dispute, investigation or legal claim is pending, we keep the relevant data until it has been settled.

9. Cookies and analytics

Our website sets no cookies and loads no analytics until you allow it. When you first visit, a banner lets you accept, decline or choose per category. Your choice is stored in your browser for twelve months and can be changed at any time via "Cookie settings" in the footer. Declining is as easy as accepting and does not limit access to the website.

With your consent we use the privacy-friendly website analytics of our hosting provider, which counts page views and basic technical information (page, referrer, country, device type) without cookies and without building a profile of you. We do not use marketing or tracking cookies and do not place pixels of advertising platforms on our own website.

Two settings are stored on your device without consent because they are strictly necessary: your cookie choice itself and your preference to reduce animations. The Portal uses a session cookie or token that is necessary to keep you logged in.

10. Security

We protect personal data with technical and organisational measures appropriate to the risk, including encrypted connections (TLS), encryption at rest at our hosting providers, two-factor authentication on every Adcure staff account and available to Client accounts, sign-in by one-time email link so that no Client password is stored, role-based separation between the Client environment and administrative functions, logging of administrative actions, and a review of who has access at least twice a year. Only the persons who need access for their work have it. Despite these measures no system is completely secure; if you notice a vulnerability, please report it to service@adcure.agency.

11. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you and receive a copy;
have inaccurate data corrected and incomplete data completed;
have your data erased, where we no longer need it and no legal retention period applies;
restrict the processing, for example while a correction request is being reviewed;
receive the data you provided to us in a structured, commonly used, machine-readable format and have it transmitted to another provider where technically feasible;
object to processing based on our legitimate interest, including direct marketing, on grounds relating to your particular situation; for direct marketing we will always stop;
withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise a right, email service@adcure.agency from the address registered with us, or describe your request in the Portal. We may ask you to confirm your identity. We respond within one month; for complex requests we may extend this by two months and will tell you if we do. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.

12. Complaints

If you believe that we process your personal data unlawfully, we would like to hear from you first at service@adcure.agency. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (Postbus 93374, 2509 AJ Den Haag, www.autoriteitpersoonsgegevens.nl), or with the supervisory authority of the EU member state in which you live or work.

13. Automated decision-making

We do not take decisions based solely on automated processing that produce legal effects for you or similarly significantly affect you. Automated checks, for example on a failed payment or an unusual login, are always followed by human review before an account is closed or an agreement is terminated. The AI assistant provides information; it does not decide on your account.

14. Data breaches

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Autoriteit Persoonsgegevens within 72 hours of becoming aware of it and, if the risk is high, inform you without undue delay, as required by articles 33 and 34 GDPR.

15. Children

Our services are intended for businesses and we do not knowingly process personal data of persons under 18. If you believe a minor has provided us with personal data, please contact us so that we can delete it.

16. Data processing agreement

For the services described in this policy, Adcure is the controller. If, for a specific project, Adcure processes personal data on your behalf and under your instructions, Adcure acts as your processor and a data processing agreement is available on request.

17. Changes to this policy

We may update this policy when our services, processors or the law change. The date at the top shows the latest version. For material changes we will inform clients by email or in the Portal at least thirty (30) days in advance.

18. Contact

Adcure Agency, Beneluxlaan 59, 2871 HE Schoonhoven, the Netherlands. Privacy requests and questions: service@adcure.agency. General enquiries: hello@adcure.agency.