Privacy Policy - AdsPatch

AdsPatch is a service for businesses. It is not offered to consumers, and not to anyone under 18. This policy covers both the public website and the client relationship described in the AdsPatch Client Services Agreement.

Who is responsible

We are the controller of the personal data described here. For the advertising you run through an ad account, you are responsible for your own data protection obligations, including anything you collect from people who see or click your ads.

Controller: SIA “JOMINIT DIGITAL”, trading as AdsPatch
Registration number: 40203517650
VAT number: LV40203517650
Registered address: Pārmiju iela 23, Rīga, LV-1057, Latvia
Contact: hello@adspatch.com

What we collect

When you apply through this website

Your name, work email address and Telegram username.
Your company's legal name, registered address, country, registration number and VAT or tax number.
The platforms you advertise on, your monthly ad spend range and your vertical.
Your preferred payment method, deposit currency and billing email address.
Technical context attached to the submission: your IP address, the page you submitted from, the site that referred you, and any campaign parameters in the link you arrived on.

When you become a client

Account and login details for you and for every person you authorise to use the dashboard, including your own staff and contractors.
Verification records: company registration documents, proof of address, identification of directors and beneficial owners, and evidence of the source of funds. We ask for these at onboarding and we may ask again later.
The advertiser details the platforms require about the businesses advertising through them: legal name, registration number, tax identification, country of incorporation, beneficial ownership, website and contact details.
Payment records: bank account details, the wallet addresses you pay from and withdraw to, transaction references and blockchain transaction identifiers, invoices and proformas.
Your balance, deposits, allocations, transfers, withdrawals, fees and the ledger entries behind them, together with the ad accounts issued to you.
Records of our correspondence with you, including support conversations and the second-channel confirmations we use before sending a withdrawal to a new destination.

This website sets no analytics or advertising cookies. The only cookie it sets is the session cookie needed to protect the form against cross-site request forgery. The dashboard sets a session cookie for the same reason, to keep you signed in.

Why we process it, and on what basis

To assess your application and take the steps you asked for before we enter a contract, and then to provide the Services: issue ad accounts, hold and allocate your balance, run the ledger and produce your statements. Basis: performance of a contract, and steps taken at your request before it (GDPR Art. 6(1)(b)).
To verify who you are and where your money comes from, and to screen you against the sanctions lists named in the Agreement. We are required to do this and we cannot provide the Services without it. Basis: legal obligation (GDPR Art. 6(1)(c)), under anti-money-laundering and sanctions law.
To invoice you and keep our accounts, including validating an EU VAT number before we can issue an invoice to an EU business. Basis: legal obligation (GDPR Art. 6(1)(c)).
To give the platforms the advertiser information they require, without which an ad account cannot be opened or kept open. Basis: performance of our contract with you (GDPR Art. 6(1)(b)).
To keep the service and your money secure: rate-limiting and abuse blocking on the form, audit logs of actions taken in the dashboard, reconciliation against platform and partner records, and the holding period on a first withdrawal to a new destination. Basis: our legitimate interest in preventing fraud and unauthorised access to client funds (GDPR Art. 6(1)(f)).
To establish, exercise or defend legal claims, including under the indemnity in the Agreement. Basis: our legitimate interests (GDPR Art. 6(1)(f)).

We do not sell your data. We do not use it for advertising of our own. No decision that produces a legal or similarly significant effect on you is made by automated means alone: a person decides whether to approve an application, a verification or a withdrawal.

Verification, and what happens if you do not complete it

Verification is not optional and it is not a formality. If a verification request is outstanding we may hold allocations while we wait, and where the law or a competent authority requires us to withhold or freeze funds we will do so and tell you as far as we are permitted to. We will not use verification as a reason to keep money that is yours.

We keep verification records even after you stop being a client, because anti-money-laundering law requires us to. Your right to erasure does not extend to those records for as long as that obligation lasts.

Who else sees it

Our partner network, through which ad accounts are made available to you. It receives what it needs to open, fund and maintain your accounts.
The advertising platforms you choose to run on. They receive the advertiser information described above, on their own terms, and they decide independently what to do with it.
Banks and payment providers handling your deposits and withdrawals.
The European Commission's VIES service, when we validate an EU VAT number before issuing an invoice.
Our accountants, auditors and legal advisers, under professional confidentiality obligations.
Our hosting and email providers, who process data on our instructions in order to run the service and deliver the messages we send you.
Authorities, where we are legally required to report or disclose.

We do not share your data with anyone else. The existence of our relationship is not confidential, but we will not disclose your commercial terms without your consent.

Sending data outside the EEA

The advertising platforms we support are established outside the European Economic Area, mostly in the United States. When you choose to advertise on one of them, the advertiser information they require is transferred to them. Where a transfer is not covered by an adequacy decision, it is made under the European Commission's standard contractual clauses. You can ask us which mechanism applies to a particular platform and we will tell you.

How long we keep it

Applications we decline, up to 12 months so we can recognise a re-application, then deleted.
Verification and transaction records, five years after the end of the relationship, because anti-money-laundering law requires it. Longer only if an authority tells us to.
Invoices and accounting records, for the period Latvian accounting and tax law requires.
Ledger entries, for the life of the account and then with the accounting records. The ledger is append-only by design: we correct a mistake by posting a reversing entry, never by deleting history.
Correspondence, for as long as it is useful to the relationship and then for as long as a claim could still be brought.

If your account is dormant for twelve months and still holds a balance, we will contact you at your registered details to arrange returning it. We do not treat dormancy or termination as forfeiting your money.

Keeping it safe

Access to client data is limited to the people who need it. Actions taken in the dashboard are audit-logged. We require two-factor authentication on the platform and business manager accounts connected to the Services, and we ask you to keep your own dashboard credentials secure and tell us promptly if you suspect they have been misused.

Your rights

You can ask us for a copy of your data, ask us to correct or delete it, ask us to restrict or object to processing, or ask for it in a portable format. Where we rely on legitimate interests you can object, and we will stop unless we have grounds that override yours. Write to hello@adspatch.com and we will respond within one month.

Two limits worth stating plainly. We cannot delete records we are legally required to keep, which is most of your verification and transaction history. And we cannot delete data held by an advertising platform on its own account: for that you have to go to the platform, and we will point you to the right place if you ask.

If you think we have handled your data wrongly you can complain to the Latvian Data State Inspectorate (Datu valsts inspekcija), or to the supervisory authority in the country where you live or work.

Changes

If we change how we handle personal data we will update this page and change the review date at the top of it. Where a change materially affects clients we will also give notice by email and in the dashboard, as the Agreement requires.