Privacy Policy

This Privacy Policy explains how zannaempire OÜ (“Zanna Empire,” “we,” “us,” or “our”) collects, uses, stores, and protects personal data when you visit zannaempire.com, contact us, submit an application, book a strategy call, or use our performance marketing services.

Zanna Empire is a performance marketing agency based in Tallinn, Estonia.

1. Who We Are

For the purposes of the General Data Protection Regulation (EU) 2016/679 (“GDPR”), zannaempire OÜ is the data controller for personal data collected through our website, contact forms, applications, and direct communications.

Where we process data on behalf of clients in connection with advertising accounts, analytics platforms, customer lists, conversion tracking, or campaign management, we may act as a data processor under a separate client agreement or data processing agreement.

2. Personal Data We Collect

We may collect the following categories of personal data.

2.1 Information You Provide to Us

When you fill out a form, apply to work with us, book a call, or contact us by email, we may collect:

• First name and last name;
• Work email address;
• Company or brand name;
• Website URL;
• Current monthly advertising spend;
• Platforms you are running or want to run, including Meta Ads, Google Ads, TikTok Ads, or multiple platforms;
• Your business goals, marketing challenges, and other information submitted through the form;
• Any information you provide during calls, email correspondence, onboarding, or client communications.

2.2 Client and Business Data

If you become a client, we may process business and campaign-related data, including:

• Advertising account data;
• Analytics and attribution data;
• Campaign performance metrics, including ROAS, CPA, revenue, conversions, leads, click-through rates, and other marketing KPIs;
• Creative assets, ad copy, landing pages, product feeds, audience data, and campaign structure;
• Access permissions to platforms such as Meta Ads, Google Ads, TikTok Ads, Google Analytics, Google Tag Manager, Shopify, CMS platforms, reporting dashboards, or similar tools;
• Billing, invoicing, tax, and accounting information.

2.3 Automatically Collected Data

When you visit our website, we may automatically collect certain technical data, including:

• IP address;
• Browser type and version;
• Device type;
• Operating system;
• Referring website;
• Pages visited;
• Time and date of visit;
• Approximate location based on IP address;
• Cookie and analytics identifiers.

2.4 Cookies and Similar Technologies

We may use cookies, pixels, analytics tools, and similar technologies to:

• Operate and secure the website;
• Understand website traffic and user behavior;
• Improve website performance;
• Measure marketing effectiveness;
• Support remarketing or advertising campaigns, where applicable.

You can control cookies through your browser settings. Where legally required, we will request consent before placing non-essential cookies.

3. How We Use Personal Data

We use personal data for the following purposes:

• To respond to inquiries and applications;
• To assess whether your business is a suitable fit for our services;
• To book and manage strategy calls or audits;
• To provide performance marketing, creative strategy, growth strategy, CRO, analytics, and related services;
• To audit advertising accounts, analytics, funnels, landing pages, and campaign performance;
• To prepare proposals, strategy documents, reports, and growth plans;
• To communicate with you about services, onboarding, reporting, invoices, and account matters;
• To manage client relationships;
• To process payments, invoices, tax documentation, and accounting records;
• To improve our website, services, internal processes, and marketing;
• To comply with legal, tax, regulatory, and contractual obligations;
• To protect our rights, business, systems, and clients.

4. Legal Bases for Processing

Where GDPR applies, we process personal data based on one or more of the following legal bases:

4.1 Consent

We may process data based on consent when you agree to receive marketing communications, accept non-essential cookies, or voluntarily provide information for a specific purpose.

4.2 Contract

We process personal data where necessary to enter into or perform a contract with you or your company, including client onboarding, service delivery, billing, and support.

4.3 Legitimate Interests

We may process data where necessary for our legitimate business interests, including responding to inquiries, improving our services, securing our website, analyzing performance, managing client relationships, and conducting B2B marketing, provided those interests are not overridden by your rights.

4.4 Legal Obligation

We may process data where required to comply with legal, tax, accounting, regulatory, or reporting obligations.

5. Sharing Personal Data

We do not sell personal data.

We may share personal data with:

• Service providers and processors that support our website, email, hosting, CRM, analytics, reporting, project management, invoicing, and business operations;
• Advertising and analytics platforms where necessary to provide services, such as Meta, Google, TikTok, Google Analytics, Google Tag Manager, or similar platforms;
• Professional advisors, including accountants, auditors, lawyers, and tax consultants;
• Government authorities, regulators, courts, or law enforcement where legally required;
• Potential buyers, successors, or restructuring parties in connection with a merger, acquisition, sale, or reorganization of our business.

All third-party service providers are expected to process personal data only as necessary and in accordance with applicable data protection laws.

6. International Data Transfers

We are based in Estonia and may work with clients, platforms, service providers, and contractors in the European Union, the United States, and other countries.

Where personal data is transferred outside the European Economic Area, we will take appropriate safeguards where required by law, such as:

• European Commission Standard Contractual Clauses;
• Adequacy decisions;
• Contractual, technical, and organizational safeguards.

7. Data Retention

We keep personal data only for as long as necessary for the purposes described in this Privacy Policy.

Typical retention periods include:

• Inquiry and application data: up to 24 months, unless a client relationship begins;
• Client account and service data: for the duration of the client relationship and for a reasonable period afterward;
• Accounting, invoicing, tax, and legal records: as required by applicable law;
• Marketing consent records: until consent is withdrawn or the data is no longer needed;
• Website analytics data: according to the retention settings of the relevant analytics tools.

When data is no longer needed, we will delete, anonymize, or securely archive it.

8. Security

We use reasonable technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, disclosure, or destruction.

These measures may include access controls, secure passwords, restricted account permissions, encryption where appropriate, secure storage, and internal confidentiality practices.

No system is completely secure. You are responsible for maintaining the security of any platform credentials, advertising account permissions, and access links you provide to us.

9. Your Rights

If GDPR applies to you, you may have the right to:

• Access your personal data;
• Request correction of inaccurate data;
• Request deletion of your data;
• Restrict processing;
• Object to processing based on legitimate interests;
• Withdraw consent at any time;
• Request data portability;
• Lodge a complaint with a data protection authority.

To exercise your rights, contact us at hi@zannaempire.com.

We may need to verify your identity before responding to a request.

10. Marketing Communications

If you subscribe to updates or agree to receive marketing communications, we may contact you about our services, insights, offers, or relevant business updates.

You can unsubscribe at any time by using the unsubscribe link in an email or by contacting us at hi@zannaempire.com.

11. Client Advertising Data

When we provide performance marketing services, we may access or process data from advertising platforms, analytics tools, ecommerce systems, CRMs, landing pages, pixels, tracking systems, and reporting dashboards.

The client remains responsible for ensuring that:

• It has lawful grounds to collect and share such data with us;
• Its own privacy policy properly discloses advertising, analytics, tracking, pixels, cookies, and data sharing;
• Any customer lists, conversion data, or first-party data uploaded to advertising platforms are collected and used lawfully;
• Required consents are obtained where necessary.

12. Children’s Privacy

Our website and services are intended for businesses and professional users. We do not knowingly collect personal data from children under the age of 16.

If you believe a child has provided personal data to us, contact us and we will take appropriate steps to delete it.

13. Third-Party Links

Our website may link to third-party websites, platforms, or services. We are not responsible for the privacy practices, content, or security of third-party websites.

You should review the privacy policies of any third-party services you use.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a new “Last Updated” date.

Your continued use of the website or our services after changes are posted means you acknowledge the updated Privacy Policy.

15. Contact

For questions about this Privacy Policy or how we process personal data, contact: