Legal
Privacy Policy
AdLab Creatives ("AdLab", "we", "us") is a creative agency based in the Netherlands that produces performance creatives for e-commerce brands. This policy explains what personal data we collect through adlabcreatives.com and in the course of our services, why we collect it, and what rights you have. We process personal data in accordance with the EU General Data Protection Regulation (GDPR / AVG).
1. Who is responsible
AdLab Creatives is the data controller for the processing described here. Questions or requests can be sent to bodi@adlabcreatives.com.
2. What data we collect
Application and contact forms. When you apply to work with us, we collect the details you enter: name, email address, phone number, company or website, monthly ad spend range, and anything you write in the free-text fields. We also record the page you submitted from, the referring URL, campaign parameters (UTM tags) and your browser's user agent.
Client portal. Clients receive a login for a private portal. There we store your email address, a hashed password, your company name and the project information we share with you (deliveries, tested angles, status updates).
Working together. During an engagement we process business contact details, communication (email, Slack, WhatsApp), briefs, brand assets, ad account access you grant us, and performance data from your advertising accounts.
Website usage. Our hosting provider logs technical data such as IP address, request time and browser type for security and reliability. We also use the Meta Pixel (see section 5).
3. Why we use it and on what legal basis
- To respond to your application and assess whether we are a fit: our legitimate interest in acquiring clients, and pre-contractual steps at your request.
- To deliver our services to clients, including the portal: performance of the contract with you or your company.
- To measure and improve our marketing, including Meta ads: your consent where required, otherwise our legitimate interest.
- To keep the site secure and prevent abuse: our legitimate interest.
- To meet legal obligations, such as tax and accounting rules.
4. Who we share data with
We do not sell personal data. We share it only with service providers that help us run the business, under data processing agreements:
- Vercel (website hosting and serverless functions)
- Neon (database for applications and portal data)
- Resend (transactional email notifications)
- Airtable, Notion, Google Workspace (forms, project management and documents)
- Meta Platforms (advertising measurement, see section 5)
- Google Fonts (loading web fonts; your IP address is sent to Google when fonts load)
Some providers are based in the United States. Where data leaves the EEA we rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
5. Cookies and the Meta Pixel
Our pages load the Meta Pixel, which sets cookies and sends events (such as page views and form submissions) to Meta. We use this to measure the results of our own advertising and to build audiences for it. Meta may combine this with data it holds about you; see Meta's privacy policy. You can limit this by adjusting your Meta ad settings, blocking third-party cookies, or using a tracker blocker.
The client portal uses a strictly necessary session cookie so you stay logged in. We do not use other analytics cookies.
6. How long we keep data
- Applications: up to 24 months after submission, so we can follow up later if timing was not right.
- Client data: for the duration of the engagement and up to 7 years afterwards where Dutch tax law requires it; otherwise deleted or anonymised within 12 months after the engagement ends.
- Server logs: typically 30 days.
7. Your rights
Under the GDPR you can ask us to access, correct, delete or export your personal data, to restrict or object to processing, and to withdraw consent at any time. Email bodi@adlabcreatives.com and we will respond within one month. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.
8. Security
We use HTTPS everywhere, hash passwords, restrict access to client data to the people who need it, and keep ad account access scoped to what the work requires. No system is perfectly secure; if a breach affects you, we will notify you as the law requires.
9. Children
Our services are aimed at businesses. We do not knowingly collect data from anyone under 16.
10. Changes
We may update this policy from time to time. The date at the top shows the current version. Material changes will be announced to clients by email.