How ZenAds handles personal information

1. Introduction

ZenAds is an advertising management and lead management platform operated by Zen Docs Technologies (Pty) Ltd, a company based in South Africa.

ZenAds enables businesses and authorised users to connect supported advertising platforms, create and manage advertising campaigns, monitor campaign performance, manage leads and access related advertising and business information from a central platform.

This Privacy Policy applies when users access or use:

• the ZenAds website, web application and API;
• advertising platform integrations;
• lead management functionality;
• subscription and billing functionality;
• customer support services; and
• any related ZenAds services.

By using ZenAds, users acknowledge the processing practices described in this Privacy Policy.

2. Responsible Party

For purposes of applicable data protection legislation, including the South African Protection of Personal Information Act, 2013 (POPIA), the responsible party for personal information relating directly to ZenAds account holders is Zen Docs Technologies (Pty) Ltd, South Africa.

Where ZenAds processes lead, customer or other personal information on behalf of a ZenAds customer, the customer may be the responsible party or controller for that information, and Zen Docs Technologies may act as an operator or processor, depending on the circumstances and applicable law.

3. Scope of this Privacy Policy

This Privacy Policy applies to personal information processed through ZenAds. It does not replace the privacy policies of third-party services connected to ZenAds.

Users should also review the privacy policies and terms of any third-party platforms they connect to ZenAds, including:

• Google, YouTube and Google Ads;
• Meta, Facebook, Instagram and WhatsApp;
• TikTok;
• Microsoft Advertising and Bing;
• payment service providers;
• hosting and infrastructure providers; and
• other third-party integrations used with ZenAds.

4. Information We Collect

The information ZenAds collects depends on how the platform is used and which features and integrations are enabled.

Account Information

When a user creates a ZenAds account, we may collect:

• full name, email address, telephone number and communication preferences;
• password or authentication credentials, account identifier, user role and account status;
• email verification status, preferred language, country and time zone.

Passwords must be stored using secure password hashing mechanisms and must never be stored in readable plain text.

Business Information

When configuring a business account, ZenAds may collect:

• business name, industry, country, address, telephone number and website;
• time zone, preferred currency and business contact information;
• team members, subscription plan and advertising account information; and
• other information provided by the business.

Advertising Account Information

When users connect supported advertising accounts, ZenAds may access or receive information such as:

• advertising account identifiers, account names, campaign identifiers and campaign names;
• campaign status, budgets, targeting settings, geographic targeting and audience settings;
• advertisements, creative assets, campaign schedules and publishing status;
• impressions, clicks, conversions, advertising expenditure, cost-per-lead information and campaign performance information.

ZenAds will only request permissions that are reasonably necessary to provide enabled functionality.

Campaign and Creative Content

When users create campaigns through ZenAds, we may process campaign names, objectives, descriptions, headlines, calls to action, landing page URLs, uploaded images, uploaded videos, audience settings, locations, campaign dates, budgets, publishing status and campaign performance.

Users are responsible for ensuring they have the legal right and appropriate permissions to use any content uploaded to ZenAds.

5. Google User Data

Where a user connects a Google account or Google Ads account, ZenAds may request access to Google information necessary to provide the selected ZenAds functionality.

Depending on permissions authorised by the user, this may include:

• Google account identification information;
• Google Ads customer or account identifiers;
• campaign information, budgets, advertisements, assets, status and targeting information;
• reporting information, conversion information and other Google Ads information required to manage or report on campaigns.

ZenAds uses Google user data only to provide functionality requested or authorised by the user, including connecting advertising accounts, creating or updating campaigns, managing assets and budgets, retrieving campaign status and displaying reports.

ZenAds will not sell Google user data. ZenAds will not use Google user data for purposes materially different from those disclosed at the time authorisation is requested without appropriate notice and any required additional authorisation or consent.

ZenAds' use and transfer of information received from Google APIs will comply with applicable Google API Services User Data Policy requirements.

6. OAuth and Connected Accounts

ZenAds may use OAuth or equivalent authorisation mechanisms to connect third-party advertising accounts. Where OAuth is used, users authenticate directly with the relevant third-party provider.

ZenAds should not request users to provide Google, Meta, TikTok, Microsoft or other third-party account passwords directly to ZenAds. Instead, the relevant provider authorises ZenAds and provides appropriate tokens or credentials.

ZenAds may securely store:

• access tokens, refresh tokens and token expiry information;
• authorised scopes;
• external account identifiers; and
• connection status.

Tokens and other sensitive integration credentials must be protected using appropriate encryption and access controls. Users may disconnect supported advertising accounts through ZenAds or through the relevant third-party platform where supported.

7. Lead Information, WhatsApp and Lead Forms

ZenAds may provide lead-management functionality. Depending on the lead source and information provided by the individual, ZenAds may process:

• name, surname, email address, telephone number, WhatsApp number, company name and job title;
• enquiry information, location, campaign source, advertising platform, campaign identifier and related attribution information;
• lead status, salesperson notes, qualification status, conversion status and date and time of enquiry.

Lead information may originate from Facebook or Instagram lead forms, Google advertising campaigns, TikTok lead functionality, WhatsApp, ZenAds-hosted lead forms, customer websites, third-party integrations, telephone enquiries, manual entry or other authorised lead sources.

ZenAds customers are responsible for ensuring that they have an appropriate lawful basis for collecting, using and contacting leads. Customers must comply with applicable privacy laws, electronic communications laws, direct marketing requirements, advertising laws, consent requirements and opt-out requirements.

Where a customer enables WhatsApp-related functionality, ZenAds may process information necessary to associate WhatsApp enquiries with campaigns, identify advertising sources, display lead information, route enquiries, track lead status, support authorised communication functionality and measure campaign results.

When an individual completes a ZenAds-hosted form, ZenAds may process information submitted through that form on behalf of the relevant ZenAds customer. The form should identify the business collecting the information and provide appropriate privacy information or links where required.

8. Payment, Subscription and Advertising Spend Information

ZenAds is intended to operate as a subscription service. We may process subscription plan, subscription status, billing period, trial start date, trial expiry date, renewal date, payment status, transaction reference, payment gateway identifiers, invoice information, billing history and limited payment-method information supplied by the payment provider.

ZenAds does not intend to store complete payment card numbers or CVV/security codes. Payment card information should be collected and processed by an authorised third-party payment service provider.

ZenAds may receive limited information from the payment provider, such as card type, last four digits of a card, transaction status, transaction reference and tokenised payment references. ZenAds must never store CVV numbers.

ZenAds subscription fees and advertising expenditure are separate. Unless expressly stated otherwise, ZenAds does not collect or hold the customer's advertising budget. Advertising expenditure is generally billed directly by the applicable advertising provider through the customer's connected advertising account.

9. Technical, Usage and Audit Information

When users access ZenAds, we may automatically collect technical information, including IP address, browser type, device type, operating system, application version, login date and time, session information, referring pages, pages viewed, actions performed, error information, diagnostic information, security events and approximate geographic information derived from network information where permitted.

ZenAds may maintain audit records relating to important activities, including account creation, login activity, advertising account connection or disconnection, campaign creation, campaign modification, campaign publication, campaign pausing, campaign resumption, creative uploads, subscription changes, billing events, lead status changes, administrative actions and security-related events.

Audit information may include user identifier, organisation identifier, date and time, action, affected entity, IP address where appropriate, correlation identifier and other relevant diagnostic information.

10. How We Use Information

Zen Docs Technologies may process information for purposes including:

• creating and managing user accounts, dashboards, businesses, campaigns, leads, integrations, reporting and analytics;
• connecting advertising accounts, uploading advertising assets, managing campaigns and retrieving performance information;
• receiving, displaying, organising and attributing leads to campaigns;
• administering trials, subscriptions, renewals, cancellations, payments and billing support;
• authenticating users, preventing fraud, investigating security incidents and maintaining audit records;
• answering enquiries, troubleshooting technical issues and providing onboarding assistance; and
• using aggregated, statistical or appropriately de-identified information to improve ZenAds and develop new features.

Where required by law, appropriate consent or another lawful basis will be used.

11. Legal Bases for Processing

Depending on applicable law and the circumstances, Zen Docs Technologies may process personal information because processing is necessary to perform a contract, provide requested services, comply with legal obligations, protect ZenAds and its users, pursue legitimate business interests, or because the individual has provided consent.

Where consent is relied upon, consent may generally be withdrawn, subject to applicable legal and contractual limitations.

12. How We Share Information

Zen Docs Technologies does not sell customer personal information or lead personal information.

We may share information with third parties where necessary to operate ZenAds, including:

• advertising providers selected by customers, such as Google, Meta, Facebook, Instagram, WhatsApp, TikTok and Microsoft Advertising;
• payment providers used for subscription billing;
• infrastructure providers for hosting, databases, file storage, backups, email, security, monitoring and analytics;
• professional advisers, including lawyers, accountants, auditors and insurers; and
• authorities or third parties where reasonably necessary to comply with law, respond to valid legal process, enforce agreements, investigate fraud, protect rights or property, protect users, investigate security incidents or comply with regulatory obligations.

Where third parties process personal information on our behalf, we will take reasonable steps to ensure that appropriate contractual, confidentiality, privacy and security obligations are in place where required.

ZenAds may use international advertising platforms, infrastructure providers and other service providers. As a result, information may be processed or stored outside the user's country, including outside South Africa. Where personal information is transferred internationally, Zen Docs Technologies will take reasonable steps to ensure that transfers comply with applicable data protection requirements.

13. Data Security and Provider Credentials

Zen Docs Technologies takes reasonable technical and organisational measures designed to protect information against unauthorised access, accidental loss, unlawful processing, unauthorised disclosure, alteration, destruction and misuse.

Measures may include encryption, secure communications using HTTPS/TLS, password hashing, role-based access controls, secure token storage, token encryption, database security, network controls, audit logging, authentication controls, restricted administrative access, backups, monitoring, vulnerability management and security updates.

OAuth tokens, API credentials and other provider credentials must be treated as sensitive information. ZenAds must restrict access to authorised services and personnel, encrypt sensitive credentials where stored, avoid exposing credentials to client-side interfaces unnecessarily, avoid recording credentials in ordinary application logs, revoke or delete credentials where appropriate after disconnection and follow applicable provider security requirements.

No internet-based service can guarantee absolute security. Users are responsible for protecting their passwords and account credentials.

14. Data Retention and Account Closure

Zen Docs Technologies retains information only for as long as reasonably necessary for the purposes for which it was collected or as required by law.

Retention periods may depend on whether the account remains active, contractual requirements, customer instructions, legal requirements, accounting requirements, dispute resolution requirements, security requirements, backup cycles and advertising platform requirements.

Information that is no longer required should be securely deleted, anonymised or otherwise rendered inaccessible, subject to applicable retention obligations.

When an account is closed or an advertising account is disconnected, ZenAds will stop requesting new information from that integration except where retention is required for legitimate business, security, legal, accounting or compliance purposes.

15. User Rights and Choices

Subject to applicable law, users may have rights to request access to personal information, correction of inaccurate information, deletion of certain information, objection to certain processing, restriction of certain processing, withdrawal of consent where consent is relied upon and information about how personal information has been processed.

Some requests may be limited by legal, security, accounting, fraud prevention, platform integrity or contractual requirements.

Users may disconnect supported advertising accounts through ZenAds where available or through the relevant third-party platform.

16. Children's Privacy

ZenAds is intended for business use and is not intended for children. Users should not submit personal information of children unless they have a lawful basis and all required permissions to do so.

17. Changes to this Privacy Policy

Zen Docs Technologies may update this Privacy Policy from time to time. When material changes are made, ZenAds may provide notice through the website, application, email or another appropriate channel.

The date at the top of this page indicates when this Privacy Policy was last updated.

18. Contact

For privacy-related questions, requests or concerns, users should contact Zen Docs Technologies (Pty) Ltd through the support or contact channels made available in ZenAds or on the ZenAds website.

The latest privacy contact details will be made available through the ZenAds application and official ZenAds website.