LEGAL
Last updated: 5 October 2026. This Privacy Policy explains how Elorenis processes personal data through the public website, commercial interactions, user accounts, the Elorenis platform and connected services.
The data controller for the processing activities described in this Policy is [LEGAL ENTITY NAME], trading as Elorenis, with registered office at [REGISTERED OFFICE], tax/VAT or company registration number [NUMBER]. Privacy requests may be sent to [PRIVACY EMAIL]. If a Data Protection Officer is appointed, the relevant contact details will be published here before production launch.
This Policy applies to personal data processed through elorenis.com and related pages, demo and commercial requests, Elorenis user accounts, authentication and support, integrations with advertising platforms, CRM, lead-generation, commerce and offline outcome systems, and the security and administration of the service. Separate contractual documents may apply to customer-controlled processing, including the Data Processing Agreement.
Elorenis generally acts as data controller for its own website, commercial relationship, account administration, authentication, security, billing, support, legal compliance and service communications. When an agency uses Elorenis to process data relating to its clients, prospects, leads or other individuals for the agency's purposes, the agency will normally act as controller and Elorenis will act as processor on its documented instructions, subject to the applicable Data Processing Agreement.
Depending on how the service is used, Elorenis may process account and professional data, technical and security data, commercial relationship data, advertising-platform data, lead and funnel data, and information imported from systems connected by the customer.
We may receive personal data directly from the individual, from the agency customer, from other authorized users in the same organization, from services connected by the customer, from advertising platforms, CRM systems, lead-generation tools, commerce systems and other customer business systems, and automatically when the website or service is used. Customers are responsible for ensuring that they have an appropriate legal basis and authority to provide data to Elorenis where they act as controller.
We process personal data only where a lawful basis applies. The applicable legal basis depends on the context and may include performance of a contract or pre-contractual measures, compliance with legal obligations, legitimate interests that are not overridden by the individual's rights, and consent where required.
When an authorized agency connects Meta assets, Elorenis may access the Platform Data made available through the relevant Meta APIs and permissions, including business and ad-account identifiers, Pages, lead forms, campaigns, ad sets, ads, creatives, delivery and performance metrics and, where specifically authorized, lead data. Elorenis uses this data only to provide the service requested by the authorized agency, including asset discovery and binding, campaign and performance monitoring, lead processing, reporting, anomaly and opportunity detection, operational recommendations and authorized advertising actions. Elorenis does not sell Meta Platform Data or use it to build independent advertising products targeted at the individuals represented in that data.
Meta access is limited to assets and permissions that the connecting user and organization are authorized to use. Provider credentials and tokens are processed server-side and are not intentionally exposed to the browser or ordinary application logs. If authorization is revoked or the connection is removed, Elorenis stops obtaining new data through that connection and handles credentials and previously received data in accordance with the applicable retention, deletion and contractual rules.
The public website uses Google Analytics 4 to understand how visitors use the website and to measure aggregate website performance. Google Analytics may process online identifiers, cookie or device identifiers, IP-derived information, approximate location, browser and device information, referral information, pages viewed and interaction events. The provider is Google Ireland Limited for users in the European Economic Area and Switzerland, with other Google group companies acting where relevant. Where consent is required under applicable law, Google Analytics is not activated until the visitor has provided valid consent. Consent may be withdrawn at any time through the website's cookie preferences.
The public website uses the Meta Pixel to measure the effectiveness of Elorenis advertising, understand conversions and audiences, and improve campaign measurement. Depending on configuration and user choices, the Pixel may transmit to Meta information such as page views, events, URL and referrer data, browser and device information, IP-derived information and identifiers stored or read through cookies or similar technologies. The provider for users in the European Economic Area is Meta Platforms Ireland Limited. Where consent is required, the Meta Pixel is not activated until valid consent has been provided. Consent can be withdrawn at any time through the website's cookie preferences.
The website may use strictly necessary cookies and similar technologies for security, session management, language or technical preferences. These tools may be used without consent where permitted by law. Analytics, advertising, profiling and other non-essential tracking technologies, including Google Analytics and the Meta Pixel, are activated only where the applicable legal requirements have been met. Visitors must be able to reject non-essential tracking as easily as they can accept it and may change their choices later through the cookie-preference interface.
Certain Elorenis features may use artificial intelligence systems to analyze existing context, summarize information, identify possible patterns, prepare explanations, generate content and propose operational actions. Elorenis applies data-minimization principles and contractual and technical safeguards when external model providers are used. The final list of AI subprocessors and the applicable data-use terms will be included in the production subprocessor register. Elorenis does not, for its own purposes, use AI to make solely automated decisions about individuals that produce legal effects or similarly significant effects within the meaning of Article 22 GDPR.
Elorenis may organize campaign, experiment, decision and outcome information to create reusable operational knowledge within the customer's agency. Where direct identification is not necessary, Elorenis may apply minimization, aggregation, pseudonymization or anonymization. Pseudonymized data remains personal data where re-identification is reasonably possible. Data is treated as anonymous only where individuals are no longer reasonably identifiable. Information belonging to one agency is not made available to another agency unless an appropriate legal basis and contractual basis exists or the information has been effectively anonymized.
Personal data may be disclosed only where necessary to hosting and infrastructure providers, database and storage providers, backup providers, authentication providers, email and communication providers, support and monitoring providers, security providers, AI providers where required by a feature, connected platforms acting on the customer's instructions, professional advisers and public authorities where required by law. Providers processing personal data on our behalf are subject to appropriate contractual obligations. A production subprocessor list will identify the relevant providers, purpose and location before launch.
Some providers or connected platforms may process personal data outside the European Economic Area. Where a transfer is subject to GDPR Chapter V, Elorenis relies on an applicable adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism and, where necessary, evaluates supplementary safeguards. The use of Google Analytics, Meta Pixel and other global providers may involve such international processing depending on the provider configuration and data flow.
Personal data is retained only for as long as necessary for the relevant purpose and in accordance with legal, contractual and security requirements. Account and commercial data is normally retained for the customer relationship and any legally required follow-up period. Customer-controlled data is retained according to customer instructions, service configuration and the Data Processing Agreement. Integration credentials are retained only while needed to maintain the authorized connection. Residual copies may remain in protected backups until the normal backup-rotation cycle expires. Accounting and tax records are kept for the statutory period. Security logs are retained for a period proportionate to incident investigation, abuse prevention and legal requirements. Exact production retention periods will be documented in the internal retention schedule and, where appropriate, in customer documentation.
Elorenis applies technical and organizational measures appropriate to the risk, including encrypted transport, access controls, tenant and authorization boundaries, server-side secret handling, strong authentication for privileged administrative functions, minimized logging of personal data and secrets, backups, recovery procedures, integrity controls and operational monitoring. No information system can guarantee zero risk, and security measures are reviewed in light of the nature of the data, the processing context and the state of the art.
Elorenis maintains procedures to identify, contain, assess and document security incidents involving personal data. Where Elorenis acts as processor, it notifies the relevant controller without undue delay after becoming aware of a personal data breach affecting data processed on that controller's behalf. Where Elorenis acts as controller, it will notify the competent supervisory authority and affected individuals when required by applicable law.
Where Elorenis acts as controller, individuals may exercise the rights available under Articles 15 to 22 GDPR, subject to the applicable conditions and exceptions.
Requests may be sent to [PRIVACY EMAIL]. We may request only the information reasonably necessary to verify identity and understand the request. We will respond within the periods required by applicable law. Where the request concerns data that Elorenis processes solely on behalf of an agency customer, we may direct the requester to that controller, forward the request to the customer or assist the customer in responding, as appropriate.
Authorized users may request deletion in accordance with applicable law and the customer agreement. Removing an integration stops future collection through that connection, subject to technical propagation times. Meta and other provider authorizations may also be revoked through the relevant provider's own controls. Elorenis will maintain a dedicated data-deletion page at https://elorenis.com/data-deletion with instructions for submitting deletion requests.
Elorenis is a business-to-business service intended for agencies, companies and professional users and is not designed for use by children. We do not knowingly offer individual public accounts to children. Customers that process children's personal data through connected systems remain responsible for determining the applicable legal basis and safeguards.
Elorenis can connect to services operated by third parties. Those providers may process personal data for their own purposes under their own terms and privacy notices. Elorenis does not control independent processing carried out by a third party outside the processing required to provide the requested integration.
We may update this Privacy Policy to reflect changes in law, the service, processing activities, providers or organizational structure. The current version will be published on this page with an updated effective date. Where a change materially affects how personal data is processed, additional notice may be provided where appropriate.
Individuals have the right to lodge a complaint with the competent data protection supervisory authority. In Italy, the competent authority is the Garante per la protezione dei dati personali. This right is without prejudice to any other administrative or judicial remedy available under applicable law.
[LEGAL ENTITY NAME] — [REGISTERED OFFICE] — [VAT / COMPANY REGISTRATION NUMBER] — Privacy contact: [PRIVACY EMAIL]. These placeholders must be replaced with the operating legal entity's verified details before the Policy is published in production.
