Privacy Policy

PRIVACY POLICY

In plain language · Po polsku w skrócie

What this Policy means for you, in 30 seconds:

  • You leave us your email or name in a form on our website — we use it to reply to you and you can unsubscribe at any time.
  • You request a Free SEO/AI/GEO Audit — we scan your public website, send you the report, and may follow up. We keep the data for up to 12 months unless you ask us to delete it sooner.
  • You buy a subscription at pay.zerofluff.digital — Stripe handles your card (we never see card numbers); we keep invoice records for 5 years as required by Polish accounting law.
  • You get a cold outreach email from us — § 7 explains exactly where we found your business contact, what we do with it, and how to opt out (reply STOP, takes effect immediately).
  • Any question, complaint, or "delete my data" request — email [email protected]. We answer within 30 days as required by GDPR.

Sekcje poniżej są pełną wersją prawniczą tych zasad, wymaganą przez RODO (art. 13/14). Jeśli nie chcesz czytać 60 stron — punkty wyżej pokrywają 95% przypadków. Pytania: [email protected].

This Privacy Policy is the single, unified document covering the processing of personal data by the six Joint Controllers operating as MTA Group — MTA Digital, MTA Performance, Anchor.Team, Force of Nature Europe, SharkPress Agency and Zero Fluff Digital — across all of their websites and services, including zerofluff.digital, pay.zerofluff.digital, mta.digital, anchor.team, and any group-affiliated subdomains.

§ 1. Joint Controllers of Personal Data

The joint controllers of your personal data are six Polish limited liability companies operating as MTA Group. MTA Digital sp. z o.o. is the parent entity and the operational lead for data protection matters and group-level vendor licenses (Workspace, AI tools, CRM, outreach pipeline, internal collaboration tools). Zero Fluff Digital sp. z o.o. is a wholly-owned subsidiary operating as a full-service growth marketing agency in its own right (incrementality-first paid media, AI search visibility, retainer engagements); it is also the direct Stripe merchant of record for services purchased through pay.zerofluff.digital. The other four Joint Controllers operate parallel agency lines within the group. This Privacy Policy applies uniformly to all six Joint Controllers — there is no separate policy for ZFD or for pay.zerofluff.digital; pay.zerofluff.digital/privacy-policy redirects (HTTP 308) to this canonical document.

Zero Fluff Digital sp. z o.o.

Subsidiary agency · Stripe merchant for pay.zerofluff.digital

Address: ul. Świętego Marcina 29/8, 61-806 Poznań

Court: District Court Poznań – Nowe Miasto i Wilda, 8th Commercial Division

KRS: 0001174081

NIP: 7831930082

REGON: 541841870

Share Capital: PLN 5,000.00 (fully paid)

Representative: Radosław Kmita – Member of the Management Board

View other 5 Joint Controllers (MTA Group entities)▼

MTA Digital sp. z o.o.

Address: ul. Świętego Marcina 29/8, 61-806 Poznań

Court: District Court Poznań – Nowe Miasto i Wilda, 8th Commercial Division

KRS: 0000561985

NIP: 7831727441

REGON: 361723055

Share Capital: PLN 5,000.00 (fully paid)

Representative: Jakub Krystkowiak – President of the Management Board

MTA Performance sp. z o.o.

Address: ul. Świętego Marcina 29/8, 61-806 Poznań

Court: District Court Poznań – Nowe Miasto i Wilda, 8th Commercial Division

KRS: 0000784788

NIP: 7010922437

REGON: 383274210

Share Capital: PLN 5,000.00 (fully paid)

Representative: Mateusz Mikołajczyk – President of the Management Board

Anchor.Team sp. z o.o.

Address: ul. Świętego Marcina 29/8, 61-806 Poznań

Court: District Court Poznań – Nowe Miasto i Wilda, 8th Commercial Division

KRS: 0000969275

NIP: 7831856345

REGON: 521897892

Share Capital: PLN 5,000.00 (fully paid)

Representative: Wiktor Jacheć – President of the Management Board

Force of Nature Europe sp. z o.o.

Address: ul. Świętego Marcina 29/8, 61-806 Poznań

Court: District Court Poznań – Nowe Miasto i Wilda, 8th Commercial Division

KRS: 0001050399

NIP: 7831885358

REGON: 525999520

Share Capital: PLN 5,000.00 (fully paid)

Representative: Jacek Matuszewski – Member of the Management Board

SharkPress Agency sp. z o.o.

Address: ul. Świętego Marcina 29/8, 61-806 Poznań

Court: District Court Poznań – Nowe Miasto i Wilda, 8th Commercial Division

KRS: 0001181847

NIP: 7831932253

REGON: 542142080

Share Capital: PLN 5,000.00 (fully paid)

Representative: Wiktor Jacheć – President of the Management Board

Data Protection Officer (DPO) — Article 37 GDPR

The Joint Controllers have formally appointed Mateusz Mikołajczyk as their Data Protection Officer under Article 37 GDPR. The appointment has been notified to the Polish supervisory authority (PUODO) as required by Article 37(7) GDPR. Mateusz can be contacted via:

Email (preferred): [email protected]

Postal mail: Mateusz Mikołajczyk, ul. Świętego Marcina 29/8, 61-806 Poznań, Poland

In-person meetings: by appointment only (the Joint Controllers operate remote-first; the postal address above is the registered office)

§ 1a. Essence of the Joint Controllership Arrangement (Art. 26(2) GDPR)

In accordance with Article 26(2) GDPR, this section sets out, in summary form, the essence of the Joint Controllership Arrangement concluded between the six Joint Controllers identified in §1.

  • Equal joint controllership. All six Joint Controllers are joint controllers on equal terms; there is no master-controller, lead-controller or sub-controller hierarchy. Each Party remains directly responsible to data subjects and to PUODO under the GDPR.
  • Single Point of Contact. The address [email protected] is designated as the Single Point of Contact for all data subject communications and supervisory authority enquiries. It is monitored by MTA Digital sp. z o.o. (parent entity) on behalf of all six Joint Controllers. [email protected] is an alias forwarding to the same inbox for matters specifically concerning pay.zerofluff.digital.
  • Operational lead — data subject rights & Privacy Policy. MTA Digital sp. z o.o. coordinates responses to requests under Articles 15-22 GDPR (access, rectification, erasure, restriction, portability, objection, automated decision-making) and maintains this Privacy Policy.
  • Operational lead — personal data breach response. Mateusz Mikołajczyk is designated as the operational lead for incident response under Articles 33 and 34 GDPR.
  • Right to exercise rights against any Party (Art. 26(3) GDPR). Notwithstanding the above operational allocations, you may exercise your GDPR rights against any one of the six Joint Controllers; no Party may decline to handle a request on the ground that another Party is the operational lead.
  • Joint and several liability (Art. 82(4) GDPR). The Joint Controllers are jointly and severally liable to data subjects for the entire damage caused by joint processing, in order to ensure effective compensation.

A full copy of the Joint Controllership Arrangement is available to data subjects on reasoned request submitted to [email protected].

§ 2. Data Processing Overview

We obtain personal data in two ways: (a) directly from you — when you conclude a contract, use our services, complete a form, subscribe to a newsletter, attend a meeting, or otherwise interact with us; and (b) from publicly available business sources — for the limited purpose of business-to-business outreach described in § 7 (and only within the scope and safeguards set out in §§ 7.1–7.10). The table that follows covers both flows, grouped by purpose.

Service Delivery

Contract performance and service provision

Business Operations

Day-to-day activities and contractor cooperation

Communication

Contact forms and customer interactions

Website Analytics

Usage statistics and performance optimization

Legal Compliance

Accounting, claims, and regulatory requirements

Marketing

Newsletter delivery and social media management

Purpose of personal data processingLegal basis for the processing of personal dataPeriod of storage of personal dataScope of personal data processed
Conclusion and performance of a contract for the provision of marketing/promotional/search engine optimization (SEO)/lead generation services/website developmentThe processing of your personal data is necessary for the performance of the contract for the provision of services to you. The legal basis for the processing of personal data is Article 6(1)(b) of the GDPR, i.e., processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.We will process your personal data for the duration of the provision of services to you. We will process the data until the expiry of claims under the concluded service agreement at the latest.Email address, first name, last name, street, house or apartment number, country, telephone number, bank account number, transaction amount, bank name. If the Customer is an entrepreneur, the following data is processed: company name, tax identification number, street, house or apartment number, country, telephone number. If the first and last name of the person placing the order on behalf of the Contractor is provided, this data is also processed.
Conducting day-to-day business activities, including cooperation with contractors who supply the Joint Controllers with products and services necessary for the Joint Controller's daily operationsThe legal basis for the processing of personal data is Article 6(1)(b) of the GDPR, i.e. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contractPersonal data will be processed for the duration of the business relationship or, alternatively, until the expiry of any claims arising therefromfirst and last name, company name, tax identification number, address, telephone number, email address
Contact with customers via the contact form available at https://mta.digital/pl/kontakt/ and https://www.anchor.team/contactWe process your personal data on the basis of your consent, i.e. pursuant to Article 6(1)(a) of the GDPR. The processing of your personal data is necessary in order to respond to your question asked via the contact form. The legal basis for the processing of personal data is Article 6(1)(b) of the GDPR, i.e. the need to take action at the request of the data subject prior to entering into a contract, or Article 6(1)(f) of the GDPR, i.e. the legitimate interest of the Joint Controllers in responding to potential customers.We will process your personal data until you withdraw your consent. Subsequent withdrawal of consent does not affect the lawfulness of the processing of personal data from the period prior to its withdrawal.First name, last name, email address
Statistics on the use of individual functionalities of the website https://mta.digital/pl/, https://www.anchor.team/pl and other Joint ControllersOur legitimate interest in facilitating the use of services provided electronically and improving the functionality of these services. The legal basis for the processing of personal data in this case is Article 6(1)(f) of the GDPR, i.e., the legitimate interest of the Joint Controllers.We will process your personal data for the duration of the storage of cookies, but no longer than for a period of 50 months.For these purposes, we process personal data relating to your activity, such as: behavioral data on how individual users use the Joint Controllers' website and their preferences in this regard, the amount of time spent on the Joint Controllers' website; the number of visits to specific URLs (subpages) from specific phrases or media channels, data on the location of devices used by users to view websites belonging to the Joint Controllers, age, gender, other data about user activity on websites belonging to the Joint Controllers and on related websites, e.g., comments and reviews posted, activity on social networks, email address, IP address, other user identifiers, e.g., login, first and last name, mailing address, phone number, company name, tax identification number.
Establishing, pursuing, and enforcing claims. Internal accountingOur legitimate interest in establishing, pursuing, and enforcing claims and defending against claims in proceedings before courts and other state authorities. The legal basis for the processing of personal data in this case is Article 6(1)(f) of the GDPR, i.e., the legitimate interest of the Joint Controllers. In addition, we process data on the basis of Article 6(1)(c) of the GDPR in conjunction with Article 74(2) of the Accounting Act in conjunction with Article 86 § 1 of the Tax Ordinance (i.e. due to the need to comply with legal obligations, e.g., accounting, bookkeeping, and tax obligations).The data is processed for the period of limitation of claims resulting from the provisions of the Civil Code. All data processed for accounting and tax purposes is processed for a period of 5 years from the beginning of the year following the financial year in which the operations, transactions, and proceedings were finally completed, repaid, settled, or expired (i.e. in accordance with Article 74(2) of the Accounting Act of September 29, 1994 (i.e. Journal of Laws of 2023, item 120, as amended) in conjunction with Article 86 § 1 of the Tax Ordinance Act of August 29, 1997 - Tax Ordinance (i.e. Journal of Laws of 2025, item 111, as amended).For this purpose, we may process certain personal data provided by you: first name, last name, company name, address, tax identification number (NIP), statistical identification number (REGON), PESEL number, accounting, financial data or data related to the claim (data related to the use of our services, if the claims result from the way you use our services, other data necessary to prove the existence of the claim, including the extent of the damage suffered).
Newsletter deliveryThe legal basis for the processing of personal data for the purpose of sending the newsletter is the consent of the person to whom the newsletter is to be sent, expressed, for example, by ticking a checkbox. The legal basis for the processing of personal data in this case is Article 6(1)(a) of the GDPR, i.e., the consent of the data subject.Personal data processed for the purpose of sending the newsletter is stored until the data subject withdraws their consent. Withdrawal of consent does not affect the lawfulness of the processing of personal data prior to its withdrawal.In order to send the newsletter, we may process some of the personal data you provide: first name, last name, email address, image.
Maintaining social media accounts, including Facebook, Instagram, and LinkedInThe legal basis for the processing of personal data is Article 6(1)(f) of the GDPR, i.e., the legitimate interest of the Joint Controllers in promoting the services offered by the Joint Controllers and undertaking other marketing activities.Personal data is processed for the duration of a natural person's use of the websites made available by the Joint Controllers via Facebook, Instagram, and other social media.The Joint Controllers process personal data made available by a natural person on social networking sites, most often including: first name, last name, nickname, image, etc.
Bookkeeping, accountingThe legal basis for the processing of personal data is: Article 6(1)(c) of the GDPR in conjunction with Article 74(2) of the Accounting Act in conjunction with Article 86 § 1 of the Act of August 29, 1997 - Tax Ordinance, i.e. the need to fulfill the legal obligation incumbent on Joint Controllers of Personal DataThe data is processed for the period of limitation of claims resulting from the provisions of the Civil Code. All data processed for accounting and tax purposes is processed for a period of 5 years from the beginning of the year following the financial year in which the operations, transactions, and proceedings were finally completed, repaid, settled, or expired (i.e. in accordance with Article 74(2) of the Accounting Act of September 29, 1994 (i.e. Journal of Laws of 2023, item 120, as amended) in conjunction with Article 86 § 1 of the Tax Ordinance Act of August 29, 1997 - Tax Ordinance (i.e. Journal of Laws of 2025, item 111, as amended).Personal data such as first name, last name, company name, tax identification number, address, place of business, delivery address, bank account number.
IT servicesThe legal basis is Article 6(1)(f) of the GDPR, the legitimate interest of the Joint Controllers in ensuring the proper IT support for the services provided by the Joint Controllers. In addition, the Joint Controllers process personal data for IT services in connection with the recruitment and employment of Associates, as well as in connection with business cooperation with Contractors.Personal data is processed for the duration of cookie storage. The Joint Controllers may process personal data for longer if this is necessary for the primary purpose of data processing (e.g., the Joint Controller processes personal data until the expiry of claims under the concluded contract).Data resulting from cookies, as well as all other data that Joint Controllers process in connection with IT services (e.g., data processed using e-mail), including in particular data of Customers, Contractors, and Job Candidates.
Implementation of the affiliate programThe legal basis is Article 6(1)(b) of the GDPR, i.e., the necessity to process personal data in order to ensure participation in the implementation of the partnership program, as well as Article 6(1)(f) of the GDPR, i.e., the legitimate interest of the Joint Controllers in increasing the number of Customers using their services.Personal data is processed for the duration of the business relationship or until the expiry of any claims.Data necessary to participate in the affiliate program, as specified in the form available at https://mta.digital/en/partners/, such as: e-mail address, company URL, interests, and data necessary to conclude the Agreement, such as first name, last name, registered office address, telephone number, company name, tax identification number, and details of the person representing the entity.
Maintaining a blog on the website at: https://mta.digital/pl/blog-2/ and at https://www.anchor.team/blogLegal basis: Article 6(1)(f) of the GDPR, i.e., the legitimate interest of the Joint Controllers in promoting their own servicesPersonal data will be processed for the duration of the legitimate interest of the Joint Controllers of personal data or until an objection is raisedThe blog run by the Joint Controllers of Personal Data may potentially process data such as: first name, last name, image.
Collecting customer opinions on the website at https://www.anchor.team/#TestimonialsLegal basis: Article 6(1)(f) of the GDPR, i.e., the legitimate interest of the Joint Controllers in surveying customer satisfaction with the quality of services providedPersonal data will be processed for the duration of the legitimate interest of the Joint Controllers of personal data or until an objection is raisedAs part of the customer satisfaction survey on the quality of services provided, the following personal data is processed: first name, last name, company name
Provision of the Free SEO / AI / GEO Audit to prospective customers (zerofluff.digital)Article 6(1)(b) GDPR — pre-contractual steps requested by the data subject (the prospective customer requests the diagnostic Audit); Article 6(1)(f) GDPR — legitimate interest of the Joint Controllers in providing the Audit and following up with relevant service proposals where the data subject has not opted out.Personal data collected for the Audit is processed for up to 12 months from the date of the Audit request, unless the data subject (a) becomes a paying customer (in which case retention is governed by the customer relationship), or (b) requests earlier deletion (we erase within 30 days). After the 12-month window, contact data is automatically suppressed and retained only to prevent unsolicited re-contact.Email address, optional name, the URL of the website to be audited, optional notes provided in the audit request form, plus the resulting Audit report (technical observations on the public website, no personal data of website visitors). The Audit pipeline reads only publicly available content of the requested website (robots.txt, sitemap, public pages, Core Web Vitals signals) and does not access private back-ends or end-user data.
Conducting online conferences with potential customersLegal basis: Article 6(1)(b) of the GDPR, i.e., the necessity to process personal data prior to entering into a contract, and Article 6(1)(f) of the GDPR, i.e., the legitimate interest of the Joint Controllers in enabling them to contact Customers as quickly as possiblePersonal data will be processed for the duration of the business relationship or until any claims expireAs part of the processing of personal data related to the conduct of online conferences, the following personal data will be processed: first name, last name, email address, and other data required by the Calendly application used by the Joint Controllers of Personal Data
Maintaining a form enabling the resolution of problems encountered by Customers in the course of their business activities via the website at https://www.anchor.team/contactLegal basis: Article 6(1)(f) of the GDPR, i.e., the legitimate interest of the Joint Controllers in resolving Customer problems related to their business activities, and Article 6(1)(b) of the GDPR, i.e., the necessity to process personal data in order to take steps prior to entering into a contractPersonal data will be processed for the duration of the business relationship or until any claims expire.As part of the processing of personal data related to the operation of the form used to resolve problems encountered by Customers in the course of their business activities, the following personal data will be processed: first name, last name, e-mail address, telephone number, website address (if it contains personal data).

§ 3. Data sharing

The Joint Controllers ensure that all personal data collected is used to fulfill obligations towards users. This information will not be disclosed to third parties, except in situations where:

  • the data subjects have given their prior explicit consent to such action, or
  • the obligation to transfer this data results or will result from applicable law, e.g., to law enforcement authorities.

Recipients of Personal Data

In addition, the personal data of service users and customers may be transferred to the following recipients or categories of recipients:

Service Providers

Companies supplying technical, IT, and organizational solutions enabling business activities, including website and electronic services (computer software providers, e-mail and hosting providers, management software providers).

Examples: Google LLC, Google Ireland Limited, Autenti sp. z o.o., Asana Inc., Web INnovative Software sp. z o.o., Home.pl S.A., OVH sp. z o.o., Notion Labs Inc., ZIELINAMEDIA sp. z o.o., Loom Inc., Pipedrive Inc., Mango Technologies Inc.

Accounting, Legal, and Consulting Service Providers

Companies providing accounting, legal, or consulting support (accounting office, law firm, debt collection company).

Examples: MSRR Szymańska sp. z o.o. sp.k. and Krafton Accounting XON sp. z o.o. sp.k.

Transport and Product Delivery Services (Couriers)

Service providers used to identify the recipient of orders and deliver products.

Payment Gateway Sub-Processors (pay.zerofluff.digital)

For payments processed via the Zero Fluff Digital sp. z o.o. payment gateway at pay.zerofluff.digital, the following sub-processors receive personal data strictly limited to what is necessary for their service. Each is bound by a Data Processing Agreement under Article 28 GDPR.

Stripe Technology Company, Limited (Ireland — EU/EEA establishment of Stripe, Inc.) — payment processing, card data tokenisation, Stripe Tax (VAT calculation), invoice issuance, fraud prevention. DPA: stripe.com/legal/dpa. Data: name, email, billing address, payment instrument, tax identifiers (NIP/VAT).

Clerk Inc. (United States — EU-US Data Privacy Framework participant) — optional customer account creation, authentication, session management. DPA: clerk.com/legal/dpa. Data: email, hashed password, OAuth identifiers (if used).

Resend (United States, AWS SES infrastructure — EU-US Data Privacy Framework participant) — transactional email delivery (welcome, onboarding, receipts) from the verified zerofluff.digital sender domain (SPF/DKIM/DMARC aligned). DPA: resend.com/legal/dpa. Data: email, name, purchase metadata.

Vercel Inc. (United States — EU-US Data Privacy Framework participant) — hosting and request routing for pay.zerofluff.digital. DPA: vercel.com/legal/dpa. Data: HTTP request metadata, IP address, request logs (short retention).

Cloudflare, Inc. (United States — EU-US Data Privacy Framework participant) — (a) authoritative DNS for both zerofluff.digital and pay.zerofluff.digital; (b) full reverse proxy / CDN / WAF / SSL termination for zerofluff.digital (the main website). DPA: cloudflare.com/cloudflare-customer-dpa. Data: IP address, HTTP request metadata, WAF/Bot Management signals.

International transfers: Stripe — intra-EEA, no Chapter V transfer. Clerk, Resend, Vercel, Cloudflare — transfers to the United States under the European Commission's adequacy decision of 10 July 2023 (EU-US Data Privacy Framework). All four are listed on the active DPF participant list at dataprivacyframework.gov.

AI Productivity & Research Tools

The Joint Controllers use the following AI assistants for internal research, analysis, and productivity. The licenses for ChatGPT (OpenAI) and Claude (Anthropic) are held by MTA Digital sp. z o.o. — the parent entity of MTA Group. The other five Joint Controllers, including Zero Fluff Digital sp. z o.o., access these tools through the shared corporate licenses pursuant to the Joint Controllership Arrangement (§ 1 / § 1a) and on the basis of internal allocation under Article 26 GDPR. The Data Processing Agreements with OpenAI and Anthropic are therefore signed between MTA Digital sp. z o.o. and each AI provider; the protection these DPAs afford extends to all Joint Controllers through the joint controllership arrangement.

These tools may have OAuth-granted access to our Google Workspace (Gmail, Drive, Sheets, Docs), GitHub private repositories, project-management environment (ClickUp), and meeting-transcript providers. When personal data of customers, leads, or other data subjects is incidentally present in those workspaces, it can be processed by the AI provider as a sub-processor on the Joint Controllers' behalf. Use is limited to business-tier plans where a Data Processing Agreement applies by default.

Google LLC — Gemini for Workspace (Ireland establishment for EEA customers, Cloud Data Processing Addendum) — Gemini AI features bundled with Google Workspace. Covered by the Workspace CDPA. DPA: workspace.google.com/terms/dpa_terms.html. Data: any content within Workspace that we expose to Gemini features (emails, documents, sheets).

OpenAI, L.L.C. (United States — EU-US Data Privacy Framework participant; ChatGPT Business plan) — ChatGPT with Deep Research / connectors to Google Workspace. DPA auto-applies to Business / Enterprise / API tiers per the OpenAI Services Agreement. SOC 2 Type II + ISO 27001 / 27017 / 27018 / 27701 certified. Data: conversation content, documents and emails accessed via connectors. Zero data retention beyond the limited window required for service delivery and abuse monitoring, per Business plan terms.

Anthropic PBC — Claude (United States — EU-US Data Privacy Framework participant; Claude Team plan) — Claude with connectors to our source-code hosting, email, document-collaboration and meeting-recording environments. The Data Processing Addendum is incorporated by reference into the Anthropic Commercial Terms (anthropic.com/legal/commercial-terms). Data: conversation content, code in private repositories, emails accessed via Gmail connector, transcripts of internal and client meetings if recorded, and documents accessed via Drive. No training on customer data per the Commercial Terms.

ClickUp, Inc. (United States — EU-US Data Privacy Framework participant) — project management and internal collaboration; may contain operational notes referencing customers and leads. AI Assistant features within ClickUp may further process this content. ClickUp is additionally used for meeting recording and transcription alongside Fireflies (see below). DPA: clickup.com/terms/data-processing.

Fireflies.ai Inc. (United States — EU-US Data Privacy Framework participant) — meeting recording, transcription, and AI summarisation. A Fireflies bot joins scheduled meetings, announces recording at join time, and produces a transcript stored in the Joint Controllers' tenant. Participants may at any time refuse recording (the bot then exits the meeting). DPA: fireflies.ai/dpa.

International transfers to US-based AI providers occur under the EU-US Data Privacy Framework (Commission adequacy decision of 10 July 2023). Google's processing of Workspace content is covered by the Cloud DPA and processed under SCCs / DPF for EEA controllers. Access is scoped by OAuth permissions and reviewed periodically.

Advertising, Analytics & Marketing Platforms

The Joint Controllers operate pixels, tags and embedded widgets from the platforms below on every Joint-Controller website and subdomain (zerofluff.digital, pay.zerofluff.digital, mta.digital, anchor.team, and any other group-affiliated host) for measurement, retargeting, and conversion attribution. Each platform is loaded only after the user has granted the corresponding cookie category in the Cookiebot consent banner (analytics or marketing). The full live list of cookies dropped by each platform is in the Cookie Declaration in § 6.

Separately, as a paid-media agency, Zero Fluff Digital sp. z o.o. and the other Joint Controllers operate advertising accounts on these same platforms on behalf of client companies. In that relationship the client is the controller of their own pixel data, the Joint Controller acts as processor under a customer Data Processing Agreement (template available on request), and the platform acts as sub-processor under its own terms.

Meta Platforms Ireland Ltd. — Facebook / Instagram Ads, Meta Pixel

Conversion tracking, retargeting audiences, lookalike modelling. EU/EEA establishment (Ireland); transfers to the US under EU-US DPF + SCCs (Meta is on the DPF active participant list). DPA: facebook.com/legal/terms/dataprocessing.

Google LLC — Google Ads, Google Analytics 4, Tag Manager, YouTube embeds

Conversion tracking, Consent Mode v2 signal forwarding, video embeds. Google is a DPF active participant; EEA-customer relationship runs through Google Ireland Limited. DPA: business.safety.google/adsprocessorterms.

LinkedIn Ireland Unlimited Company — LinkedIn Ads, Insight Tag

B2B conversion tracking and account-based marketing. EU/EEA establishment (Ireland); US transfers under DPF + SCCs. DPA: linkedin.com/legal/l/dpa.

TikTok Technology Limited — TikTok Ads, TikTok Pixel

Conversion tracking, retargeting, lookalike audiences for short-form video campaigns. EEA establishment in Ireland; transfers to TikTok Ltd (UK) under UK Adequacy + SCCs, and to ByteDance entities under SCCs. DPA: ads.tiktok.com/.../data-processing-agreement.

X Corp. (Twitter) — X Ads, X Pixel

Conversion tracking and retargeting on the X platform. US-based; transfers under SCCs (X Corp is not currently DPF self-certified). DPA: gdpr.x.com/en/dpa.html.

Microsoft Ireland Operations Ltd. — Microsoft Advertising (Bing Ads), Microsoft Clarity

Search-network conversion tracking (Microsoft Advertising) and session-replay / heatmap analytics (Clarity). EU/EEA establishment (Ireland); US transfers under DPF + SCCs. DPA: Microsoft Products and Services DPA.

HubSpot, Inc. — Marketing CRM, tracking pixel, form widgets, chat

Visitor analytics, lead capture, marketing-automation cookies (__hstc, hubspotutk, __ptq.gif). EU-US DPF active participant. DPA: legal.hubspot.com/dpa.

Embedded third-party widgets (Vimeo, YouTube, Clutch reviews)

Video players (Vimeo LLC, YouTube via Google) and the Clutch.co review widget set their own cookies when their content is loaded on our pages. They act as independent controllers for the data their widgets collect; we have no access to that data beyond aggregated viewership and review metadata.

International transfers to US-based platforms occur under the EU-US Data Privacy Framework (Commission adequacy decision of 10 July 2023) where the platform is a DPF active participant, and otherwise under Standard Contractual Clauses included in the platform-specific DPA. The full live list of DPF participants is at dataprivacyframework.gov.

International Data Transfers — summary

Several recipients listed above are established outside the European Economic Area, predominantly in the United States. All such transfers occur under one or more of the following legal mechanisms:

  • EU-US Data Privacy Framework — Commission adequacy decision of 10 July 2023 — for recipients listed as active participants at dataprivacyframework.gov (currently: Google, Meta, Microsoft, LinkedIn, HubSpot, Clerk, Resend, Vercel, Cloudflare, OpenAI, Anthropic, Fireflies, ClickUp, Apollo, Clay, Prospeo, Instantly and others).
  • Standard Contractual Clauses (2021/914, Module Two — controller-to-processor) — for recipients not on the DPF list (e.g. X Corp / Twitter, certain TikTok and ByteDance entities) and as a fallback layer in every DPA we sign.
  • UK Adequacy Regulations 2021 + International Data Transfer Addendum — for transfers routed through UK entities (e.g. TikTok Ltd).

For each recipient, the specific transfer mechanism and link to the applicable Data Processing Agreement is given in the subsections above (§ 3 Payment Gateway Sub-Processors, AI Productivity & Research Tools, Advertising / Analytics / Marketing Platforms).

Google Analytics opt-out: visit google.com/policies/privacy/partners or install the browser add-on at tools.google.com/dlpage/gaoptout. For other platforms, granular control is available in the Cookiebot consent panel — open the floating Cookiebot icon in the bottom-left corner of any page.

Data Security Measures

The Joint Controllers take all necessary measures to ensure appropriate security of personal data processing.

  • Subcontractors and cooperating entities must guarantee appropriate security measures
  • Data sharing only with entities meeting GDPR Articles 46 or 49 requirements
  • EU standard contractual clauses and other safeguards for transfers outside the EEA
  • Continuous assessment of legal systems in data recipient countries
  • Compliance with EU-US Data Privacy Framework for US data transfers

§ 4. User rights

A User whose personal data is being processed has the rights set out below. Each right is subject to the limitations and exceptions provided by GDPR itself — most notably the exceptions to the right of erasure under Article 17(3) (e.g. where retention is necessary for compliance with a legal obligation such as the 5-year retention of accounting records under the Polish Accounting Act, or for the establishment, exercise or defence of legal claims) and the carve-outs to the right of objection under Article 21(6). Where we cannot fully fulfil a request, we will explain the legal basis for the limitation within the 30-day response period mandated by Article 12(3) GDPR.

Access & Control

Request access to personal data, rectification, erasure ("right to be forgotten"), restriction of processing, objection to processing, and data transfer rights.

Based on Articles 15-21 of the GDPR

Consent Management

Withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Based on Article 6(1)(a) or Article 9(2)(a) of the GDPR

Supervisory Authority

Lodge a complaint with the supervisory authority (President of the Personal Data Protection Office in Warsaw) regarding data processing violations.

Objection Rights

Object to processing based on public interest, legitimate interests, or direct marketing purposes, including profiling.

How to exercise your rights: Send your request to [email protected]

§ 5. Right to lodge a complaint with a supervisory authority

If the processing of personal data violates the law, you have the right to lodge a complaint with the supervisory authority regarding the processing of personal data by the Joint Controllers. Complaints may be submitted to the President of the Personal Data Protection Office (the Office of the President of the Personal Data Protection Office is located in Warsaw (00-014, at 1A Moniuszki Street)).

§ 6. Cookies

Cookies are IT data, in particular text files, stored on users' end devices (usually on a computer hard drive or mobile device) used by the user's browser to save specific settings and data for the purpose of using websites. These files allow the user's device to be recognized and the website to be displayed appropriately, ensuring comfort during its use. The storage of cookies therefore enables the website and its offer to be tailored to the user's preferences - the server recognizes and remembers, among other things, preferences such as visits, clicks, and previous actions.

Cookie Usage by Website

The Joint Controllers operate several websites within the MTA Group. The complete, always up-to-date list of cookies set on this website (zerofluff.digital) — including each cookie's name, provider, purpose, category and retention period — is generated automatically by the Cookiebot Consent Management Platform and is shown in the "Cookie Declaration" section below. The same disclosure mechanism is mirrored on the other MTA Group websites (e.g. mta.digital, anchor.team) with each site's own Cookiebot configuration.

Because the list refreshes automatically as we add or remove third-party services, the figures below are always current; we do not maintain a static count.

Cookie Types and Purposes

By using the website available at https://mta.digital/ or https://zerofluff.digital/, you consent to the installation of so-called essential cookies on the end device of the person using the Website. Consent to the installation of necessary cookies is a prerequisite for using the Joint Controllers' website. With regard to other categories of cookies, the user has the option of consenting to their use by the Joint Controllers, which, however, is not a prerequisite for using the Joint Controllers' website. With regard to cookies other than essential cookies, consent is given through the web browser settings. If the User does not agree to the use of cookies other than those that are necessary, they should change their browser settings accordingly or opt out of using the Website (more information below). However, this will not prevent the use of the Joint Controllers' website.

The table below shows the types of cookies used by the websites https://mta.digital/ and https://zerofluff.digital/, along with additional information about the purpose of each cookie.

Type of cookieCharacteristics
Session cookiesThese cookies are used to process information that allows the user's session to be maintained until the web browser is closed. In principle, session cookies do not collect personal data in a way that would allow direct identification of the user. Their main task is to store information about the current browsing session, such as the contents of the shopping cart in an online store or the login status. However, in certain situations, the information collected by cookies, in combination with other data, could potentially lead to the identification of a person.
Long live cookiesThese cookies enable the personalization of services for Users – saving search criteria. Long-term cookies can potentially collect personal data.
Third-party cookiesThese cookies are placed by third parties. In the case of our website, this is the provider of the Cookiebot tool. For more information on the processing of personal data by the Cookiebot tool, please visit https://www.cookiebot.com/en/privacy-policy/. Although cookies do not directly store your name, email address, or phone number, they can identify you through your IP address, device ID, or other unique identifiers. This data, combined with other information collected by cookies, can be used to create a user profile and track your activity on the web.
Type of cookieCharacteristics
Essential/Necessary cookiesEssential cookies contribute to the usability of the website by enabling basic functions such as website navigation and access to secure areas of the website. The website cannot function properly without these cookies. Essential cookies do not, as a rule, collect personal data in a way that would allow a specific person to be identified. Although they do not collect personal data, in some cases, when combined with other information, they can potentially contribute to the identification of the user.
Preference cookiesPreference cookies allow the website to remember information that changes the appearance or functionality of the website, such as the preferred language or region where the user is located. Preference cookies, such as those that remember language or display settings, may collect personal data.
Statistical/analytical cookiesStatistical cookies help website owners understand how different users behave on the website by collecting and reporting anonymous information. Cookies allow for counting visits to the websites of personal data Joint Controllers and traffic sources, counting the number of users, and thus measuring and statistically analyzing how users use the website. The above-mentioned cookies may potentially collect personal data in the form of so-called behavioral data, i.e., data on how the website is used, which may be considered personal data.
Marketing/Advertising cookiesMarketing cookies are used to track users on websites. The aim is to display advertisements that are relevant and interesting to individual users and thus more valuable to third-party publishers and advertisers. These files collect information about user behavior obtained while browsing the website in order to display advertisements related to the user's browsing profile. These cookies may collect information about location, preferences, browsing history, and user behavior, which may also be considered personal data.
Unclassified cookiesUnclassified cookies are cookies that are in the process of being classified, along with the providers of individual cookies.

Cookie Declaration

The following table lists all cookies used on this website:

Cookie declaration failed to load. Please refresh the page or check your network connection.

Cookie Information and Usage

The information stored in cookies on websites is used by the Joint Controllers, with the exception of files specified as "third-party cookies." Third-party cookies are cookies used and managed by external entities to provide services required by us to improve our services and the User's experience when browsing our website. The main services for which third-party cookies are used are obtaining access statistics.

As part of cookie technology, Joint Controllers may use tracking pixels or clear GIF files to collect information about how you use their services and your response to marketing messages sent by email.

Joint Controllers may use web log files (which contain technical data such as the user's IP address) to monitor traffic within their services, resolve technical problems, detect and prevent fraud, and enforce the provisions of the User Agreement.

The controller does not use any cross-site tracking technologies, and the personal data collected about each user is not sold or shared for the purpose of advertising based on the collection of multi-contextual behavior from different websites.

The Joint Controllers inform that the website does not respond to DNT (Do Not Track) signals, but the user can disable certain forms of online tracking, including some analytics and personalized advertising, by changing the cookie settings in their browser or using our cookie consent tools (if applicable).

Detailed information on changing cookie settings and deleting cookies yourself in the most popular web browsers is available in the help section of your web browser and on the following pages (just click on the link):

Google ChromeMozilla FirefoxMicrosoft EdgeOperaSafari macOSSafari iOS/iPad OS

Detailed information on managing cookies on your cell phone or other mobile device should be available in the user manual for that mobile device.

§ 7. Business-to-Business Outreach Activities

About this section

This section supplements §§ 1–6 above and describes only the scope of data processing within business-to-business outreach campaigns conducted by Zero Fluff Digital — initiating commercial contact with companies that have not actively reached out via our website. All matters not covered here (data subject rights, supervisory authority, cookies, general data sharing principles) are governed by §§ 1–6.

7.1. Why we contact you

We conduct business-to-business outreach for Zero Fluff Digital — an accountability-first growth marketing agency specialising in incrementality measurement, creative testing systems, and paid-media operations for direct-to-consumer e-commerce and business-to-business companies. We reach out to companies whose profile suggests a potential fit with these services.

The legal basis for processing is our legitimate interest under Article 6(1)(f) of the GDPR — conducting business-to-business direct marketing. Recital 47 of the Regulation explicitly cites direct marketing as an example of such legitimate interest. A formal Legitimate Interests Assessment (LIA) is on file and reviewed periodically.

7.2. What data we process in outreach

We process exclusively business-related data necessary to conduct outreach:

  • First name and last name, if available in public sources
  • Business email address
  • Job title or role within the company
  • Company name
  • LinkedIn profile URL, if obtained from a public profile
  • Communication history with us, including message content and timestamps
  • Public information about your company (website content, press mentions, podcast appearances)
  • For website-related campaigns, technical data about your public website (SSL certificates from crt.sh public Certificate Transparency logs, Lighthouse performance scores)

7.3. Where outreach data comes from (GDPR Article 14 disclosure)

Under Article 14 of the GDPR — applicable where personal data is obtained from sources other than the data subject — we disclose below the categories of sources from which we may have aggregated the business contact data used for outreach. In our outreach emails, this aggregation is summarised by the phrase "I ran deep research on your domain". This Section 7.3 is the substantive Article 14 source disclosure that the email phrase refers to.

Data is obtained exclusively from publicly available business sources, optionally enriched and cross-referenced by AI research agents (Google Gemini Deep Research, OpenAI ChatGPT Deep Research, Anthropic Claude — all on Business / Workspace tiers with signed DPAs as listed in § 3):

  • Company websites, including contact sections and team pages
  • LinkedIn public professional profiles
  • B2B databases and email finder waterfall tools: Apollo.io, Clay, FindyMail, Prospeo — all EU-US DPF compliant (see § 7.6)
  • Public podcasts and conference materials, if you or your company participated
  • Public technical registers — in particular crt.sh, an ETSI-standard Certificate Transparency log
  • Public industry directories, including madewithlovable.com for Lovable-built websites
  • AI research agents aggregating the above sources: Google Gemini Deep Research, OpenAI ChatGPT (Deep Research mode), Anthropic Claude. These agents may surface email addresses that they retrieved from any of the publicly indexed sources above, or from their integrations with the B2B databases in this list. The AI providers themselves are processors of any personal data we share with them — see § 3 "AI Productivity & Research Tools" for their DPA basis.

If you would like to know which specific combination of the above sources surfaced your contact details for a given outreach email, please contact [email protected] and we will provide a per-record response within 30 days as required by Article 12(3) GDPR.

7.4. How long we keep outreach data

  • Active leads (people we are in correspondence with, or who have not yet responded) — kept up to 24 months from last contact
  • After opt-out, data is marked as suppressed and retained solely to ensure you are never contacted again
  • Upon explicit request, data is deleted earlier — within a maximum of 30 days

7.5. How to opt out

You can opt out of our outreach in three ways:

  1. Reply to any of our emails with the word STOP or the phrase "not interested". You will be immediately excluded from all our campaigns.
  2. Click the unsubscribe link in the footer of each email.
  3. Send an email to [email protected] requesting data deletion.

Opt-out requests are processed without undue delay — typically immediately upon receipt and at the latest within the thirty (30) day period mandated by Article 12(3) GDPR. We use commercially reasonable efforts to ensure suppression propagates immediately across all our active marketing channels; in the rare case of technical limitations of third-party platforms, the request remains effective and is logged for follow-up. Suppression is permanent — once added to our suppression list, your contact details are retained solely to prevent re-contact, and not for any further processing.

7.6. Outreach-specific sub-processors

In addition to the sub-processors listed in § 3, the following operate within outreach activities:

Instantly — cold-email platform, US-based servers (EU-US DPF compliant). Used as the system of record for outreach sequences and replies.

Supabase — lead-management database, servers in the European Union (Frankfurt / Ireland regions). Data Processing Agreement in place.

n8n — workflow automation, self-hosted on our own EU infrastructure (no third-party processor relationship — we are both controller and processor for this layer).

Apollo, Clay, FindyMail, Prospeo — B2B data providers and email finders, all US-based, all EU-US DPF compliant.

International transfers to US-based sub-processors occur under the EU-US Data Privacy Framework — Commission adequacy decision of 10 July 2023 — and Standard Contractual Clauses included in the processor agreements.

7.7. Email tracking

Outbound outreach emails may contain open-tracking pixels — a standard practice for cold-email platforms. Tracking data is used solely for campaign performance statistics and is not combined with external behavioural profiles, nor used to build individual profiles of recipients.

7.8. Automated profiling and qualification (Article 22 GDPR)

For some outreach campaigns we run a Catalyst pipeline that performs automated analysis combining (a) public podcast or conference transcripts of company representatives, (b) public LinkedIn profile data, and (c) public company website content to score the likely fit of your company with our service offering.

This is automated qualification, not an automated decision producing legal effects within the meaning of Article 22(1) GDPR — the only operational outcome is whether we send you an outreach email at all. No contractual or financial consequence is attached to the qualification.

Nonetheless, you retain the rights set out in Article 22 GDPR and may at any time:

  • request human intervention in the qualification,
  • express your view on the outcome,
  • contest the result.

Send such requests to [email protected]. We respond within 30 days as required by Article 12(3) GDPR.

7.9. Polish Prawo Komunikacji Elektronicznej (PKE 2024)

For recipients who are individual entrepreneurs registered in the Polish CEIDG (sole traders — jednoosobowa działalność gospodarcza, "JDG"), Article 398 of the Polish Prawo Komunikacji Elektronicznej (PKE, 2024) applies in addition to GDPR. We address this in three ways:

  • We rely on the legitimate-interest basis under Article 6(1)(f) GDPR for the initial business-to-business contact, where the recipient's contact details have been published by the recipient themselves in a business-to-business context (company website, professional LinkedIn profile, public business directories).
  • Outreach to JDG recipients carries an enhanced opt-out statement referencing Article 398 PKE explicitly, so that the recipient understands and can exercise the PKE-specific objection in addition to the general GDPR right of objection.
  • Our Data Protection Officer reviews the JDG outreach log on a quarterly cadence. Any complaint relating to PKE is treated as a hard signal and triggers an immediate review of the outreach approach for this audience, up to and including suspension of JDG outreach.

Where prior consent is the more appropriate basis (e.g. recipients who have not made their contact details publicly available in a business-to-business context, or where the offered service is unrelated to the recipient's registered activity), we will obtain consent before sending.

7.10. Contact for outreach matters