1. Who is responsible for your data

The controller is the individual operator of the ZS Proces project in Croatia. ZS Proces is not currently a registered company. For privacy questions and data-rights requests, contact privacy@zsproces.com.

The controller details in this policy will be updated when the business is formally registered. This does not reduce your rights under applicable data-protection law.

2. Information we may process

Website information

Our hosting and security providers may process technical data such as IP address, browser type, requested pages, timestamps and security events. This website currently uses no advertising cookies, analytics cookies or contact-form tracking.

Meta account and advertising information

When a Meta account holder authorizes an integration, it may access:

• basic account identifiers needed for authentication;
• Business, Page and Ad Account names and identifiers;
• campaigns, ad sets, ads, creative metadata and delivery status;
• performance insights such as spend, reach, impressions, clicks and conversions;
• permissions, access tokens and token-related technical information; and
• lead information only if a lead-related feature is separately enabled and authorized.

The exact information available depends on the permissions granted through Meta. ZS Proces does not ask for Meta passwords.

Agent and support information

Instructions, conversation history, agent memory, generated analyses and diagnostic logs may be processed when Hermes Agent is used to perform authorized tasks.

3. Why we process information

• to connect and authenticate an account you have authorized;
• to retrieve, analyze, report on or manage advertising assets at your direction;
• to provide requested automation and maintain relevant agent context;
• to diagnose failures, prevent abuse and protect connected accounts; and
• to meet legal, regulatory and platform obligations.

4. Legal bases

Depending on the activity, processing is based on your consent when you connect Meta or enable an optional feature; steps taken at your request or performance of an agreement; our legitimate interests in delivering and securing the requested service; or compliance with a legal obligation. You may withdraw consent without affecting prior lawful processing.

5. Automated actions and human control

Hermes Agent may analyze data and prepare or execute actions within the permissions you grant. Account owners should review material campaign, budget and publishing decisions. ZS Proces does not use this integration to make solely automated decisions that produce legal or similarly significant effects about individuals.

6. Service providers and recipients

Information may be processed by the following categories of recipients:

• Meta Platforms Ireland Limited and its affiliates, for Meta products and APIs;
• Cloudflare, Inc., for DNS, security and website delivery;
• Hostinger and its service providers, for hosting, Hermes Agent and email;
• the AI model provider selected in the Hermes Agent configuration; and
• professional advisers or authorities when legally required.

We do not sell personal data. We do not share Meta data with data brokers or use it to create unrelated advertising profiles.

7. International transfers

Some providers may process information outside Croatia or the European Economic Area. Where required, transfers rely on an adequacy decision, Standard Contractual Clauses or another lawful safeguard provided by the relevant service provider.

8. Retention

Meta access tokens are retained only while the connection remains active or until they expire or are revoked. Campaign data, conversation history, agent memory and operational logs are kept only as long as needed for the authorized task, continuity, security or legal obligations. Data associated with a valid deletion request is removed from active systems without undue delay and normally within 30 days. Residual backup copies may take up to 90 days to cycle out, unless longer retention is legally required.

9. Security

We use access controls, encrypted connections, limited permissions and provider security features appropriate to the service. No internet service is completely risk-free. Please report suspected unauthorized access to privacy@zsproces.com.

10. Your rights

Subject to applicable law, you may request access, correction, erasure, restriction or portability of your personal data, and may object to certain processing. You may withdraw consent at any time. We may request reasonable information to verify your identity and ordinarily respond within one month.

You may also lodge a complaint with the Croatian Personal Data Protection Agency (AZOP) at azop.hr.

11. Children

This service is intended for business users and is not directed to children. We do not knowingly collect children's personal data.

12. Changes to this policy

We may update this policy when the service, providers or legal entity changes. The effective date above will be revised and material changes will be communicated where required.