Legal
Privacy and cookie policy
This policy explains how MoreAds OÜ, operating as X5 Agency, processes personal data on x5.agency and when you contact us.
1. Who is responsible
The data controller is MoreAds OÜ, registered in Estonia, address Harju maakond, Tallinn, Kristiine linnaosa, Tulika tn 17, 10613, VAT number EE102573998. For any question about this policy or your data, email agency@x5.agency.
2. What data we process and why
| Situation | Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| You browse the site | IP address, user agent, requested URL, time, referrer, in server and CDN logs | Serving the site, security, abuse prevention | Legitimate interest, Art. 6(1)(f) | Logs are kept by our hosting provider for up to 30 days |
| You send the contact form or email us | Name, company, email, what you write, the page you sent it from | Answering your request, preparing a proposal, starting a business relationship | Consent, Art. 6(1)(a), and steps before a contract, Art. 6(1)(b) | Until the request is closed, then up to 24 months for follow-up unless a contract is signed |
| You apply for a job | Name, email, CV or profile link, what you write | Considering your application | Consent, Art. 6(1)(a) | Up to 6 months after the position is filled, unless you ask us to delete it earlier |
| You allow analytics cookies | Pseudonymous identifier, pages viewed, device and browser type, approximate location from a truncated IP | Understanding how the site is used and improving it | Consent, Art. 6(1)(a) | Analytics identifiers expire after 24 months at most; you can withdraw consent at any time |
We do not sell personal data and we do not use it for automated decisions that have legal effects on you.
3. Cookies and similar storage
The site sets nothing optional until you choose. The banner offers two options: "Allow analytics" or "Only necessary". You can change your choice at any time with the "Cookie settings" link in the footer.
| Name | Type | Set by | Purpose | Expires |
|---|---|---|---|---|
x5_consent | Strictly necessary (localStorage) | x5.agency | Remembers your cookie choice | Until you clear browser storage |
_ga, _ga_* | Analytics, optional | Google Analytics | Distinguishes visitors and sessions. Loaded only after you choose "Allow analytics" and only if analytics is enabled on the site | Up to 24 months |
Fonts are loaded from Google Fonts. Your browser sends your IP address to Google to fetch the font files; Google states that it does not use this to set cookies or to profile users. If you prefer, block third-party fonts in your browser and the site falls back to a system font.
4. Who receives the data
- Amazon Web Services (S3 and CloudFront), which hosts the site and keeps access logs. AWS processes data under its Data Processing Addendum with EU Standard Contractual Clauses.
- The email provider that delivers messages sent to agency@x5.agency.
- AWS Lambda and Amazon SES (us-east-1), which deliver form submissions to our mailbox. Submissions are not stored by these services beyond delivery logs.
- Google Ireland Ltd for Google Analytics, only if you allow analytics cookies. Google may transfer data to the United States under the EU-US Data Privacy Framework and Standard Contractual Clauses.
- Authorities, when the law requires it.
5. International transfers
Data is stored in the EU where possible. Where a processor operates outside the European Economic Area, we rely on an adequacy decision or Standard Contractual Clauses under Art. 46 GDPR.
6. Your rights
Under the GDPR you can ask us to access, correct, delete or restrict your data, object to processing based on legitimate interest, receive your data in a portable format, and withdraw consent at any time without affecting processing done before. Email agency@x5.agency; we answer within one month.
You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or the supervisory authority in your own EU country.
7. Security
The site is served over HTTPS only. Access to mailboxes and hosting is limited to people who need it and protected by two-factor authentication.
8. Children
The site is meant for businesses. We do not knowingly collect data from anyone under 16.
9. Changes
When this policy changes, the date at the top changes with it. If a change affects how we use data you already gave us, we let you know by email where we can.