Privacy Policy

Last updated: 13 October 2026

Who is responsible for your data?

Maco Agency OÜ (MACO), registration number 12915093, VAT number EE101821968, is responsible for the processing described in this notice. Address: Tornimäe 7-117, 10145 Tallinn, Estonia. For privacy questions or requests, contact kristina@maco.agency.

Information we process and why

Enquiries and client services

When you contact us, we process the name, email address, message and any other information you choose to provide, such as your telephone number or company details. We use this information to respond, discuss potential work and provide agreed services. Sending a contact enquiry does not subscribe you to a newsletter.

We process information needed to take steps at your request before a contract or to perform a contract (GDPR Article 6(1)(b)). When communicating with a company's representative or handling other business enquiries, we rely on our legitimate interest in managing business communications and client relationships (Article 6(1)(f)). We retain records required by law, including accounting records, on the basis of legal obligations (Article 6(1)(c)).

Website operation and optional measurement

Our website and hosting services process technical information, such as IP address, requested page, browser information and server logs, to deliver and protect the site. Necessary storage, including the record of your privacy choices, supports these functions. We rely on our legitimate interest in operating a functional and secure website for this processing.

With your analytics consent, we use Google Analytics 4 to understand visits, traffic sources, pages viewed and interactions. Optional measurement may process online identifiers, device and browser details, page URLs and approximate location. Aggregate reports do not mean all underlying data is anonymous. We use the LinkedIn Insight Tag with separate marketing consent, as described below.

Optional analytics and marketing processing is based on consent (Article 6(1)(a)). You can accept or reject these purposes separately and change your choice using Privacy settings on the website. Declining them does not prevent you from contacting us. Withdrawing consent does not affect processing that was lawful before withdrawal.

Plausible Analytics

Our Webador website includes cookie-free visitor measurement provided by Plausible Insights OÜ, Estonia. It counts page visits and provides statistics about traffic sources, pages, browser and device types and approximate location. It does not use cookies or persistent identifiers or track visitors across websites or days. This platform-level measurement operates separately from our optional Google Analytics and LinkedIn consent choices.

Plausible temporarily processes the IP address and browser User-Agent to derive approximate location and a daily visitor identifier; it does not store the raw IP address or User-Agent. According to Plausible, visitor data is processed and stored in the European Union. We rely on our legitimate interest in understanding basic website usage (GDPR Article 6(1)(f)). See Plausible’s Data Policy.

Google reCAPTCHA on contact forms

Our Webador contact forms use Google reCAPTCHA Enterprise to detect spam, automated submissions and abuse. Google processes technical signals, including the visitor’s IP address, browser and device information and interactions needed to assess whether a submission is legitimate. This security service is separate from optional marketing measurement. We rely on our legitimate interest in protecting our website and communication channels against spam and abuse (GDPR Article 6(1)(f)).

Processing through reCAPTCHA Enterprise is covered by the applicable Google Cloud data-protection and service terms. Further information is available in Google’s reCAPTCHA documentation and the Google Cloud Privacy Notice.

Email marketing and Mailchimp

Mailchimp remains an available email-marketing service for MACO. We are not currently sending campaigns through it. If you have separately subscribed to marketing messages, your subscription details may be held in Mailchimp; pausing campaigns does not itself delete an existing subscription.

For consent-based email marketing, we use your email address, any name you provide and your subscription preferences only with your separate consent. A general enquiry is not permission to add you to a marketing list. You can withdraw consent by contacting us and, when a campaign is sent, by using its unsubscribe link.

Where we use Mailchimp to manage a mailing list, The Rocket Science Group LLC d/b/a Mailchimp processes the relevant contact data on our behalf under its Data Processing Addendum. Mailchimp also describes its own processing in its Global Privacy Statement.

Recipients, security and international transfers

Depending on the activity, information may be handled by our authorised personnel and relevant service providers: Webador for website hosting and forms, GoDaddy for domain-related services, Google for analytics and reCAPTCHA spam protection, Plausible Insights OÜ for cookie-free measurement through Webador, LinkedIn for consent-based audience measurement, and Mailchimp where used for subscribed email contacts. A provider does not necessarily receive every category of data. The MACO Data Collector section below explains the separate handling of connected client-account reports and assisted review.

Access is limited according to the purpose and role. Service providers may process data to deliver their services; access is not limited exclusively to MACO employees. LinkedIn's independent-controller role is explained below.

Providers may process data outside the European Economic Area, including in the United States. Applicable safeguards may include an adequacy decision for an eligible recipient or European Commission Standard Contractual Clauses, together with additional measures where required. For Mailchimp, the applicable transfer arrangements are described in its Data Processing Addendum. Contact us for information about safeguards relevant to your data. We do not rely on the former EU–US Privacy Shield as a transfer basis.

Retention

Retention depends on the purpose: enquiries and client correspondence are kept for handling the matter, providing the service and meeting relevant record-keeping or legal-claim needs. Accounting records are generally retained for seven years as required by Estonian law. This accounting period is not a blanket retention period for all website or marketing data.

Subscription details are retained while needed to manage the subscription. Following withdrawal, limited records may be retained where needed to respect an opt-out or demonstrate compliance. Provider-held analytics and marketing records follow the applicable service settings and provider terms. The specific current practices for local Google API records and LinkedIn Insight Tag data are described below. Contact us about the retention or deletion of your particular records.

Your rights and how to contact us

Subject to the applicable conditions, you can request access, correction, deletion, restriction of processing and portability of your personal data. You can object to processing based on legitimate interests and to direct marketing, including related profiling. You can withdraw consent at any time.

Send requests to kristina@maco.agency. We may request proportionate information to verify your identity. We respond without undue delay and normally within one month. Where a lawful extension is needed because of complexity or the number of requests, we will explain it within that first month. Deletion and portability are subject to their legal conditions, including obligations to retain certain records.

You may lodge a complaint with the Estonian Data Protection Inspectorate: www.aki.ee, info@aki.ee, or another competent supervisory authority.

MACO Data Collector — Google API data

MACO Data Collector is a local reporting tool operated by authorised personnel of Maco Agency OÜ as part of the marketing measurement and analysis services provided to its clients. It accesses connected Google accounts only with the account holder’s permission and is not available as a public self-service application.

With the Google account holder’s permission, it reads reports from configured Google Search Console and Google Analytics 4 properties. These reports include search queries, pages, impressions, clicks, average positions, traffic sources, sessions, engagement and event counts. Access is read-only.

We use these reports to compare reporting periods, check measurement quality and support marketing decisions. The collector does not change website content, Google account settings or advertising campaigns.

Downloaded reports, generated reports and operational records are stored locally with restricted access. Google access credentials are stored separately in a restricted folder on an encrypted computer. The application does not collect Google account passwords.

At the account holder’s request, selected report data may be processed through OpenAI’s ChatGPT or Codex for assisted review. Such review is permitted only after MACO has verified that the applicable provider terms and account settings exclude use of this data for AI model training. If this has not been verified, Google API report data must not be submitted to the AI service. The collector itself makes no automatic calls to AI services. Access tokens and client secrets are excluded from report review.

Google API data is not used to train AI models. MACO’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google API data is not sold or used for advertising targeting. Local records are currently retained for measurement comparisons and validation until the authorised operator deletes them; automatic deletion is not configured.

The account holder can revoke access through their Google Account connections settings. Revocation stops future access but does not automatically delete previously downloaded records. To request deletion or ask about this tool, contact kristina@maco.agency.

LinkedIn Insight Tag

With your marketing consent, we use the LinkedIn Insight Tag to receive aggregated insights about the professional audience visiting our website, such as companies and job roles. LinkedIn’s reports to us do not identify individual visitors. The tag is optional and is not loaded when you decline marketing cookies. Analytics and marketing choices can be managed separately using Privacy settings on our website.

The provider is LinkedIn Ireland Unlimited Company. The tag sends LinkedIn information such as the page URL, referrer, IP address, browser and device characteristics, and visit timestamp. LinkedIn may associate this information with its members and use it for its own advertising, measurement and service-improvement purposes, as described in its Privacy Policy. Under LinkedIn’s Independent Controller Addendum, LinkedIn acts as an independent controller for the relevant Insight Tag data; it is not solely a processor acting on MACO’s instructions.

You can withdraw marketing consent using Privacy settings. Changing an active consent choice reloads the page to apply it. Withdrawal stops future loading of the tag on our website; it does not automatically erase information LinkedIn has already received. LinkedIn members can also manage advertising preferences in their LinkedIn account.

LinkedIn states that it removes direct identifiers within seven days and deletes the remaining pseudonymised Insight Tag data within 180 days. Its current retention information and privacy controls are available at the links below.

LinkedIn Privacy Policy
Insight Tag data
Independent Controller Addendum