Privacy Policy
Last updated 23 August 2026
Contents
1. Who we are
MZ Marketing ("MZ Marketing", "we", "us") is a performance marketing company that plans, produces and operates paid advertising campaigns on behalf of its clients, primarily on TikTok. This policy explains what information we handle, why, and what rights you have over it.
For questions about this policy or about data we hold, contact [email protected].
2. Information we collect
Information you give us
- Business contact details — name, email address, company and any information you include when you contact us or engage our services.
- Account credentials — where we provide access to our internal dashboard, we store a name, an email address and a securely hashed password. We never store passwords in readable form.
Information collected automatically
- Session data — when signed in to our dashboard, a session cookie identifies your session. See Cookies.
- Technical logs — our hosting provider records standard request information such as IP address, user agent and timestamp, for security and reliability.
Information we do not collect
We do not build advertising profiles of individual consumers, we do not buy or sell personal data, and we do not collect special category data. Our landing pages do not ask visitors for personal information beyond what a campaign explicitly discloses at the point of collection.
3. Advertising platform data
We access advertising platform APIs — including the TikTok Marketing API — strictly to operate advertising accounts that we own or that an advertiser has explicitly authorised us to manage.
- Access is granted by the account holder through the platform's own authorisation flow. We never ask for, receive or store an advertiser's platform username or password.
- We store an access token issued by the platform, plus the identifiers, names, currency and timezone of the advertising accounts that authorisation covers.
- We retrieve aggregated campaign performance data — such as spend, impressions, clicks, conversions and cost metrics — for reporting and optimisation.
- We create and modify campaigns, ad groups, ads, budgets and creatives within those authorised accounts, at the direction of the account holder.
We do not access, request, store or process personal data belonging to platform end users. The data we handle through advertising APIs is limited to advertiser account configuration and aggregated campaign performance. We do not resell API access and we do not provide platform data to any third party.
An advertiser can revoke our access at any time from within their platform account. On revocation we stop accessing the account and delete the stored access token.
4. How we use information
- To provide, operate and improve our advertising services.
- To create, manage, optimise and report on advertising campaigns in authorised accounts.
- To authenticate users of our dashboard and keep it secure.
- To communicate with clients about work in progress, invoices and support.
- To meet legal, accounting and regulatory obligations.
We do not use client or platform data to train machine learning models, and we do not use it for any purpose unrelated to delivering the service.
5. Legal bases
Where the UK GDPR or EU GDPR applies, we rely on:
- Contract — to deliver the services a client has engaged us for.
- Legitimate interests — to operate, secure and improve our business, balanced against your rights.
- Legal obligation — to keep records we are required to keep.
- Consent — where we ask for it, which you may withdraw at any time.
6. Who we share information with
We do not sell personal information. We share it only with service providers who help us operate, and only as far as needed:
- Advertising platforms (for example TikTok) — to run campaigns in authorised accounts.
- Hosting and infrastructure providers — to serve our website and dashboard.
- Analytics and attribution providers — to measure campaign performance.
- Professional advisers and authorities — where we are legally required to disclose information.
7. Cookies
This public website sets no advertising or analytics cookies.
Our client dashboard sets a single strictly necessary cookie, sid,
which identifies your signed-in session. It is HttpOnly, Secure and
SameSite=Lax, expires after 30 days, and exists only to keep you signed in. Signing
out deletes the session. Blocking it will prevent the dashboard from working.
8. How long we keep information
- Business contact details — for the duration of our relationship and a reasonable period afterwards.
- Dashboard accounts — until the account is deactivated at the client's request.
- Platform access tokens — until authorisation is revoked or access is no longer needed.
- Campaign performance data — for as long as needed for reporting and to meet accounting obligations.
9. Security
All traffic to our website and dashboard is encrypted in transit over HTTPS. Passwords are stored only as salted, iterated hashes. Access to production systems and to advertising accounts is limited to personnel who need it, and sensitive credentials are held as encrypted secrets rather than in application code. Access to stored credentials within the dashboard is logged.
No system is perfectly secure. If we become aware of a breach affecting personal data, we will notify affected parties and the relevant supervisory authority where the law requires it.
10. International transfers
We operate across several countries and our providers may process information outside your own. Where information moves out of the UK or EEA, we rely on an adequacy decision or on standard contractual clauses with appropriate safeguards.
11. Your rights
Depending on where you live, you may have the right to access a copy of your information, to have it corrected or deleted, to restrict or object to how we use it, to data portability, and to withdraw consent. To exercise any of these, email [email protected]. We will respond within the period required by applicable law.
If you are in the UK or EEA and are unhappy with our response, you may complain to your local data protection authority.
12. Children
Our services are business-to-business and are not directed at children. We do not knowingly collect information from anyone under 18. Advertising campaigns we run are targeted in line with each platform's minimum age requirements and applicable law.
13. Changes
We may update this policy as our services change. The date at the top of this page reflects the most recent revision. Material changes will be communicated to active clients directly.
14. Contact us
MZ Marketing
Email: [email protected]
Web: mzmarketing.net