Privacy Policy

Trés Media AB, org. no. 559471-3579, Åhusgatan 5, 214 38 Malmö, Sweden (“Trés Media”, “we”, “us”) is a marketing agency. We operate a marketing analytics and operations platform (the “Service”) used by our team and by clients and partners we invite, to view and manage the performance of their advertising on Meta platforms (Facebook and Instagram) and related marketing data.

Under the EU General Data Protection Regulation (“GDPR”), Trés Media AB is the controller of personal data we process for our own purposes, such as account administration, security and support. When we process advertising, CRM or other client data solely on a client’s instructions, that client is the controller and Trés Media acts as its processor. The client’s privacy notice also applies to that processing. This policy explains both our own processing and how the Service handles client data.

• Account data. Access is restricted to Trés Media staff and invited client or partner users. When you sign in with your Google account we receive your name, email address and profile picture to create and secure your account.
• Meta connection and advertising data. With the authorization of the relevant business, we store the identifiers and credentials needed to connect to its Meta Business Manager, ad accounts and Pages, including access tokens, granted scopes and connection status. Through Meta’s APIs we retrieve campaign and ad-set structure, targeting configuration, ad creatives, spend and aggregate performance metrics. We do not use the Marketing API to retrieve profiles or contact details of people merely because they see or interact with an ad.
• Client operational, lead and customer data. Where a client configures a connection, the Service processes business and reporting data from its CRM, project-management, accounting or other connected systems. This may include the names, email addresses and phone numbers of leads and customers, along with campaign attribution, customer status and related business records. We process personal data in these records on behalf of and under the instructions of that client.
• Communications data. Information you provide when you contact us, for example by email.
• Technical data. When you use the Service we automatically log technical information such as IP address, browser and device type, and pages visited, for security and operations. The Service uses only cookies that are strictly necessary for sign-in and session management; we do not use advertising or third-party analytics cookies.
• Shared report links. When our staff share a partner report by link, anyone who has the link can open it without signing in, until the link expires or is revoked. For each such link we count how many times the report was viewed, how many times its PDF was downloaded, and how many times the link inside the PDF was used, and we record when it was last viewed. These counts are kept per link: opening a shared report sets no cookies, and the counts include no IP address, browser or device type, or referring page. Automated link previews, such as those from chat or email apps, are excluded from these counts where we can recognize them.

• To provide, secure and operate the Service (performance of our agreement with you or the client you represent; legitimate interests in providing and protecting the Service).
• To deliver reporting and marketing services to the client that authorized access to its advertising, CRM and connected-service data. Where we act as processor, the client determines the legal basis for that processing.
• To communicate with you about the Service, respond to requests, and provide support (legitimate interests).
• To comply with legal obligations, such as accounting rules, and to establish or defend legal claims (legal obligation; legitimate interests).

We do not sell personal data, we do not use it for advertising of our own, and we do not make automated decisions that have legal or similarly significant effects on you.

Data we receive through Meta’s APIs (“Platform Data”) is used solely to provide analytics, reporting and campaign-management services to the business that authorized the connection, in accordance with Meta’s applicable terms and policies. We do not sell Platform Data or use it for our own advertising. Meta access credentials are treated as confidential and are used only to operate the authorized connection. Access can be revoked in Meta’s settings, and you may request deletion as described on our data deletion page.

• Service providers that host and operate the Service on our behalf, such as cloud hosting, database, file-storage, job processing and email providers, and AI model providers used to draft ad copy and support Service features. They receive only the data needed for their service and are subject to contractual or other applicable data-protection obligations.
• Connected services such as Meta and the CRM, project-management, accounting or reporting services configured by the client, when exchanging data is necessary to provide a feature the client has requested.
• The client that owns the data. Advertising and lead data is visible to the client it belongs to and to Trés Media staff who service that client.
• Professional advisors and authorities where required by law or to protect our rights.

Some service providers may process data in countries outside the EU/EEA, including the United States. Where the GDPR requires a transfer mechanism, we use recognized safeguards such as an applicable adequacy decision (including the EU–U.S. Data Privacy Framework) or the European Commission’s Standard Contractual Clauses.

We keep personal data only as long as needed for the purposes described above. Account data is generally kept while the account is active; Meta credentials and connection data while the connection is active or needed to provide the Service; and client-controlled data for the period agreed with, or instructed by, the client. We may keep limited records for longer where required by law (for example, bookkeeping obligations), for security, or to establish or defend legal claims. When data is no longer needed, we delete or anonymize it.

Under the GDPR you may request access to, correction or deletion of your personal data, restriction of or objection to our processing, and a portable copy of data you provided. Where processing is based on consent, you may withdraw it at any time. To exercise these rights, contact us at info@tresmedia.se. If your request concerns data we process for a client, you may also contact that client directly; we will assist the client with the request as required by law. You also have the right to lodge a complaint with the Swedish Authority for Privacy Protection ( Integritetsskyddsmyndigheten) or the supervisory authority where you live.

We use technical and organizational measures designed to protect personal data, including encryption in transit, access controls and restricted accounts. No internet service can be guaranteed fully secure. The Service is a business tool and is not intended for anyone under 18 years of age.

We may update this policy from time to time; material changes will be announced by updating the date above and posting the new version here. Questions? Contact Trés Media AB, Åhusgatan 5, 214 38 Malmö, Sweden · info@tresmedia.se · +46 73-764 68 31.