Privacy Policy

for the application “MBA Leadzentrale” · last updated October 2026

1. Controller

Mehr Baumpflege Anfragen, owner Kevin Lasarz, Möhringer Landstraße 108, 70563 Stuttgart, Germany, e-mail kl@mehrbaumpflegeanfragen.de (see Legal Notice).

2. Purpose of the application

MBA Leadzentrale is an internal tool of our agency. It collects contact enquiries that arrive through our clients' websites (contact forms and clicks on phone, WhatsApp and e-mail buttons), presents them to our staff in a dashboard, and uploads the resulting conversions into the Google Ads accounts of the respective clients, which we manage on their behalf.

3. Data we process

• Contact enquiries: the details entered into the form (e.g. name, phone number, e-mail address, message), time of the enquiry, form name.
• Attribution to ad clicks: Google click identifier (gclid/gbraid/wbraid) and campaign parameters (UTM), if the visit originated from a Google Ads advertisement.
• Visit statistics without personal reference: device type, time on page, scroll depth, load time, whether a form was started or submitted. Inputs of forms that were not submitted are never stored, only the names of the fields that were filled in. The IP address is used only in truncated, hashed form to prevent abuse.
• Technical status of the client website: software versions, installed plugins, e-mail delivery errors.

4. Legal basis

Processing is based on the performance of our contracts with the respective clients (Art. 6(1)(b) GDPR) and on our legitimate interest in evaluating and optimising the advertising campaigns we manage (Art. 6(1)(f) GDPR). Where we process data on behalf of our clients, a data processing agreement pursuant to Art. 28 GDPR is in place.

5. Use of Google user data (Google Ads API)

The application accesses, via the Google Ads API, the Google Ads accounts that our agency manages through its Google Ads manager account (MCC). The access is authorised by the agency's own Google account only. The access comprises reading and creating conversion actions and uploading click conversions (timestamp, Google click identifier, conversion action). No personal data of any person is retrieved from Google, and no campaigns, ads, bids or budgets are modified.

Information received from Google APIs is used exclusively for the purpose described above. It is not transferred to third parties, not sold, and not used for advertising purposes outside the respective client's own Google Ads account. MBA Leadzentrale's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Storage and hosting

Data is stored in a database operated by Supabase Inc. on servers located in the EU (Ireland) under a data processing agreement. All transfers are encrypted. Only authorised employees of our agency can access the data after signing in.

7. Retention

Contact enquiries are retained for as long as required to serve the respective client and are deleted when the engagement ends. Conversions are no longer transmitted to Google later than 90 days after the ad click. Visit statistics are deleted after 13 months. Google OAuth tokens are stored encrypted and can be revoked at any time by the agency in its Google account settings.

8. Cookies on client websites

On our clients' websites the related component (“MBA Connector”) sets a single first-party cookie (mba_attr, lifetime 90 days) storing the Google click identifier and campaign parameters so that a later enquiry can be attributed to the ad click. No cookies are used for visit statistics, and visitors are not recognised across visits.

9. Your rights

Data subjects have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR) as well as the right to lodge a complaint with a supervisory authority. Please direct requests to the contact details given in the Legal Notice.