Privacy policy

Controller and contact

The controller for the processing of personal data on adlesa.com and network.adlesa.com is:

For all questions about data protection, including requests to exercise your rights, please write to this address.

Legal basis

We process personal data in accordance with the General Data Protection Regulation (GDPR), the Spanish Organic Law 3/2018 (LOPDGDD) and, for access to information on your device (for example cookies), the German Telecommunications Digital Services Data Protection Act (TDDDG) where it applies to you. Depending on the purpose, we rely on:

• Art. 6(1)(b) GDPR: processing is necessary to provide the service you request or to take steps before a contract (for example your account and your publisher application).
• Art. 6(1)(a) GDPR: your consent (for example newsletter and optional cookies). You can withdraw it at any time with effect for the future.
• Art. 6(1)(c) GDPR: we must comply with a legal obligation (for example accounting and tax retention).
• Art. 6(1)(f) GDPR: our legitimate interests in secure and stable operation, in preventing fraud and abuse in the affiliate network, and in answering enquiries efficiently.

Visiting this website

When you open our website, the web server automatically records technical access data (server log files): the page requested, date and time, amount of data transferred, status code, browser type and version, operating system, referrer URL and your IP address. We use this data to deliver the website, to keep it secure and stable and to detect and follow up attacks or abuse. The legal basis is Art. 6(1)(f) GDPR. We do not combine this data with other data sources to identify you.

The website uses fonts and scripts that we host ourselves. At the time of writing we do not load analytics or advertising tools from third parties on adlesa.com.

Contact and demo requests

If you send us a message through a form on the website (contact, demo request, agency or partner enquiries) or by email, we process the details you enter, typically name, email address, company and your message, to answer your request and for follow-up questions. The legal basis is Art. 6(1)(b) GDPR for requests that concern a contract or onboarding, otherwise Art. 6(1)(f) GDPR. To protect the forms against abuse we apply a rate limit that uses a pseudonymised (hashed) form of your IP address and a hidden spam-protection field. Enquiries are deleted when they have been dealt with and no statutory retention duty applies.

Newsletter

We send our newsletter only with your consent (Art. 6(1)(a) GDPR). Signing up requires a valid email address and a confirmation through a link we send you (double opt-in). To be able to prove your consent we store your email address, the date and time of sign-up and confirmation, your IP address, browser information and the consent text shown. The data is used only to send the newsletter and is not passed on to third parties for their own purposes. You can withdraw your consent at any time through the unsubscribe link in every newsletter or by writing to us. We then delete your address from the mailing list and keep only the minimum record needed to prove that you signed up and unsubscribed, as far as we are allowed to (Art. 6(1)(f) GDPR).

Cookies and consent

Cookies are small files stored on your device. We distinguish between necessary and optional cookies.

• Necessary: adlesa_consent stores your cookie choice for up to 12 months. On the publisher portal at network.adlesa.com we also set a session cookie (adlesa_session) and a security cookie (XSRF-TOKEN) so that you can sign in and so that forms are protected against forgery. These cookies are required to provide the service you request. The legal basis is Art. 6(1)(f) GDPR and, for the access to your device, § 25(2) no. 2 TDDDG.
• Optional (analytics, marketing): these are only set or loaded after you give active consent in the cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). The banner offers equal options to accept all, to reject optional cookies or to choose categories. At present we do not use any optional cookies; the choice will apply as soon as we introduce such tools, and we will name them here beforehand.

You can change or withdraw your choice at any time via “Cookie settings” in the footer. You can also restrict or delete cookies in your browser; the portal will then not work for signed-in use. You can manage many advertising cookies via aboutads.info/choices (US) or youronlinechoices.com (EU).

Publisher registration and account

Registration for publishers, bloggers and creators takes place at network.adlesa.com. We process the following data to create and run your account and to review your application (Art. 6(1)(b) GDPR):

• Website or channel: the address (URL) of your website, blog or social profile, its name, category, the countries your visitors come from, your optional self-declared monthly traffic and an optional description. We use this to review whether your site fits our partner programs, to assign matching programs and to prevent the same site from being registered twice (Art. 6(1)(f) GDPR). We may open the public page you named in the course of the review.
• Account: email address, a password (stored only in hashed form), a username generated from your email address and an API token for your account.
• Contact details: salutation, first and last name, company (optional), postal address and country, which we need for contracts, invoices and payouts and for tax obligations.
• Confirmations: your acceptance of the terms and of the content guidelines, with the time of registration.

Provision of these details is necessary to use the portal; without them we cannot create your account. After you register, our team reviews your site, usually within one to two working days, and informs you by email. To improve the registration, we count anonymously how far visitors get in the registration form (form viewed, step completed, account created). For this we store a one-way hash of the technical session ID with the step and the time, without email address, IP address or other personal data (Art. 6(1)(f) GDPR). Decisions on approval are made by our staff; we do not use fully automated decision-making with legal effect (Art. 22 GDPR).

Tracking, commissions and payouts

When you join partner programs and place tracking links, we record clicks and resulting conversions and assign them to your publisher account, together with the commission, status and payout. We need this data to attribute and settle commissions between advertisers and publishers (Art. 6(1)(b) GDPR) and to detect fraudulent or invalid traffic (Art. 6(1)(f) GDPR). If you request a payout, we process the payment details you provide for that purpose. Advertisers whose programs you join can see the information needed to run the partnership, such as your publisher identifier, your approved site and the performance of your links; they do not receive your private account details unless needed to fulfil the contract.

Service emails

We send emails that are needed for the service, for example a confirmation after registration, the result of the site review, notices about changes to your account, programs or payouts, and security messages (Art. 6(1)(b) GDPR). These are not advertising. Our team also receives an internal notification about every new application so that it can be reviewed promptly.

Recipients and processors

We pass personal data on only where this is necessary for the purposes above, where the law requires it or where you consent. Recipients can be: our hosting and infrastructure provider, who processes data on our behalf under a data processing agreement; advertisers and affiliate network partners to the extent described in the section on tracking; and tax advisers, auditors, authorities or courts where we have a legal duty or a legitimate interest. We do not sell personal data.

Transfers to third countries

We do not intend to transfer your personal data to countries outside the European Economic Area. If a service provider processes data outside the EEA, this happens only if an adequacy decision exists or on the basis of appropriate safeguards such as the EU standard contractual clauses. On request we provide a copy of these safeguards.

Storage period

We store personal data only as long as needed for the purpose. Server log files are kept for a limited time and then deleted or anonymised. Contact enquiries are deleted once they are resolved. Account data is kept while your account exists and deleted on request after the account is closed, unless statutory retention periods apply, in particular under commercial and tax law (usually six to ten years for invoices and booking records), or the data is needed to establish, exercise or defend legal claims. Data of rejected applications is deleted after a short period, unless you ask us to keep it, so that we can answer questions about the decision.

External content and links

Our website and emails contain links to external websites, for example the sites of advertisers or publishers. We have no influence on how those operators process data; their own privacy policies apply once you follow a link. If we embed content from third parties in the future (for example videos or maps), your IP address is transmitted to the provider because otherwise the content could not be delivered. We will only do so after your consent where the law requires it.

Your rights

Under the GDPR you have the right to:

• access to the data we hold about you (Art. 15);
• rectification of inaccurate data (Art. 16);
• erasure (Art. 17) and restriction of processing (Art. 18);
• data portability, meaning to receive data you provided in a common, machine-readable format (Art. 20);
• object at any time to processing based on legitimate interests, on grounds relating to your particular situation (Art. 21);
• withdraw a consent at any time with effect for the future, without affecting the lawfulness of the processing before the withdrawal (Art. 7(3)).

To exercise your rights, write to marketing@adlesa.com. You also have the right to lodge a complaint with a data protection supervisory authority. The authority competent for us is the Spanish Agencia Española de Protección de Datos (aepd.es); you can also contact the authority of your place of residence or work.

Changes to this policy

We update this policy when our services or the legal situation change. The current version is always available on this page.

Last updated: October 2026. Provider: Auerswald Marketing S.L., Ctra. del Cap de la Nau Pla, 126-1-18, 03730 Xàbia, Spain