PRIVACY POLICY — ALTERNATIVE EXPERIENCES ADS REPORTING Last updated: 4 October 2026 1. Who we are and what this policy covers Alternative Experiences Limited operates Alternative Experiences Ads Reporting, an internal tool for analysing advertising across our authorised department ad accounts using the Meta Marketing API. We are responsible for the personal data we process through this reporting tool. For privacy questions or requests, contact accounts@alternativeexperiences.ie. This policy covers the reporting app. It does not replace the separate privacy and cookie notices applicable to our websites, event bookings or Meta's own services. 2. Information we collect When an authorised administrator connects an ad account, the app retrieves information from Meta, including: - Ad-account IDs, account names, currencies and timezones. - Campaign, ad-set and ad IDs, names, statuses, budgets, schedules, targeting settings and attribution settings. - Ad creative information, including text, headlines, images or image links, video identifiers and destination links. - Advertising performance reports, including spend, impressions, reach, clicks, aggregate conversion counts and attributed conversion values. - Technical records needed to operate the integration, including access credentials, synchronisation timestamps and error logs. Performance reports generally contain aggregate statistics rather than the identities of people who view or click ads. However, account information or advertising content may contain personal data, such as names or images. This integration does not request individual lead-form submissions, private messages or customer payment-card details. We also process information you provide when contacting us about privacy. 3. How and why we use information We use this information to maintain an internal advertising dashboard, compare campaign performance over time, monitor advertising expenditure and status changes, and diagnose reporting problems. Where this involves personal data, our basis is our legitimate interest in managing and evaluating our business advertising and maintaining a reliable reporting system, subject to individuals' rights and interests. We may also process information where necessary to meet legal obligations, including responding to applicable data-protection requests. The reporting app does not make decisions about individuals that produce legal or similarly significant effects. It does not itself install advertising cookies on visitors' devices; any website tracking is covered by the relevant website's notices and consent arrangements. 4. Storage and disclosure We process information through our self-hosted n8n automation system and store reporting data in Airtable. Authorised staff and service providers supporting hosting, storage, maintenance and security may access information as necessary for their roles. The integration uses Meta to obtain the authorised advertising data. We do not sell information collected through this reporting app. We may disclose information where required by law or where necessary to establish, exercise or defend legal claims. 5. International processing Our service providers may process information outside Ireland or the European Economic Area, depending on the services and hosting arrangements used. [BEFORE PUBLISHING: Confirm the actual international processing arrangements for Airtable and your hosting providers. State the applicable safeguard, such as an adequacy decision or EU Standard Contractual Clauses, and how a person can obtain information or a copy of the safeguards. Do not claim a safeguard is in place until you have verified it.] 6. Retention [BEFORE PUBLISHING: Insert the retention periods you will actually apply to advertising reports and creative data, n8n execution/error logs, and backups. Include when the periods start and any justified exceptions. The supplied workflows do not automatically delete old records.] We retain access credentials only while needed for an authorised connection and revoke or remove them when that connection is discontinued. Disconnecting an account stops future collection but does not, by itself, delete information already stored. Information no longer needed for the stated purposes is deleted or anonymised, subject to applicable legal requirements. 7. Your rights and deletion requests Where we hold personal data about you, you may have rights to access it, correct it, request its erasure, restrict its use, object to processing based on legitimate interests, and receive portable data where that right applies. These rights are subject to the conditions and exceptions in applicable law. To request access or deletion, email accounts@alternativeexperiences.ie with the subject “Meta app data request”. Describe the information or account concerned so we can locate it. Do not send passwords or access tokens. We may request proportionate information to verify your identity and authority. We respond without undue delay and normally within one month. If a lawful extension is necessary, we will explain it within that period. Where we cannot comply with a request, we will explain why and the options available to you. Deletion by us does not delete information held independently by Meta. You may complain to the Irish Data Protection Commission at https://www.dataprotection.ie/ or another competent data-protection authority. 8. Changes and contact We may update this policy when the reporting tool or our data practices change. The current version and its update date will be published on this page. Privacy contact: accounts@alternativeexperiences.ie Operator: Alternative Experiences Limited