Privacy Policy
Effective date: 22 July 2026 · Last updated: 22 July 2026
This policy explains how Black Bird Marketing SH.P.K. ("Blackbird", "we", "us") collects, uses, and protects personal data — through our website, in the course of providing digital marketing services to our clients, and through the applications and integrations we operate on third-party advertising and marketing platforms.
Who We Are
Black Bird Marketing SH.P.K. is a digital marketing agency registered in the Republic of Kosovo (business registration no. 810042010), with its registered address at Bajram Kelmendi Nr. 35, Lok. 27, Prishtinë, Republic of Kosovo. We trade as "Blackbird" and "Blackbird Marketing" and operate the website blackbird.marketing.
We provide paid advertising, SEO, web design and CRO, content, analytics, and related growth services to a select group of clients. For questions about this policy or our data practices, contact hello@blackbird.marketing.
Scope: The Two Capacities We Act In
We handle personal data in two distinct capacities:
- As a controller — for data we collect directly through our own website, contact forms, analytics, and business development (e.g. when you enquire about working with us).
- As a processor / service provider — for data we access on behalf of our clients when they authorize us to manage their advertising accounts, analytics properties, CRM systems, and marketing platforms. In this capacity we act only on our clients' documented instructions, and the client remains the controller of that data.
Most data accessed through the platform integrations described in Section 4 falls into the second category: it belongs to our clients and their customers, and we process it solely to deliver the services those clients have engaged us for.
Information We Collect
Directly from you (as controller):
- Contact details you submit through our forms — name, email address, company, phone number, and the content of your message.
- Website usage data — pages visited, referral source, device and browser information, approximate location, collected via cookies and analytics tools (see Section 12).
- Business correspondence — emails, proposals, and records of our communications with you.
On behalf of our clients (as processor):
- Advertising account data — campaign structures, budgets, bids, creatives, and performance metrics from platforms such as Meta, TikTok, Google, LinkedIn, and Microsoft.
- Audience and insights data — aggregated audience characteristics, custom audience definitions, and conversion events configured within client accounts.
- Analytics and CRM data — website analytics, lead records, and customer lifecycle data held in systems the client authorizes us to access (e.g. Google Analytics, HubSpot).
Platform Integrations & Developer Applications
To deliver our services efficiently, Blackbird operates developer applications and API integrations that connect third-party marketing platforms to our secure, internal cloud tooling. These platforms include, among others:
- Meta Platforms (Facebook & Instagram — Marketing API, Graph API)
- TikTok (TikTok for Business — Marketing API)
- Google (Google Ads API, Google Analytics APIs)
- LinkedIn (Marketing APIs)
- Microsoft Advertising (Bing Ads API)
These integrations operate under the following principles:
- Authorized access only. We connect to an account only after the account owner (our client) explicitly grants access through the platform's own authorization flow (e.g. OAuth, Business Manager partner access). Access is scoped to the permissions the platform and the client grant.
- Purpose limitation. Data obtained through platform APIs ("Platform Data") is used exclusively to provide services to the client whose account it relates to — campaign management, reporting, optimization, and analysis. We do not use one client's Platform Data for the benefit of another client, for our own marketing, or for building independent data products.
- No sale of data. We never sell, license, or rent Platform Data to any third party.
- Secure internal tooling. Platform Data is processed within access-controlled cloud infrastructure operated by or for Blackbird, including automation and AI-assisted tooling that our team uses to manage campaigns and produce reporting. This tooling operates under our instructions and safeguards; Platform Data is not used to train third-party AI models.
- Revocable at any time. Clients can revoke our access at any time through the relevant platform's settings (see Section 9), and we remove access promptly at the end of an engagement.
Platform-specific commitments
Meta. Our use of Platform Data received from Meta complies with the Meta Platform Terms and Developer Policies. We process Meta Platform Data only as a service provider to the businesses that authorize our application, and we delete it as described in Section 9.
TikTok. Our use of data received through TikTok for Business APIs complies with the TikTok Business Products (Data) Terms and applicable TikTok developer terms, and is limited to managing and reporting on the advertiser accounts that authorize our application.
Google. Blackbird's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How We Use Information
- To respond to enquiries and manage our relationship with prospective and existing clients.
- To plan, execute, measure, and optimize advertising and marketing campaigns on behalf of clients.
- To produce reporting, dashboards, and analysis for the client the data belongs to.
- To operate, secure, and improve our website and internal tooling.
- To comply with legal obligations, enforce agreements, and protect our rights.
Legal Bases
Where we act as controller, we rely on: your consent (e.g. non-essential cookies, marketing communications); performance of a contract or pre-contractual steps (e.g. responding to your enquiry); and our legitimate interests in operating and promoting our business, balanced against your rights.
Where we act as processor, the client — as controller — is responsible for the legal basis, and we process data under a data processing agreement in line with the GDPR and Kosovo's Law No. 06/L-082 on Protection of Personal Data, which mirrors the GDPR.
Sharing & Subprocessors
We do not sell personal data. We share it only with:
- The client it belongs to — reporting and campaign data is shared with the client whose account it relates to.
- Service providers — hosting, cloud infrastructure, analytics, productivity, and AI tooling providers that support our operations, bound by confidentiality and data processing terms.
- Advertising platforms — when executing campaigns, data flows to the relevant platform under the client's own agreements with that platform.
- Authorities — where required by applicable law or valid legal process.
A current list of subprocessors relevant to a client engagement is available on request.
International Transfers, Security & Retention
Transfers. We are based in the Republic of Kosovo and serve clients in the EU, UK, and elsewhere. Where we process personal data on behalf of EU/EEA clients, transfers are governed by EU Standard Contractual Clauses (Implementing Decision (EU) 2021/914) together with supplementary technical and organizational measures.
Security. We apply access controls, least-privilege account management, multi-factor authentication, encrypted transmission, and audit logging across our systems. Access to client accounts and Platform Data is limited to authorized team members who need it to deliver the engagement.
Retention. We retain controller data only as long as needed for the purposes above (enquiries are typically retained for up to 24 months after last contact). Platform Data is retained only for the duration of the relevant client engagement and active task completion; working copies are deleted when no longer needed and, at the latest, upon termination of the engagement, unless a longer period is required by law.
Data Deletion Instructions
You can request deletion of data held by Blackbird at any time. This section also serves as the data deletion instructions for our developer applications on Meta, TikTok, and other platforms.
- Clients (account owners): revoke our application's access at any time from the platform's own settings — e.g. Meta Business Manager (Settings → Partners / Business Integrations), TikTok Ads Manager (Assets → Partners), or your Google account's third-party access settings. Then email hello@blackbird.marketing with the subject line "Data Deletion Request" and we will delete Platform Data and working copies relating to your accounts within 30 days, and confirm once complete.
- Individuals: if you believe Blackbird holds personal data about you, email hello@blackbird.marketing with the subject line "Data Deletion Request". If the data is held on behalf of a client, we will forward your request to that client (the controller) and support them in fulfilling it.
Deletion requests are actioned within 30 days unless a legal obligation requires longer retention, in which case we will tell you.
Your Rights
Subject to applicable law (including the GDPR and Kosovo's Law No. 06/L-082), you have the right to access, rectify, erase, restrict, and object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time where processing is based on consent.
To exercise any of these rights, contact hello@blackbird.marketing. You also have the right to lodge a complaint with your local supervisory authority — in Kosovo, the Information and Privacy Agency (AIP); in the EU, your national data protection authority.
Cookies & Analytics
Our website uses essential cookies required for it to function, and — with your consent where required — analytics cookies that help us understand how the site is used. You can control cookies through your browser settings and, where shown, our consent banner. Analytics data is used in aggregate and is not used to identify individual visitors.
Children & Changes to This Policy
Our website and services are directed at businesses and are not intended for children under 16. We do not knowingly collect personal data from children.
We may update this policy from time to time. The "Last updated" date at the top reflects the most recent version, and material changes will be highlighted on this page. Continued use of our website or services after changes take effect constitutes acceptance of the updated policy.
Contact
Black Bird Marketing SH.P.K. (trading as Blackbird)
Bajram Kelmendi Nr. 35, Lok. 27
Prishtinë, Republic of Kosovo
Business registration no. 810042010
Email: hello@blackbird.marketing
Privacy contact: Art Raifi, Director — art@blackbird.marketing