Privacy Policy

Effective Date: December 7, 2025

This Privacy Policy describes how Ki Marketing, a UGC marketing agency (referred to as "Ki Marketing," "we," "us," or "our"), collects, uses, shares, and protects personal information in connection with our services, website, and communications. We are committed to processing your data transparently and in compliance with global data protection standards, including but not limited to the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), as amended by the CPRA.

1. Scope and Applicability

This policy applies to:

• Clients and prospective clients using our agency services.
• UGC Creators and influencers engaged or considered for campaigns.
• Website Visitors and individuals who contact us.

We are generally the Data Controller (GDPR) or the Business (CCPA/CPRA) for the information we collect directly from you.

2. Information We Collect and Legal Basis

We collect information based on your relationship with us. The legal basis for processing is critical for compliance and is noted below (GDPR standards).

A. UGC Creators

Types of Personal Information Collected:

• Identity/Contact: Name, email, phone, Discord/Social handles
• Financial/Tax: Payment details, tax ID (W-9, W-8BEN), rate card, bank details
• Performance/Metrics: Social media analytics, portfolio content, reach, engagement, usage rights granted

Purpose of Processing:

• Contractual necessity to select, engage, and manage creator relationships
• Contractual necessity to process payments and adhere to tax law
• Legitimate Interest in evaluating content and suitability for campaigns

Legal Basis (GDPR): Contract; Legal Obligation; Legitimate Interest.

B. Clients/Prospects

Types of Personal Information Collected:

• Business Contact: Name, job title, company name, address, email, phone
• Campaign Data: Budget, campaign goals, target audience demographics, proprietary brand information

Purpose of Processing:

• Contractual necessity to establish and maintain the business relationship
• Contractual necessity to execute the contracted marketing service

Legal Basis (GDPR): Contract.

C. Website Visitors

Types of Personal Information Collected:

• Technical Data: IP address, browser type, OS, device ID, cookies, referral source
• Communication Data: Information submitted via contact forms or direct email

Purpose of Processing:

• Legitimate Interest in securing our services and analyzing usage to improve the website
• Legitimate Interest to respond to inquiries; Consent if for marketing subscription

Legal Basis (GDPR): Legitimate Interest or Consent.

3. How We Use Your Information

We use the collected information for the following specific and legitimate business purposes:

• Service Provision: To execute and manage UGC campaigns, match creators to clients, and facilitate content creation and delivery (Legal Basis: Contract).
• Payment & Finance: To process invoices, pay creators, manage agency finances, and meet tax requirements (Legal Basis: Contract and Legal Obligation).
• Security & Maintenance: To maintain the security of our systems, prevent fraud, and debug technical issues (Legal Basis: Legitimate Interest).
• Business Improvement: To analyze campaign performance, understand market trends, and refine our service offerings (Legal Basis: Legitimate Interest).
• Marketing: To send promotional communications about our services, where you have provided Consent or where permitted by Legitimate Interest (e.g., existing clients).

4. Disclosure and Sharing of Personal Information

We do not sell your personal information. We only share data with third parties necessary to operate our business or as required by law.

5. International Data Transfers

As an agency operating in the U.S. (headquartered in Maryland) but serving a potentially global client and creator base, data may be transferred to, stored, and processed in jurisdictions outside your country of residence, including the United States.

For transfers of data originating from the European Economic Area (EEA), we ensure appropriate safeguards are in place, typically relying on Standard Contractual Clauses (SCCs) adopted by the European Commission, or other legally recognized transfer mechanisms.

6. Your Data Protection Rights (GDPR & CCPA/CPRA)

Depending on your jurisdiction, you have robust rights regarding your personal information. We are committed to honoring these rights globally where feasible.

You have the right to submit a verifiable request concerning your personal information, including:

• Right to Know (Access): The right to obtain confirmation about whether we process your data and to receive a copy of that data. (CCPA/CPRA: The right to request the categories and specific pieces of personal information we have collected about you).
• Right to Rectification: The right to have inaccurate or incomplete personal information corrected. (CCPA/CPRA: The right to correct inaccurate personal information).
• Right to Erasure (Deletion): The right to request the deletion of your personal information under certain circumstances (e.g., data is no longer necessary). (CCPA/CPRA: The right to request the deletion of your personal information, with exceptions).
• Right to Restrict Processing (GDPR): The right to limit the way we use your data (e.g., while a rectification request is being handled).
• Right to Object (GDPR): The right to object to processing based on Legitimate Interest, especially for direct marketing. (CCPA/CPRA: The right to opt-out of the Sale or Sharing of personal information—Ki Marketing does not sell data).
• Right to Data Portability (GDPR): The right to receive your personal data in a structured, commonly used, and machine-readable format.

Exercising Your Rights: To exercise any of these rights, please contact us using the details provided in Section 9. We will respond to all requests within 30 days (GDPR) or 45 days (CCPA/CPRA), which may be extended under specific circumstances.

7. Data Security and Retention

Security

We implement technical and organizational security measures designed to protect your personal information from unauthorized access, disclosure, alteration, and destruction. These measures include:

• Encryption (at rest and in transit via SSL/TLS).
• Access Controls and need-to-know restrictions for internal personnel.
• Regular Security Audits and monitoring of our infrastructure.

Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements.

• Client/Creator Contract Data: Retained for the duration of the contractual relationship plus 7 years to meet financial and tax obligations.
• Usage Data/Analytics: Retained for a maximum of 24 months after collection.

8. Children's Privacy

Our services are directed to adults operating businesses or acting as professional creators. We do not knowingly collect personal information from individuals under the age of 16. If we become aware that we have collected personal information from a child without parental consent, we will take immediate steps to delete the information.

9. Contact Us

If you have any questions, concerns, or wish to exercise your data protection rights, please contact our Data Protection Contact:

Ki Marketing
Attention: Data Protection Contact
Email: contact@kimarketing.xyz
Mailing Address: 22509 Castle Oak Road, Clarksburg MD, 20871