When we run your Chinese platform accounts, we handle some personal data about your audience on your behalf: usernames, comments, messages and engagement statistics. Under the GDPR you are the controller of that data and we are your processor. This page explains in plain words how that works. It is a summary, not a contract.
The data processing terms are part of the Service Agreement you sign with us. Exhibit B is the Data Processing Addendum under Article 28 GDPR, including the security measures and the register of subprocessors. Exhibit C covers international transfers. These signed exhibits apply, not this page, and this page cannot change them.
Personal data of your audience that passes through the accounts we run for you, for example public handles, profile information, comments, messages and engagement figures, plus contact details of brand representatives where we handle deals for you. We do not ask for sensitive data.
We use it only to provide the service: publishing your content, running and moderating the accounts, reporting, and handling brand deals you approve. We follow your instructions and do not use your audience data for our own purposes.
Everyone who works on your accounts is bound by confidentiality and only gets the access they need. We use individual access accounts, two-factor authentication where available, a secure credential manager and encrypted connections, and we remove access promptly when it is no longer needed.
You authorise us to use subprocessors for the agreed services. They are listed in the register that forms part of your agreement, and we tell you at least 14 days before a material new one starts. You can object on reasonable data protection grounds within that period.
No personal data is made accessible in China or in another country without an EU adequacy decision until the steps in Exhibit C are complete: the EU Standard Contractual Clauses (normally Module Three) with completed annexes, and a documented transfer impact assessment with any measures it requires. If a transfer cannot happen lawfully, the processing does not take place. Chinese platforms act as independent controllers under their own terms and Chinese law.
If someone in your audience makes a data protection request that reaches us, we forward it to you and help you respond. If a data breach affects your data, we tell you without undue delay. On request we give you the information you need to check that we comply.
When the agreement ends, we return or delete the audience data we hold for you, as you choose and as the platforms allow, unless the law requires us to keep it. The handover of your accounts is covered by the exit package in the Service Agreement.
Questions about data protection at Kaimen: [email protected]