When we run your Chinese platform accounts, we sometimes handle personal data about your audience on your behalf — usernames, comments, messages and engagement statistics. Under EU data protection law (GDPR), you are the controller of that data and we are your processor. These terms set out how we handle it. “We”/“us” means Kaimen, “you” means the client named in the Key Terms of the Service Agreement.
Personal data of your audience that passes through the accounts we run for you: platform usernames and handles, profile information visible to us, comments and direct messages, and engagement and analytics data provided by the platforms. It does not cover data you are separately responsible for inside your own content (people appearing in your videos are covered by your warranties in clause 3 of the Service Agreement).
We process this data only to provide the services in the Service Agreement: publishing and scheduling content, community management where agreed, performance reporting, and handling brand deals. We follow your documented instructions and won't use audience data for our own purposes. If we believe an instruction breaks data protection law, we'll tell you before acting on it.
Everyone we allow to access this data — employees, translators, editors, local partners — is bound by confidentiality obligations.
We use technical and organisational measures appropriate to the risk: access to accounts and data limited to people who need it, credentials stored in access-controlled tools, encrypted connections, and prompt revocation of access when someone leaves a project.
You give us general authorisation to use sub-processors. Today these categories are: hosting and productivity providers, AI transcription and translation providers, and our local operating partners in China. We'll post changes to this page before a new sub-processor handles your audience data; if you have a reasonable objection, tell us within 14 days and we'll discuss alternatives. We remain responsible for our sub-processors' work.
Providing this service means personal data is transferred to and processed in the People's Republic of China, which the EU has not found to offer an adequate level of data protection. These transfers take place under the European Commission's Standard Contractual Clauses, which we put in place with the receiving partner, together with measures appropriate to the local legal environment. By using the service you acknowledge that Chinese platforms themselves act as independent controllers under their own terms and Chinese law — what happens inside Douyin, Bilibili, Xiaohongshu or Weibo is outside our control.
If someone in your audience exercises a GDPR right — access, deletion, objection — and the request reaches us, we'll forward it to you promptly and give you reasonable help responding, taking into account what the platforms technically allow.
If we become aware of a personal data breach affecting data we process for you, we'll notify you without undue delay with what we know: what happened, what data is affected, and what we're doing about it.
On request, we'll give you the information reasonably needed to show we comply with these terms. You can audit us once per year on reasonable notice, at your cost, in a way that doesn't disrupt our work or expose other clients' data.
When the Service Agreement ends, we'll delete or return the audience data we hold for you within 30 days, unless the law requires us to keep it. Data held by the platforms themselves, and published content, are governed by clause 4 and clause 11 of the Service Agreement and the platforms' own terms.
These terms form part of the Service Agreement. On personal data, these terms prevail over the rest of the agreement. We may update this page from time to time; the version and date at the top tell you what applies. Material changes will be notified to active clients by email.
Questions about data protection at Kaimen: [email protected]