Privacy Policy

Data collected directly

We collect the following data that you provide when you register:

• Full name
• Date of birth
• National identity document
• Email address
• Phone number
• Profile photo

Identity verification data (KYC)

For identity verification processes, we may request:

• A copy of your identity document
• A selfie holding your document
• Bank account ownership details

Social media data

We collect data from linked accounts on TikTok, Instagram, YouTube, Twitch and other social platforms.

Financial data

For payment processing: bank account number, CCI (Código de Cuenta Interbancaria, the Peruvian interbank account code) and e-wallet.

Tax data

Where applicable: RUC (the Peruvian taxpayer registration number) and tax address.

Published content

We store the content you submit or publish through the Platform as part of advertising campaigns.

Technical data (collected automatically)

• IP address
• Device type
• Operating system
• Unique device identifiers
• Browser used

Usage data

• Interactions with the Platform
• Campaigns you take part in
• Activity history
• Session time

Geolocation

Approximate geolocation inferred from your IP address. We do not collect GPS data without explicit consent.

Performance metrics

Through the authorized APIs of external platforms, we obtain views, plays and engagement. These metrics are necessary to calculate rewards under the Verified CPM model.

Sensitive data

Inklop does not collect or process sensitive personal data (health, religion, sexual orientation, political affiliation, biometrics) except what is strictly essential for identity verification processes, and always with the explicit consent of the data subject.

We process your personal data for the following purposes:

• Registration and account creation: identity verification and account creation. Legal basis: performance of the contract and legal obligation.
• Operation of the Platform: campaign matching, content validation and payment processing. Legal basis: performance of the contract.
• Fraud prevention: detection of fraud and invalid traffic. Legal basis: Inklop's legitimate interest and legal obligation.
• Operational notifications: approvals, rejections and payment confirmations. Legal basis: performance of the contract.
• Commercial communications: marketing and commercial communications. Legal basis: express consent, revocable at any time.
• Legal compliance: legal, tax and regulatory obligations.
• Service improvement: analysis of aggregated, anonymous data.
• Dispute management: appeals, claims and disputes.
• Contractual records: acceptances of terms and disclaimers as contractual evidence.

Retention periods

• Active account data: for as long as your account stays active.
• Transaction and payment data: at least five years, under Peruvian tax regulations.
• KYC and fraud prevention data: at least five years from the last transaction, in line with anti money laundering regulations.
• Records of acceptance of terms: at least five years as contractual evidence.
• Usage and analytics data: up to two years, or anonymously and indefinitely.
• Data from cancelled accounts: kept in minimal form for up to ten years to handle possible claims, audits or requests from authorities.

Data deletion

Once these periods have elapsed, Inklop will securely delete or irreversibly anonymize the data in line with recognized technical standards.

Internal access

Internal access to personal data follows the principle of least privilege: only Inklop staff whose specific duties require it can access personal data, under mandatory confidentiality agreements.

Access for campaigns

When a creator joins a campaign, the advertising brand behind it accesses the profile data strictly necessary to run that campaign. Brands are contractually obliged to process this data only for the purposes of the campaign and to respect the creator's privacy.

Technology providers

Inklop uses external technology providers such as cloud hosting services, payment gateways, email marketing tools and analytics services. These providers act as data processors under contracts that impose obligations equivalent to those in this Policy.

International transfers

When data is transferred to servers or providers located outside Peru, Inklop guarantees the use of adequate protection mechanisms under Peruvian and international regulations, including standard contractual clauses.

Disclosure to authorities

Inklop will disclose personal data to the competent authorities only when required by a legitimate judicial or administrative order, after verifying the request and limiting the disclosure to what is strictly necessary.

Corporate changes

In the event of a merger, acquisition or corporate restructuring, the data will be transferred to the successor entity, with prior notice to users and keeping the same protection guarantees.

No sale policy

Inklop does not sell, rent or trade its user databases to third parties for their own purposes unrelated to the Platform.

Under Law No. 29733 and the GDPR principles adopted as a reference, you have the following rights over your personal data:

• Right of access: to know what data Inklop holds about you, for what purpose and for how long.
• Right of rectification: to request the correction of inaccurate, incomplete or outdated data.
• Right of cancellation or erasure: to request the deletion of your data when it is no longer necessary for the purpose it was collected for, or when you withdraw your consent, subject to the applicable legal exceptions.
• Right to object: to object to the processing of your data for specific purposes, especially direct marketing communications.
• Right to portability: to receive your data in a structured, commonly used and machine readable format.
• Right to restriction of processing: to request that processing be restricted while a challenge or claim is resolved.
• Right not to be subject to solely automated decisions: to request human intervention in decisions that significantly affect you and are based only on automated processes.
• Right to withdraw consent: to withdraw your consent at any time for non essential purposes, with no retroactive effect on prior processing.

How to exercise these rights

To exercise any of these rights free of charge, send a request to datospersonales@inklop.com stating:

• Full name
• A copy of your identity document
• The right you want to exercise
• Your registered email on the Platform

Inklop will respond within a maximum of ten business days, in line with Peruvian regulations.

Inklop applies technical, organizational and legal security measures in line with international standards.

Data encryption

• All data exchanged between the user and our servers travels over HTTPS/TLS with 256 bit encryption.
• Sensitive data at rest is protected with AES-256 encryption.
• Passwords are stored using irreversible hashing.

Access control

Internal access to personal data requires multi factor authentication and follows the principle of least privilege.

Monitoring and auditing

Intrusion detection systems, anomalous behavior alerts and audit logs.

Incident response

We have a documented incident response protocol that covers notifying the competent authority and the affected data subjects within the deadlines set by regulation.

Training and confidentiality

Every employee, contractor or provider with access to personal data signs a confidentiality agreement and receives data protection training.

Impact assessments

For new high risk processing operations, we run data protection impact assessments (DPIA) before rolling them out.

Limits of security

No security system is infallible. In the event of a security breach that compromises your data, Inklop will notify you without undue delay and take every corrective measure needed.

The consent you give for the processing of your data is free, specific, informed and unequivocal, given through a clear affirmative action at the time of registration.

Withdrawing consent

For non essential purposes, such as marketing communications, you can withdraw your consent at any time by sending a request to datospersonales@inklop.com or through the preference settings on the Platform.

Effects of withdrawal

Withdrawal does not affect the lawfulness of prior processing, or processing that is necessary to perform the contract.

The Inklop Platform is meant exclusively for people over 18 years of age. Inklop does not knowingly collect personal data from minors.

If we detect that a minor has registered without authorization, their account will be cancelled and their data deleted immediately.

If you are a parent or guardian and find that a minor has given data to Inklop without your consent, report it to datospersonales@inklop.com and we will handle it as a priority.

Types of cookies

• Essential cookies: needed for the Platform to work (authentication, session security). They do not require consent.
• Preference cookies: store user settings. They require consent.
• Analytics cookies: collect usage data in aggregate form to improve the Platform. They require consent.

Limitations

Inklop does not use third party cookies for those third parties' own advertising purposes.

Managing preferences

Users can manage their cookie preferences from their browser settings or from the preferences panel on the Platform.

Inklop may update this Policy at any time to reflect legal, operational or best practice changes.

For substantial changes, Inklop will notify users at least fifteen days in advance, by email to their registered address and by notice on the Platform.

If the user does not agree with the changes, they can cancel their account before the new version takes effect. Continued use of the Platform after the notice implies acceptance of the updated Policy.

Inklop is not responsible for:

• Any processing of data the user carries out outside the Platform.
• The privacy practices of external social media platforms such as TikTok, Instagram or YouTube, whose use is governed by their own policies.
• Damage arising from the user's failure to meet their security obligations, such as keeping their credentials confidential.
• The transfer of data to competent authorities acting within their legal powers.

Advertising brands that access creator data as part of a campaign are independent controllers of any processing they carry out with that data outside the Platform.

This Policy is governed by Law No. 29733, the Peruvian Personal Data Protection Law, and its Regulation (S.D. No. 003-2013-JUS).

Users who believe their rights have been infringed can file a complaint with the Directorate General for the Protection of Personal Data of Peru's Ministry of Justice and Human Rights, or take the matter to the competent courts in Lima, Peru.

• Personal data email: datospersonales@inklop.com
• General email: hola@inklop.com
• Support: soporte@inklop.com
• Phone: +51 935 203 096
• Website: www.inklop.com
• Address: 1111B S Governors Ave STE 48251, Dover, DE 19904, US