Privacy Policy
Effective Date: 21 April 2026
Last Updated: 21 April 2026
Controller: Kulimina Digital
Contact: info@kulimina.com
Address: London, United Kingdom
1. Who We Are
Kulimina Digital ('Kulimina', 'we', 'us', 'our') is a boutique digital marketing consultancy based in London, UK, serving the music, entertainment, and venture-backed startup industries. We also operate Kulimina Insights (insights.kulimina.com), a multi-client social media analytics dashboard platform.
This Privacy Policy explains how we collect, use, share, and protect personal data when you:
– engage us as a client for consultancy services;
– access or use the Kulimina Insights platform; or
– visit our website at kulimina.com.
We are committed to complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the EU GDPR (where applicable), and other applicable data protection laws globally, including the California Consumer Privacy Act (CCPA) where relevant.
2. Data We Collect
2.1 Consultancy Clients
When you engage Kulimina Digital for consultancy services, we may collect:
– Contact and identity information: name, email address, telephone number, job title, and company name.
– Social media account data: access credentials (via authorised platform tokens), page/profile analytics, audience demographics, engagement metrics, and content performance data.
– Advertising account data: campaign performance data, ad spend, targeting parameters, and audience data accessed via Meta Ads Manager and related platforms.
– End-consumer data: where you appoint us as a data processor to manage email lists, CRM records, or audience data on your behalf. In these cases, you remain the data controller.
– Communication data: emails, meeting notes, and other records of our correspondence.
2.2 Kulimina Insights Platform
When you access or use the Kulimina Insights platform, we may collect:
– Account information: name, email address, and authentication credentials (where account login is used).
– Social media analytics data: aggregated metrics including impressions, reach, engagement, follower growth, video views, and similar performance statistics sourced from Instagram, Facebook, YouTube, TikTok, and X (formerly Twitter).
– Raw social media content: post text, images, video thumbnails, and comment data where necessary to provide the service.
– Access log data: tokenised access records, IP addresses, browser type, and session information for security and audit purposes.
2.3 Website Visitors
When you visit kulimina.com, we may collect standard server log data including IP address, browser type, pages visited, and referring URLs, used for security and performance monitoring only.
3. How We Use Your Data
We process personal data only for lawful purposes. Our legal bases and corresponding uses are:
– Contract performance: to deliver agreed consultancy services, generate reports, manage campaigns, and fulfil platform access for Kulimina Insights subscribers.
– Legitimate interests: to maintain client relationships, improve our services, ensure platform security, conduct business analytics, and communicate relevant updates — where these interests are not overridden by your rights.
– Legal obligation: to comply with applicable laws, including tax, accounting, and regulatory requirements.
– Consent: for any marketing communications we send, where required by applicable law.
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
4. Third-Party Tools and Sub-Processors
In delivering our services, we use the following third-party tools which may process personal data on our behalf. We have reviewed these against UK GDPR and maintain appropriate data processing agreements where required:
– Meta Ads Manager — advertising campaign management (Meta Platforms, Inc., USA)
– Google Analytics / GA4 — website and platform analytics (Google LLC, USA)
– Mailchimp — email marketing platform (Intuit Inc., USA)
– HubSpot — CRM and client relationship management (HubSpot, Inc., USA)
– Stripe — payment processing for platform subscriptions (Stripe, Inc., USA)
Where data is transferred outside the UK or EU to countries without an adequacy decision (including the United States), we rely on Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms as required by UK GDPR and EU GDPR. A full list of sub-processors is available on request.
5. Social Media Platform Data
Kulimina Insights connects to social media platforms (Instagram, Facebook, YouTube, TikTok, and X) via their official APIs. Data ingested from these platforms is governed by both this Privacy Policy and the respective platform's own terms of service and privacy policy. We access only the data permissions necessary to provide the analytics service, and we do not share platform data with third parties except as set out in this policy.
6. Data Retention
We retain personal data only for as long as necessary for the purposes set out in this policy, or as required by law:
– Client contact and project data: 7 years from the end of the client engagement, to meet statutory accounting and tax obligations.
– Kulimina Insights platform data: for the duration of your active subscription, plus 90 days following termination, unless you request earlier deletion.
– Social media analytics data: rolling 24-month retention within the Insights platform by default; clients may request extended or reduced retention periods.
– Website log data: 90 days.
7. Your Rights
Depending on your location, you may have the following rights regarding your personal data:
– Right of access: to receive a copy of the personal data we hold about you.
– Right to rectification: to have inaccurate data corrected.
– Right to erasure: to request deletion of your data in certain circumstances.
– Right to restriction: to limit how we process your data in certain circumstances.
– Right to data portability: to receive your data in a structured, machine-readable format.
– Right to object: to processing based on legitimate interests.
– Rights related to automated decision-making: we do not carry out solely automated decisions that produce significant effects.
– Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
California residents have additional rights under the CCPA, including the right to know about personal information collected, the right to delete, the right to opt-out of sale, and the right to non-discrimination. Kulimina Digital does not sell personal information.
To exercise any of these rights, please contact us at info@kulimina.com. We will respond within 30 days (or within the timeframe required by applicable law). You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or your local supervisory authority.
8. Data Security
We implement appropriate technical and organisational security measures to protect personal data against unauthorised access, loss, or disclosure. These include:
– Tokenised, access-controlled links for Kulimina Insights dashboard delivery.
– Encrypted data transmission (TLS/HTTPS) across all platform endpoints.
– Role-based access controls for internal team members.
– Regular review of third-party sub-processor security standards.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay, as required by UK GDPR.
9. Cookies
Our website and platform may use essential cookies required for security and session management. We do not currently use third-party advertising cookies. Any non-essential cookies will be subject to your prior consent via a cookie consent mechanism. For full details, please see our Cookie Policy (where published separately on kulimina.com).
10. Children's Privacy
Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us immediately at privacy@kulimina.com.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or services. We will publish the updated policy at kulimina.com with a revised effective date. For material changes, we will notify clients and platform users directly where required.
12. Contact Us
For any questions, concerns, or requests relating to this Privacy Policy or your personal data, please contact:
– Email: info@kulimina.com
– Address: Kulimina Digital, London, United Kingdom