Privacy Notice

1. Purpose and scope of this notice

This privacy notice explains how we collect, use, disclose, store and protect personal data relating to users of the Application, including partner applicants, job applicants, members, subscribers and customers. It describes the types of personal data we process, why we process it, the lawful basis for that processing and the rights available to you under applicable data protection and privacy laws, including the General Data Protection Regulation where applicable.

In this notice, personal data means information relating to an identified or identifiable person. By using the Application or submitting personal data to us, you acknowledge the practices described here.

2. Personal data we collect

We may collect the following categories of personal data directly from you:

• Account registration details: information submitted when opening an account, including your name, email address, telephone number, job title, company name, year of birth, identification number, payment and billing details, and any other information required to record and process your campaigns.
• Customer and transaction details: information provided when registering or transacting with us, such as your full name, address, email address, business address, telephone number, gender, approximate age, industry, career level, estimated budget spend, details about your work, and billing and payment information.
• Other information you submit: personal data you provide when contacting us by phone, chat or email, responding to surveys, using this Application or any other application we operate, or otherwise interacting with us.

Where identity verification is required, you authorise Inmind to collect and share relevant identification information with Smile Identity Inc. so that the information can be verified against official sources, as explained in the identity verification section below.

3. Information collected automatically

Log information: when you access the Application, our servers automatically record certain information sent by your browser. This may include your IP address, which may indicate the country from which you are connecting, your browser type and settings, and the date and time of your request.

Cookies and similar tools: the Application uses cookies and related technologies to distinguish you from other users, support a better browsing experience and help us improve the Application's features and performance.

4. Identity checks and facial recognition

To help maintain a secure creator commerce platform, Inmind uses identity verification tools provided by SmileID, a third-party provider that supports digital identity verification, fraud prevention, anti-money laundering checks and know-your-customer compliance.

Verification consent and requirement

Because verification involves processing by a third party with whom you may not have a direct contract, we require your express consent. You may provide or withhold consent during the KYC process in the creator app; however, identity verification, including facial recognition processing, is mandatory for platform users.

Verification information collected

• Facial photographs.
• Full name and date of birth.
• Identification number, such as a national ID or passport number.
• Relevant revenue authority personal identification number.
• Other personal information that may be requested for identity verification from time to time.

This information is required for onboarding, identity confirmation and compliance with applicable legal and regulatory requirements. You are responsible for ensuring that the information you submit is accurate, genuine and kept up to date, and for promptly requesting correction or deletion of inaccurate information where appropriate.

Why verification data is used

Identity verification information is collected and processed for user identity verification and for compliance with legal and regulatory obligations, including anti-money laundering and identity theft prevention requirements. Verification data may also be processed where necessary to perform contractual obligations with brand companies and other Inmind partners. It will be used only for identity verification and related compliance purposes, unless we obtain your consent for a different or additional purpose.

Storage, sharing, protection and retention

SmileID stores verification data securely and applies safeguards such as encryption and access controls to protect it from unauthorised access or breaches. Inmind may access the data only where necessary to monitor processing activities, meet its data controller obligations and support compliance and security. Facial recognition and related verification data are shared with SmileID solely for identity verification, and are not disclosed to other third parties unless required by law or unless you have given express consent.

Verification data is retained only for as long as necessary for the purposes described in this notice or as required by law. Retention will generally continue while the relevant account remains active. Once an account has been deleted and all applicable retention periods have expired, Inmind will notify SmileID so that the relevant identity verification data can be permanently erased.

5. How and why we use personal data

• To acknowledge and process your account application, including placing you on a waiting list where necessary, so that we can review your application and establish the relevant link with the advertiser.
• To contact you about user, customer or member surveys and use any information you choose to provide in response, where you consented to being contacted for that purpose.
• To administer contests, promotions or similar activities and to notify you of the outcome using the email address supplied.
• To send newsletters where you have opted in. You may unsubscribe at any time using the link included at the bottom of each newsletter email.
• To allow Inmind, its affiliated businesses or selected third-party service providers to send you information about goods, services, events or promotions that may interest you, by email and only where you provided consent.
• To use your personal data for any other purpose to which you consent at the time the information is provided.
• To support legitimate business interests, including responding to inquiries or complaints, administering and improving the Application, analysing usage, personalising member communications, maintaining suppression lists, anonymising or aggregating data for research, conducting technical operations, and protecting legal rights or complying with obligations.

In this notice, legitimate interests means the interests of Inmind and its affiliated businesses in operating and managing the organisation. When relying on legitimate interests, we consider and balance the potential impact on you and your rights under data protection laws.

6. Disclosure of personal data

• Service providers: we may engage selected third parties to support our operations, including payment processors, credit reference agencies, IT suppliers and contractors, data hosting providers, delivery partners, web analytics providers, digital advertising providers, and marketing or sales software providers. These parties may access, process or store personal data only as necessary to perform the services we have instructed them to provide.
• Affiliated businesses: as we operate across different locations, our affiliated businesses may access and process the information we collect from you to provide requested services. They may only use your information for the purposes for which it was originally collected.
• Business transfers: if our business is sold or our company assets are acquired by a third party, personal data relating to applicants, members or customers may form part of the transferred assets.
• Administrative, legal and protective reasons: we may disclose personal data where necessary to comply with legal obligations, judicial or regulatory proceedings, court orders or other legal processes, to enforce our terms, or to protect Inmind, our members, applicants, customers or contractors from loss or harm.

7. Payment information

Card and other payments made through the Application are processed by third-party payment providers. Payment information you submit is securely stored and encrypted by those providers using current industry standards. We do not directly process or store your debit or credit card information.

We may arrange for card or payment details submitted for member or customer transaction fees to be stored so that those fees can be processed. You may opt out of having third-party payment providers retain your card or payment details, in which case you may need to provide payment details again for future subscription fees or purchases.

8. Cross-border transfers of personal data

Your personal data may be transferred to and stored in countries other than the country where it was first collected, including outside the Republic of Kenya, where this is necessary for service providers or affiliated businesses to carry out the purposes described in this notice. Where personal data is transferred outside the Republic of Kenya, we will take appropriate steps to ensure that it remains protected and will apply suitable safeguards in line with applicable law.

9. Security and confidentiality

Where we provide you with, or you choose, a password or login details for restricted areas of the Application, you are responsible for keeping those details confidential and must not share them with anyone else.

Transmission of information over the internet or public communication networks cannot be guaranteed to be completely secure. We use appropriate technical and organisational measures to protect personal data submitted to us against unauthorised or unlawful access, loss, destruction or damage, but we cannot guarantee absolute security for information submitted online.

10. Retention of personal data

We retain personal data only for as long as reasonably necessary for the purposes described in this notice or for any longer period required by legal, regulatory, accounting or reporting obligations. Membership records are retained for six years after expiry or termination of membership. Information submitted through the Application is retained for two years after account closure or after our last contact with you. Where you consent to marketing communications, we retain the relevant data until you unsubscribe.

At the end of the applicable retention period, we will securely destroy personal data in accordance with applicable laws and regulations. In some cases, we may anonymise personal data so that it can no longer be linked to you, in which case it will no longer be personal data.

11. Your rights and requests

Applicable data protection laws may give you rights in relation to your personal data, including verification and facial recognition data. Where available, these rights may include access, rectification, erasure, restriction of processing, data portability, objection to processing and withdrawal of consent. If you wish to exercise any of these rights, please contact us using the details in the contact and support section. We may request additional information to verify your identity before responding.

12. Account closure and profile removal

If you wish to delete your account or profile, please email support@inmind.media from the address associated with your account and include your username so that we can process the request accurately.

It may not be technically possible to remove every record of information you have provided from our servers. Because we maintain backups to protect against accidental data loss, a copy of your profile may remain in a form that is difficult or impossible for us to locate or erase immediately. We may also delete an account at any time where required by legal process, where necessary to investigate fraud or a breach of our terms, or where needed in connection with harm caused to a third party or their rights.

13. Contact and support

Questions, comments, privacy requests or concerns about verification data may be sent to support@inmind.media.

14. Changes to this notice

We may update this privacy notice from time to time, and any changes will be posted on this page. Please review it regularly for updates. Where required by applicable law, we will notify you of material or substantive changes.