Privacy Policy

[Registered legal entity name] (“Kollabmint”, “we”, “us” or “our”) operates an online marketplace that enables content creators (“Creators”) and brand organisations and their authorised representatives (“Brands”) to discover one another, negotiate terms and execute collaboration engagements through our website and mobile application (collectively, the “Services”).

This Privacy Policy (the “Policy”) describes the categories of personal data we collect, the purposes for which we process it, the parties with whom we share it, the periods for which we retain it, and the rights available to you in respect of it. “Personal Data” means any data about an individual who is identifiable by or in relation to such data.

For the purposes of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules made thereunder, [Registered legal entity name] is the Data Fiduciary in respect of the Personal Data processed through the Services. Our registered office is situated at [Registered office address].

This Policy forms an integral part of our Terms of Service. By accessing or using the Services, you acknowledge that you have read and understood this Policy. Where the Services are made available to you in a capacity governed by a separate agreement, that agreement shall prevail to the extent of any inconsistency.

This Policy applies to both categories of users. Where a provision applies only to Creators or only to Brands, it is expressly stated to do so.

We collect Personal Data in three ways: information you provide to us directly, information generated in the course of your use of the Services, and information submitted by other users in connection with an engagement to which you are a party. We limit collection to data that is necessary for the purposes described under Purposes of Processing below.

Information you provide to us

• Account information. Your name, email address, password and the account type under which you register. Passwords are stored exclusively in hashed form using the bcrypt algorithm and are not retained in plain text or in any recoverable format.
• Contact information. Your telephone number and country code, together with your election as to whether that number may be contacted via WhatsApp. You determine whether your telephone number is designated public or private.
• Creator profile information. Your username, tagline, biography, profile image location, website address, city, state and country, languages, niches, creator category, audience category, collaboration availability and preferred payment timeline. You may, at your discretion, additionally provide your gender and date of birth.
• Social platform information. The handles, profile addresses, follower counts and monthly view figures you submit in respect of each connected platform, together with the rates you publish for each content type and the applicable currency.
• Representative information. Where you elect to list a manager, talent agency or assistant, the name, role, email address and telephone number of that person. You warrant that you have obtained the consent of any individual whose details you submit.
• Brand and organisational information. The brand name, username, contact email address, verified email domain, year of incorporation, organisation size, website address, and the role held by each authorised representative within the brand account.
• Support and correspondence information. The name, email address, subject category and message content you submit through our contact form, together with the Internet Protocol address from which the submission originates.

Information generated through your use of the Services

• Communications. The content, timestamps and read status of messages exchanged between Creators and Brands through the Services.
• Engagement records. Offers, contracts and associated particulars, including deliverables, compensation terms, agreed dates, revision requests, submitted content addresses and captions, published post addresses, and performance metrics recorded against a deliverable, comprising views, likes, comments, shares and saves.
• Application and campaign records. The collaboration opportunities you apply to or publish, the stage attained by each application, and the Creators a Brand has saved to a campaign.
• Notification records. The notifications generated for your account and their read status.
• Device information. Where you use our mobile application and enable push notifications, the push notification token issued to your device and the operating system of that device.
• Technical and log information. Server logs, including Internet Protocol addresses and request metadata, generated for the purposes of security monitoring and fault diagnosis.

Data we do not collect

We do not deploy advertising or web analytics tracking technologies on the Services. We do not collect or store payment card particulars or bank account details; consideration payable under a collaboration is settled directly between the contracting parties outside the Services. We do not acquire Personal Data concerning you from data brokers or other commercial third-party sources.

We process Personal Data solely for the purposes set out below, and not for any purpose incompatible with them.

• Provision of the Services. To create and administer your account, display your profile, enable Brands to search and filter Creators, transmit communications, and record offers and contracts.
• Facilitation of engagements. To determine the search results and filters in which your profile appears, by reference to your niches, location, audience category, follower counts and published rates.
• Verification and platform integrity. To verify email addresses, telephone numbers, work email addresses and brand domains, and to assess verification requests and user reports.
• Communications and notifications. To notify you of messages, offers, contract activity, applications, and material changes to your account or to the Services.
• User support. To respond to and administer enquiries and complaints submitted to us.
• Security and prevention of misuse. To detect and prevent abuse, apply rate limiting, investigate fraudulent activity and enforce our Terms of Service.
• Legal and regulatory compliance. To maintain records we are required by law to retain and to respond to lawful requests from competent authorities.

Where processing is undertaken on the basis of your consent, you may withdraw that consent at any time in the manner described under Your Rights below. Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal. Where processing is necessary for the performance of the Services you have requested, or for a legitimate use permitted under the DPDP Act, we rely on that basis.

Certain elements of the Services are public by design, as visibility to prospective Brands is fundamental to the purpose of the Platform. You are advised to review this Section before completing your profile.

• Your public profile page is accessible to any person in possession of its address, whether or not that person holds an account, and may be indexed by search engines. It displays your username, name, profile image, tagline, biography, location, niches, languages, availability, website address and connected social handles.
• Your telephone number is private by default and is displayed on your public profile only where you have designated its visibility as public.
• Your representative contact details are public by default. You may designate them private at any time.
• Your published rates are displayed in accordance with the visibility setting you select for each platform, being either publicly visible or visible only to authenticated Brand accounts.
• Your date of birth, gender and email address are not displayed on your public profile in any circumstance.
• Messages, offers and contracts are accessible only to the parties to the relevant engagement and to authorised personnel acting in accordance with Disclosure of Personal Data below.

Search engine operators maintain independent copies of pages they have indexed. Where you make a public profile private or delete your account, a cached copy may persist in third-party search results for a period after the data has been removed from our systems. We do not control, and are not responsible for, the retention practices of such operators.

We do not sell Personal Data, and we do not disclose Personal Data for advertising or marketing purposes. We disclose Personal Data only in the circumstances set out below.

• To other users. Where you initiate or receive a communication, submit an application, extend or receive an offer, or enter into a contract, the counterparty is provided access to the particulars of that interaction and to your profile.
• Within a Brand account.Authorised representatives of the same Brand account are provided access to that account's campaigns, saved Creators, applications, offers and contracts.
• To processors acting on our behalf. To vendors providing database hosting, server infrastructure and, in the case of the mobile application, push notification delivery through the Expo service. Such processors act solely on our documented instructions and are contractually restricted from using Personal Data for their own purposes.
• For legal and regulatory purposes. Where disclosure is required by applicable law, court order or direction of a competent authority, or where we determine in good faith that disclosure is necessary to investigate suspected fraud or to protect the rights, property or safety of our users or of the public.
• In connection with a corporate transaction. In the event of a merger, acquisition, restructuring or sale of assets, Personal Data may be transferred to the successor entity, subject to the successor being bound by terms no less protective than this Policy. We will provide notice before any such transfer takes effect.

The Services set a single cookie, designated “token”. It stores your authenticated session identifier, is configured as HTTP-only such that it cannot be accessed by client-side scripts, and expires seven days after it is set.

This cookie is strictly necessary for the operation of the Services, as authenticated access cannot be maintained without it. Consent is accordingly not sought for its use. We do not employ analytics, advertising, profiling or third-party tracking cookies, nor any comparable technology. Should this position change, we will amend this Policy and, where required, obtain your consent prior to any such deployment.

You may delete this cookie at any time through your browser settings or by terminating your session. Doing so will require you to authenticate again in order to access the Services.

The Services contain links to third-party websites and social media platforms, including profile addresses and published content addresses submitted by users. Such websites and platforms are operated independently of us and are governed by their own privacy policies. We do not control and accept no responsibility for the content, security or data practices of any third-party property. We encourage you to review the applicable privacy policy before providing Personal Data to any such third party.

We retain Personal Data for the duration of your account and for such further period as is necessary for the purposes described in this Policy or as required by applicable law. Upon deletion of your account, your profile is removed and ceases to be displayed to other users.

• Communications, offers and contracts are retained for so long as any party requires them as a record of the terms agreed, and for such period as is necessary for taxation, accounting, audit or dispute resolution purposes.
• Support correspondence is retained for a period not exceeding twenty-four months from the date of resolution.
• Push notification tokens are deleted upon a device ceasing to respond or upon your logging out of the mobile application.
• Security and server logs are retained for a limited period proportionate to the security purposes for which they are generated, and are thereafter deleted.

Personal Data that is no longer required for any purpose set out in this Policy is deleted or irreversibly anonymised.

We implement reasonable security safeguards designed to protect Personal Data against unauthorised access, disclosure, alteration and loss. These measures include the storage of passwords in hashed form using the bcrypt algorithm, session management by means of signed, HTTP-only cookies, encryption of data in transit, the application of standard HTTP security headers, server-side validation of all submitted input, rate limiting of sensitive endpoints, and the restriction of access to production data to personnel requiring such access in the discharge of their duties.

Notwithstanding the foregoing, no method of transmission or storage is entirely secure, and we are unable to guarantee absolute security. In the event of a personal data breach affecting your Personal Data, we will notify you and the Data Protection Board of India in the manner and within the period prescribed under the DPDP Act.

Subject to the provisions of the DPDP Act, you are entitled to exercise the following rights in respect of your Personal Data.

• Right to access information. To obtain a summary of the Personal Data we process concerning you, the processing activities undertaken, and the identities of other Data Fiduciaries and processors with whom such data has been shared.
• Right to correction and erasure. To require the correction of inaccurate or misleading Personal Data, the completion of incomplete Personal Data, the updating of Personal Data, and the erasure of Personal Data no longer necessary for the purpose for which it was processed. The majority of such data may be amended directly through your profile settings.
• Right to withdraw consent. To withdraw, at any time, consent previously given, with effect from the date of withdrawal.
• Right to nominate. To nominate another individual to exercise these rights on your behalf in the event of your death or incapacity.
• Right of grievance redressal. To have any grievance concerning our processing of your Personal Data addressed in accordance with Grievance Redressal and Contact below, and to escalate the matter to the Data Protection Board of India where you remain dissatisfied with our response.

Requests may be submitted to privacy@kollabmint.com. We will respond within thirty days of receipt. We may require you to verify your identity before giving effect to a request. Certain rights are subject to limitation; in particular, we may decline to erase Personal Data forming part of a contractual record upon which a counterparty continues to rely, or which we are required by law to retain.

The Services are intended exclusively for individuals who have attained eighteen years of age. Engagements concluded through the Services give rise to binding contractual obligations, and we do not knowingly permit the registration of accounts by children. Where we become aware that an account has been registered by a child, we will delete that account and the associated Personal Data. If you believe that a child has provided Personal Data to us, please notify us at privacy@kollabmint.com.

Our infrastructure and database services are provided by vendors who may store or process Personal Data at locations outside India. Where Personal Data is transferred outside India, such transfer is effected only to territories that are not restricted by the Central Government under Section 16 of the DPDP Act, and we require the recipient to maintain safeguards consistent with those described in this Policy.

We may amend this Policy from time to time to reflect changes to the Services, to our practices, or to applicable law. The date stated at the head of this Policy indicates the date on which the current version took effect. Where an amendment materially affects the manner in which we process your Personal Data, we will provide notice through the Services or by email in advance of the amendment taking effect. Your continued use of the Services following the effective date constitutes acknowledgement of the amended Policy.

Enquiries concerning this Policy or our processing of Personal Data may be addressed to privacy@kollabmint.com or submitted through our contact form.

In accordance with the DPDP Act and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, we have appointed a Grievance Officer to receive and address complaints concerning the Services and the processing of Personal Data. The particulars of the Grievance Officer are as follows.

Complaints are acknowledged within twenty-four hours of receipt and disposed of within fifteen days. Where you remain dissatisfied with the resolution provided, you may refer the matter to the Data Protection Board of India.