1. Who we are
KIPLAR is a performance marketing agency operated by KIPLAR LTD., a company registered in Bulgaria under company ID (EIK) 206403444, VAT number BG206403444, with its registered office at 47 Charni Vrah Blvd., fl. 4, 1407 Sofia, Bulgaria (“KIPLAR”, “we”, “us”).
KIPLAR is the controller of the personal data described in this policy. Where we process personal data on behalf of a client, for example data inside a client’s advertising or email marketing accounts, the client is the controller and we act as its processor under our agreement with that client.
This policy covers the website kiplar.agency and its language versions, and the services we provide to our clients. For any privacy question or request, contact us at [email protected].
2. Personal data we collect
We collect only the data we need to answer you, provide our services and run our business.
- Inquiries and contact forms: name, work email, phone number, company, website, your message and any files you attach.
- Clients and partners: business contact details of your representatives, contract and billing details, and our correspondence with you.
- Advertising account data: when a client grants us access to its Google Ads account, we process the data described in section 4.
- Job applicants: your CV, cover letter, contact details and anything else you choose to send us.
- Website usage: IP address, browser and device type, pages visited, referring page and cookie identifiers. Analytics and advertising cookies are set only with your consent (section 5).
We do not knowingly collect special categories of personal data, such as health data or political opinions. Please do not send us such data.
3. How we use your data and why
Under the EU General Data Protection Regulation (GDPR), every use of personal data needs a legal basis. Ours are:
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Answer inquiries and prepare proposals | Contact form data | Steps before a contract, Art. 6(1)(b); legitimate interest, Art. 6(1)(f) |
| Provide our services | Client contacts, advertising account data | Contract, Art. 6(1)(b) |
| Invoicing and accounting | Billing details | Legal obligation, Art. 6(1)(c) |
| Recruitment | Applicant data | Steps before a contract, Art. 6(1)(b); consent to keep your CV for future roles, Art. 6(1)(a) |
| Website analytics and advertising | Cookie and usage data | Consent, Art. 6(1)(a) |
| Email updates to business contacts | Name, email | Consent, Art. 6(1)(a), or legitimate interest where the law allows; you can unsubscribe at any time |
| Security and preventing misuse | Logs, IP address | Legitimate interest, Art. 6(1)(f) |
We do not sell personal data and do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Google Ads data (Google API Services)
KIPLAR uses the Google Ads API through an internal tool operated only by KIPLAR employees. The tool accesses Google Ads accounts that our clients have granted us access to via our manager account. We use this data solely to plan, report on and manage our clients’ advertising campaigns, including keyword research, performance reporting and changes approved by our specialists. We do not sell Google user data, do not share it with third parties except as required by law, and do not use it for any purpose other than providing our services to the client who granted access. Data is stored on servers controlled by KIPLAR and deleted when the client’s access is revoked or our engagement ends. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
What we access. Account and campaign structure, ad groups, keywords, ads and assets, performance statistics (impressions, clicks, cost, conversions), search terms, conversion settings and keyword planning data. We access only accounts linked to our manager account at the client’s request.
How we access it. Through Google OAuth, authorized by a KIPLAR employee whose Google account has access to our manager account. Visitors of our website are never asked to sign in with Google.
How we use it. Only to deliver the services agreed with the client who owns the account. We do not use Google Ads data to serve advertising to anyone, to build profiles for other purposes, or to train general-purpose AI models. Where we use service providers to help analyze this data on our behalf, including AI tools, they act as our processors under written contracts that prohibit any other use.
Where it is stored. On servers controlled by KIPLAR located in Frankfurt, Germany (European Union). Access is limited to KIPLAR employees who work on the client’s account, and data is encrypted in transit.
Sharing. We share Google Ads data only with the client who owns the account, with our processors as described above, or where required by law.
Retention and deletion. We keep this data while the client’s engagement and access are active, and delete it within 30 days after access is revoked or the engagement ends, unless the law requires us to keep it longer. A client can revoke our access at any time by unlinking its account from our manager account in Google Ads or by writing to [email protected]. Access granted through a Google account can also be removed at Google Account permissions.
Limited Use. KIPLAR’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
5. Cookies and analytics
We use strictly necessary cookies to run the website. Analytics and advertising cookies are set only after you accept them in our cookie banner.
| Category | Purpose | Tools |
|---|---|---|
| Strictly necessary | Security, remembering your cookie choice and language | Our website; Cookie Script (stores your consent choice) |
| Analytics | Understanding how visitors use the site | Google Analytics 4 |
| Advertising | Measuring our own ad campaigns and showing our ads to past visitors | Meta Pixel |
You can change or withdraw your consent at any time through the “Cookie settings” link in the footer, and you can block or delete cookies in your browser settings. Blocking necessary cookies may affect how the site works.
6. Who we share data with
We share personal data only with recipients who need it to help us provide our services, and only to the extent necessary:
- Hosting and infrastructure: Hostinger, with servers in Frankfurt, Germany, for our website and internal tools.
- Business software: email and office tools Google Workspace, CRM and project management tools we use to handle inquiries and client work.
- Analytics and advertising platforms: Google and Meta, only for cookie data you have consented to.
- Professional advisors: accountants, auditors and lawyers, under confidentiality obligations.
- Authorities: when we are legally required to disclose data.
Our service providers act as processors under written agreements and may use the data only on our instructions.
7. Transfers outside the EU
Some of our service providers are based outside the European Economic Area, for example in the United States. In those cases we rely on an adequacy decision, such as the EU–US Data Privacy Framework, or on the European Commission’s Standard Contractual Clauses, to keep your data protected to EU standards. You can ask us for a copy of the relevant safeguards.
8. How long we keep data
| Data | Retention period |
|---|---|
| Inquiries that do not lead to a contract | [24 months] after our last contact |
| Client records and correspondence | For the term of the contract, then as long as needed to handle claims |
| Invoices and accounting records | As required by Bulgarian accounting and tax law |
| Google Ads data | See section 4: deleted within 30 days after access ends |
| Job applications | [6 months] after the hiring process, or longer if you consent |
| Cookie data | As stated in the cookie banner for each tool |
When a retention period ends, we delete or anonymize the data.
9. Security
We protect personal data with technical and organizational measures appropriate to the risk: access limited to employees who need it, two-factor authentication on business accounts, encryption in transit, regular updates of our systems and confidentiality obligations for our team. No method of transmission or storage is completely secure, but if a breach affects your data, we will notify you and the supervisory authority as the law requires.
10. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have your data deleted where we no longer have a reason to keep it;
- restrict or object to our processing, including direct marketing;
- receive your data in a portable format;
- withdraw your consent at any time, without affecting processing done before.
To use any of these rights, write to [email protected]. We will reply within one month and may ask you to confirm your identity.
If you believe we have not handled your data properly, you can lodge a complaint with the Bulgarian supervisory authority, the Commission for Personal Data Protection (cpdp.bg), or with the authority in the EU country where you live or work.
11. Children
Our website and services are intended for businesses and are not directed at children under 16. We do not knowingly collect their personal data.
12. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows the latest version. If a change significantly affects how we use your data, we will notify our clients directly.
13. Contact
- Company: KIPLAR LTD., EIK 206403444, VAT BG206403444
- Address: 47 Charni Vrah Blvd., fl. 4, 1407 Sofia, Bulgaria
- Email: [email protected]
