CONVERTKIT, INC.

PRIVACY POLICY

Last Updated: September 1, 2023

ConvertKit, Inc. (“ConvertKit”, “we”, “us”, or “our”) is committed to protecting your privacy. This Privacy Policy (“Policy”) describes how we collect, use, and disclose data. This Policy applies to your use of ConvertKit’s products, services, and websites located at www.www.enoicoo.com and www.creatornetwork.com on all platforms (collectively, “Services”).

ConvertKit is a United States corporation subject to the laws of the United States. The United States may not offer a level of privacy protection as great as that offered in other jurisdictions. Since our servers are located in the United States, your data may be transferred to, stored, or processed in the United States. By using our Services, you understand and consent to the collection, storage, processing, and transfer of your data to our facilities in the United States and those third parties we share your data with as described in this Policy and our Terms of Service Agreement.

1. DEFINITIONS

a. Customer: a person or entity that is registered with ConvertKit to use the Services.
b. Distribution List: a list of Subscribers and all data related to those Subscribers.
c. Personal Data: any information relating to an identified or identifiable natural person.
d. Subscriber: any person or entity on your Distribution List.
e. You: a ConvertKit Customer or other person or entity who visits our Services.

2. INFORMATION WE COLLECT ABOUT YOU

The Services collects two kinds of information about you: (a) Personal Data; and (b) Non-Personal Data.

a. Personal Data. Personal Data is any information relating to an identified or identifiable natural person. Personal Data we may collect includes:
- i. Identification and Contact Data: name, date of birth, gender, address, title, contact details (email, phone number, etc.), username, profile photo, or other demographic information;
- ii. Financial Information: credit card details, account details, payment information;
- iii. Employment Details: education, employer, job, title, geographic location, area of responsibility;
- iv. IT Information: IP address, cookie data;
- v. Personal Interests or Preferences: purchase history, subscription history, social media profile information; and
- vi. Communications and Related Data: chat and/or text records, recorded calls and/or voicemails, photographs, and video images.
You may decline to provide Personal Data to the Services. However, some of the Personal Data we ask you to provide is mandatory for a service. If you decline to provide it, we may not be able to provide that service to you.
b. Non-Personal Data. Non-Personal Data is any information not relating to an identified or identifiable natural person. Non-Personal Data we may collect includes:
- i. Browser and Device Data: IP address, device type, unique user device number, device manufacturer and model, type of browser or operating system, dates and times of use, screen resolution, plug- ins, add-ons, location, and the version of the Services you are using.
- ii. Cookies and Tracking Technologies: time spent on the Services, pages visited, and email campaign performance.
- iii. Aggregate Information: data about how you use the Services combined with data about how others use the Services in order to help us better develop new features and tailor the Services.

3. HOW WE USE YOUR INFORMATION

a. Personal Data. We may use your Personal Data to:
- i. Provide the Services;
- ii. Resolve disputes, calculate and collect fees, and troubleshoot problems;
- iii. Verify your identity and the information you provide;
- iv. Encourage a safe online experience and enforce our policies;
- v. Customize your experience and analyze usage of, improve and measure interest in, and inform you about the Services;
- vi. Provide you with information that may affect your use of the Services;
- vii. Communicate marketing and promotional offers;
- viii. Provide customer service, including receipts;
- ix. Develop new products; and
- x. Perform certain other business activities.
b. Non-Personal Data. We may use your Non-Personal Data for any purpose, including, but not limited to:
- i. Measuring traffic patterns;
- ii. Understanding demographics, customer interest, and other trends among users;
- iii. Providing, improving, and modifying the Services; and
- iv. For advertising, marketing, and promotional purposes.

4. HOW WE MAY DISCLOSE YOUR INFORMATION

a. Personal Data. We may disclose, and you consent to our disclosing of, your Personal Data to:
- i. Service Providers and others who help with our business operations and assist in the delivery of our products and services including, but not limited to, application development, site hosting, maintenance, data analysis, infrastructure provision, IT services, customer service, email delivery services, payment processing, marketing, analytics, and enforcement of our Terms of Service Agreement and other agreements;
- ii. Third parties in the event of a reorganization, merger, sale, debt financing of assets, joint venture, assignment, transfer, or other disposition of all or any portion of our business or assets (including in connection with any insolvency, bankruptcy, receivership, or similar proceeding);
- iii. A ConvertKit subsidiary, affiliate, or business partner;
- iv. Other users of the site to identify you to anyone to whom you send messages or make comments through the Services;
- v. Persons or entities with whom you consent to have your Personal Data shared;
- vi. Third parties in order to prevent damage to our property (tangible and intangible), for safety reasons, or to collect amounts owed to us;
- vii. Merchants and payment processors; and
- viii. Third parties as we believe necessary or appropriate, in any manner permitted under applicable law, including laws outside your country of residence to: comply with legal process; respond to requests from public and government authorities, including public and government authorities outside your country of residence; enforce our Terms of Service Agreement and other agreements; protect our operations; protect our rights, privacy, safety or property, and/or that of our affiliates, you, or others; and allow us to pursue available remedies or limit the damages that we may sustain.
We will never sell, rent, or lease your Personal Data to a third party.
b. Non-Personal Data. We may disclose Non-Personal Data for any purpose. Remember, Non-Personal Data cannot be used to identify you or another person.

5. ADVERTISING

a. Opting out of Receiving Email Communications from us. If you no longer want to receive marketing-related emails from us, you may opt-out via the unsubscribe link or by notifying us at legal@www.enoicoo.com. We may still send you important messages regarding administrative matters, updates, disputes, and customer service issues that are required to provide you with the Services.
b. Opting out of Receiving SMS Messages from us.** ConvertKit offers you mobile alerts regarding company information, migrations, products, events, marketing, advertising, and promotions by SMS messaging (“SMS Messaging”). Enrollment in SMS Messaging requires you to provide your mobile phone number and agree to this Policy and our Terms of Service Agreement before the SMS Messaging starts. To stop receiving SMS Messaging from ConvertKit, reply with STOP to any SMS Messaging you received from ConvertKit or use the unsubscribe link we may provide within any of ConvertKit’s SMS Messaging. This is the exclusive method for opting out. After texting STOP to ConvertKit, you may receive one additional message confirming that your request has been processed. Text HELP to any SMS Messaging you received from ConvertKit for support.
c. Cookies and Other Tracking Technologies.** ConvertKit and its partners may use cookies and other tracking technologies such as pixels and web beacons on the Services to administer the Services, track your movements around the Services, analyze trends, serve targeted advertisements, and gather demographic information. You can control the use of cookies at the individual browser level. Our third-party partners may use cookies or other tracking technologies to provide you advertising on other sites based upon your browsing activities and interests. If you want to opt-out of interest-based advertising, please visit http://preferences-mgr.truste.com/, or if located in the European Union, visit http://www.youronlinechoices.eu.
d. Web Beacons. When we send emails to Customers, we may use web beacons to track who opened the emails and clicked links to measure campaign performance and improve features for Customers. We also use web beacons in the emails we deliver for Customers to create reports about campaign performance and determine what actions Subscribers took.

6. DATA COLLECTED BY OUR CUSTOMERS

a. Our Relationship with Subscribers. Customers may import into the Services Personal Data they have collected from their Subscribers or other individuals. We have no direct relationship with Customers’ Subscribers or any individuals other than our Customers. Customers are responsible for making sure they have the necessary permissions for us to collect, store, and process Personal Data about Subscribers or other individuals.A Subscriber should unsubscribe directly from a Customer’s newsletter or contact the Customer directly to change, update, or delete the Subscriber’s data. If a Subscriber contacts us, we will refer you to that Customer and support them in responding to your request if necessary.
b. Use and Transfer of Data. Consistent with this Privacy Policy, we may transfer Customer or Subscriber Personal Data to entities that help us promote, provide, or support our Services or the services of our Customers (“Service Providers”). All Service Providers agree to protect Personal Data in accordance with this Privacy Policy. We will never sell, rent, or lease Customers’ Distribution Lists.

7. PUBLIC DATA AND THIRD-PARTY SITES

a. Public Data. We may provide areas on the Services where you can publicly post information. This information may be read, collected, and used by anyone. We do not control or endorse the information posted by third-party users, are not liable for your or third-party posts to the Services, and specifically disclaim any liability resulting from such posts.
b. Third-Party Sites. Upon your consent, the Services may access third- party information through application interfaces. We may also provide links to third-party sites. When you click on links to third-party sites, you may leave the Services.This Policy does not cover any collection, use, or disclosure by third parties through any applications, Websites, products, or services that we do NOT control or own, or any third-party features or services made available through the SERVICES.By using the SERVICES, you expressly relieve ConvertKit from any and all liability arising from your use of any third-party website.The inclusion of a link or accessibility of third-party sites does not imply endorsement of such third-party site by us. All trademarks, trade names, and logos of third parties featured on the Services belong to their respective owners.Each merchant and third-party payment processor collects and shares your information according to its own privacy policy and terms of service. ConvertKit is not responsible for the actions of third-party processors or merchants, including how such entities treat your information. You are responsible for knowing and understanding their policies and terms.

8. DATA RETENTION

We will retain your Personal Data for the period necessary to fulfill the purposes outlined in this Privacy Policy unless a longer retention period is required or allowed by law.

9. USERS UNDER 13 YEARS OF AGE

Our Services are not directed to and we do not knowingly collect Personal Data from children under the age of 13. If we become aware that a child under the age of 13 has provided us with Personal Data, we will take steps to remove such data. If you become aware that your child has provided us with Personal Data without your consent, please contact us at legal@www.enoicoo.com. By using the Services, you are representing to us that you are not under the age of 13.

10. DATA SECURITY

We employ commercially reasonable security measures to protect your information; however, no system is impenetrable. If you create an account on the Services, you are responsible for protecting the security of your account, its content, and all activities that occur under the account or in connection with the Services. You must immediately notify ConvertKit of any unauthorized uses of your account or any other breaches of security by emailing us at legal@www.enoicoo.com.

11. INTERNATIONAL DATA TRANSFERS

ConvertKit reserves the right to store and process your Personal Data in the United States and in any other country where ConvertKit or its affiliates, subsidiaries, or service providers operate facilities in compliance with and as permitted by applicable laws and regulations. Some of these countries may have data protection laws that are different from the laws of your country and may offer less legal protection.

When ConvertKit transfers, stores, or processes Personal Data outside of your jurisdiction, including to or in the United States, we take appropriate safeguards to protect your Personal Data in accordance with this Policy and applicable law.

Some recipients of your Personal Data are located in countries outside the EU/EEA, UK, and/or Switzerland that are not subject to an adequacy decision, which means that these countries are not recognized as having an adequate level of data protection under the EU/EEA, UK, and/or Swiss data protection laws and the transfer of Personal Data is therefore not permitted under the General Data Protection Regulation (EU) 2016/679 (the “EU’s GDPR”), the Data Protection Act 2018 (the “UK GDPR”), and/or Swiss Federal Act on Data Protection (the “Swiss FADP”). In these cases, ConvertKit may use the following to transfer your Personal Data to the United States and elsewhere:

a. The EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK extension to the EU-U.S DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”); or
b. The Standard Contractual Clauses (“SCCs”) approved by the European Commission or the International Data Transfer Agreement (“IDTA”) approved by the UK Government.

ConvertKit offers a Data Processing Agreement for those Customers processing Personal Data on behalf of EU/EEA, United Kingdom, and Swiss individuals. To request our Data Processing Agreement, please fill out this form.

12. LEGAL BASIS FOR PROCESSING PERSONAL DATA

Under the EU’s GDPR, the UK GDPR, and the Swiss FADP, ConvertKit generally acts as a processor on behalf of our Customers. When ConvertKit processes Personal Data as a data controller, we do so on the following legal bases:

a. To perform our contract with you for the use of the Services;
b. In reliance on our legitimate interests in administering, operating, and supporting the Services;
c. In reliance on our legitimate interests in providing certain features;
d. In reliance on our legitimate interests in enforcing our Terms of Service Agreement and applicable law;
e. In reliance on our legitimate interests in preventing fraud and abuse;
f. In reliance on our legitimate interests in meeting legal requirements;
g. In reliance on our legitimate interests in improving the Services;
h. In reliance on our legitimate interests in supporting our marketing activities;
i. In reliance on our legitimate interests in providing network and information security; and
j. You provided us your consent.

13. THE CALIFORNIA CONSUMER PRIVACY ACT

The California Consumer Privacy Act (“CCPA”) provides California residents with specific rights regarding their Personal Data, including the right to request certain information from businesses subject to the CCPA that collect Personal Data from you, the right to ask such businesses to delete Personal Data collected from you (subject to exceptions), the right to opt-out if a business sells your Personal Data, and the right of non-discrimination if you exercise any of these privacy rights.

ConvertKit acts as a “service provider” under the CCPA when offering the Services to its Customers and our receipt and collection of any Personal Data is completed on behalf of our Customers in order for us to provide the Services. If you are a Subscriber of one of our Customers, please contact the Customer directly with your request for access or deletion under the CCPA. If you contact us, we will refer you to that Customer and support them in responding to your access or deletion request if necessary.

If you exercise your rights under the CCPA, ConvertKit will not discriminate against you, deny, charge different prices for, or provide a different quality of the Services. If ConvertKit ever offers a financial incentive or product enhancement that is contingent upon you providing your Personal Data, we will not do so unless the benefits to you are reasonably related to the value of the Personal Data you provide to us. ConvertKit does not sell your Personal Data.

ConvertKit offers a Data Processing Agreement for those Customers that are considered “businesses” under the CCPA and that process Personal Data on behalf of California residents. To request our Data Processing Agreement, please fill out this form. To exercise any of your rights under the CCPA, please email us at legal@www.enoicoo.com.

14. OTHER REGION AND STATE-SPECIFIC PRIVACY LAWS AND RIGHTS

Depending on where you live, you may have certain state or country-specific rights regarding your Personal Data. These state and country laws include, but are not limited to:

a. Australia’s Privacy Act 1988 (“Australia’s Privacy Act”)
b. Brazil’s General Data Protection Law (“LGPD”)
c. Canada’s Privacy Act (“Canada’s Privacy Act”)
d. China’s Personal Information Protection Law (“PIPL”)
e. Colorado Privacy Rights Act (“CPA”)
f. Connecticut Data Privacy Act (“CDPA”)
g. Data Protection Act 2018 (the “UK GDPR”)
h. General Data Protection Regulation (EU) 2016/679 (the “EU’s GDPR”)
i. Mexico’s Ley Federal de Protección de Datos Personales en Posesión de los Particulares (“Mexico’s Data Protection Law”)
j. Switzerland’s Federal Data Protection Act (“FADP”)
k. Virginia Consumer Data Protection Act (“VCDPA”)

Under some of these laws and regulations, where applicable, you may have the right to access, deletion, correction, verification, portability, opt-out of tracking for targeted advertising purposes, opt-out of profiling, among other rights. To exercise any rights under these or other applicable data protection laws, please email us at legal@www.enoicoo.com.

You may also have the right to file a complaint about ConvertKit’s collection and processing of Personal Data. To file a complaint, contact the applicable supervisory authority or data protection authority.

15. EU-U.S. DATA PRIVACY FRAMEWORK, UK EXTENSION TO THE EU-U.S. DATA PRIVACY FRAMEWORK, AND SWISS-U.S. DATA PRIVACY FRAMEWORK

ConvertKit complies with the EU-U.S. Data Privacy Framework (the “EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (the “Swiss-U.S. DPF”) (collectively, “Data Privacy Framework”), as set forth by the U.S. Department of Commerce.

ConvertKit has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Privacy Framework Principles (“EU-U.S. DPF Principles”) with regard to the processing of Personal Data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. ConvertKit has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (“Swiss-U.S. DPF Principles”) with regard to the processing of Personal Data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (“DPF”) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

The types of Personal Data we collect are described in Section 2 of this Privacy Policy. The purposes for which we collect and use Personal Data are described in Sections 3 and 4 of this Privacy Policy. The choices we offer individuals for limiting the use and disclosure of Personal Data are described in Section 5 of this Privacy Policy.

We only collect Personal Data that is relevant for providing the Services. We process Personal Data in a way that is compatible with providing the Services or as otherwise authorized by you. We take reasonable steps to ensure that Personal Data is reliable for its intended use, accurate, complete, and current. We adhere to the DPF Principles for as long as we retain Personal Data.

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, ConvertKit commits to resolve DPF Principles-related complaints about our collection and use of your Personal Data. EU/EEA, UK, and Swiss individuals with inquiries or complaints regarding our handling of Personal Data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact ConvertKit at legal@www.enoicoo.com.

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, ConvertKit commits to refer unresolved complaints concerning our handling of Personal Data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgement of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit here for more information or to file a complaint. The services of JAMS are provided to you at no cost.

The Federal Trade Commission has jurisdiction over ConvertKit’s compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.

You may, under certain conditions, invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other mechanisms. Please visit here for more information.

ConvertKit is liable in cases of onward transfers of Personal Data to third parties acting as agents on our behalf. We comply with the DPF Principles for all onward transfers of Personal Data from the EU/EEA, UK, and Switzerland, including the onward transfer liability provisions. ConvertKit remains liable under the DPF Principles if ConvertKit’s agent processes such Personal Data in a manner inconsistent with the DPF Principles unless we can prove that we are not responsible for the event giving rise to the damage.

In certain situations, we may need to disclose Personal Data in response to lawful requests by public authorities, including to meet national security and law enforcement requirements, or otherwise comply with the law or a court order.

We use reasonable and appropriate physical, electronic, and administrative safeguards to protect personal data from loss, misuse and unauthorized access, disclosure, alteration and destruction, taking into account the nature of the Personal Data and risks involved in processing that information.

If you would like to review, correct, delete, or update Personal Data that you have previously disclosed to us, please email us at legal@www.enoicoo.com. We may limit or deny access to Personal Data only where permitted by the DPF Principles.

We will assist our Customers in responding to EU/EEA, UK, and Swiss individuals exercising their rights under the DPF Principles.

If you are a Subscriber of one of our Customers, please contact the Customer directly with your request to access or limit the use or disclosure of your Personal Data. If you contact us, we will refer you to that Customer and support them in responding to your access request if necessary.

We need to retain certain information about you for legal and internal business reasons. We will retain your Personal Data for as long as necessary to provide you with the Services and as needed to comply with our legal obligations and enforce our agreements.

16. DO NOT TRACK DISCLOSURE

Currently, there is no industry standard for recognizing Do Not Track browser signals, so we do not respond to them.

17. CHANGES TO THIS PRIVACY POLICY

ConvertKit may change this Privacy Policy at any time. The most recent version of the Privacy Policy is indicated by the “Last Updated” date at the top of the Privacy Policy. All changes are effective immediately upon posting. Please review this Privacy Policy frequently to stay updated on changes that may affect you. Your continued use of the Services signifies your continuing consent to be bound by this Privacy Policy.

18. CONTACT INFORMATION

If you have any questions about this Privacy Policy, please email us at legal@www.enoicoo.com.

隐私策略