Privacy Policy

Welcome to Ketch!

Ketch Kloud, Inc. (“Ketch,” “we,” “us,” or “our”) is a privacy technology company that helps organizations operationalize data privacy and consumer rights across digital properties, internal systems, and third-party platforms.

This Privacy Policy describes how we collect, use, disclose, and otherwise process Personal Information, and the rights and choices available to individuals in connection with that processing.

If you have questions about this Privacy Policy or our practices, please contact us at privacy@ketch.com. For all other enquiries, please visit our Contact Us page.

Your use of the Services is subject to this Privacy Policy. If you do not agree with this Privacy Policy, please do not access or use the Services.

If you are using the Services on behalf of a company or other legal entity, you represent and warrant that you have the authority to bind that entity to this Policy, and “you” will refer to that entity.

We may update this Policy from time to time. If we do, we will revise the “last updated” date above. For material changes, we may provide notice in advance - for example by posting on our Website, contacting you directly, or, where required by law, by seeking your consent.

We encourage you to periodically review this Privacy Policy.

1. When this Privacy Policy Applies

This Privacy Policy applies to all information collected by us when you:

• Visit our websites that display or link to this Privacy Policy (including https://www.ketch.com) (the “Website(s)”), our branded social media pages, or our offices;
• Communicate with us, or receive communications from us by email, phone, or text;
• Sign up for, register, or use any of our self-serve products and services (including Ketch Starter, also offered as "Ketch Free"), where you contract directly with us and we act as the controller of your account, sign-up, and usage data;
• Otherwise interact with our products and services in any capacity in which we act as a controller of your personal data - for example, where your information is shared with us during a contracting, onboarding, or partner enablement process, or because you act as or work for a Ketch customer, partner, supplier, or service provider;
• Register for, attend, or take part in our events, webinars, programs, trainings, certifications, or contests;
• Participate in one of our Partner Referral Programs, whether by generating and sharing a referral link or by clicking one;
• Participate in surveys, research, or other similar data collection facilitated by us. We refer to these activities collectively as the “Services.”

For the avoidance of doubt, this Privacy Policy applies where Ketch processes your Personal Information as a controller. It does not apply where we process Personal Information as a processor or service provider on behalf of our customers - in those cases, our customer is the controller and we handle Personal Information according to their instructions and the applicable customer agreement. We are not responsible for the privacy practices of our customers, which may differ from those described here. For information about how a Ketch customer uses your Personal Information, or to exercise rights with respect to that information, please contact that organization directly.

Our Websites and Services may include links to third-party websites, applications, and platforms not operated or controlled by us. Personal Information you provide to those third parties is subject to their own privacy policies. We are not responsible for their content, security, or privacy practices, and we encourage you to review their privacy notices before interacting with them.

2. What Categories of Personal Information We Collect

We collect the categories of Personal Information identified below. “Personal Information” means information that identifies, relates to, describes, or can reasonably be linked to a particular individual or device.

We do not sell Personal Information for monetary consideration. However, certain disclosures for advertising, analytics, or marketing purposes may be considered “selling” or “sharing” under applicable law (including California law). The table below identifies which categories we may “sell” or “share” in that sense.

For the avoidance of doubt, we do not sell or share Personal Information that we process on behalf of our customers (where we always act as a service provider or processor), and we do not knowingly sell or share Personal Information of individuals under the age of 16.

You may have the right to opt out of the sale or sharing of your Personal Information, as well as to exercise other privacy rights - see Section 10.

We disclose Personal Information to the categories of recipients described in Section 5 for the business and commercial purposes described in Section 4.

Retention

We retain Personal Information only as long as reasonably necessary for the purposes for which it was collected, including to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. Specific retention periods depend on the type of information:

• Account and customer data: retained for the duration of the relationship and for a reasonable period thereafter for record-keeping, legal-defense, and tax purposes (typically up to seven years from the end of the relationship);
• Marketing data: retained until you opt out or until you have been inactive for the period required or permitted by applicable law;
• Website and usage data: retained for the period necessary for analytics, security, and product-improvement purposes (typically no longer than 25 months);
• Cookie and other tracker data: retained for the period necessary for analytics and marketing (typically no longer than 1 year);
• Records required by law or regulation: retained for the period prescribed by the applicable law.

After the applicable retention period expires, we will, where reasonably practicable, delete or de-identify your Personal Information. Where we cannot fully delete data for technical reasons, we will seek to isolate it and prevent any further use.

3. How We Collect Personal Information

We collect Personal Information from the following sources:

• Directly from you: when you interact with our Services, including by creating an account, requesting support, registering for events or programs, completing forms or surveys, or otherwise providing information to us.
• Automatically: through your use of our Services, including via cookies and similar technologies (such as tags, SDKs, and scripts), which collect information about your device, browsing activity, and interactions with our Websites, emails, and Services.
• From our referral partners: when a partner participating in one of our Partner Referral Programs shares a referral link with you, we receive an identifier indicating that you arrived via that partner. We use this identifier to attribute your sign-up to the referring partner, calculate any reward owed, and detect fraudulent activity.
• From other third parties: including business partners, service providers, marketing and advertising partners, analytics providers, social media platforms (subject to your settings and their policies), and data providers or aggregators.
• From publicly available sources: including information you have chosen to make publicly available through online platforms, directories, or other public sources.

We may combine Personal Information collected from these sources and use it in accordance with this Privacy Policy.

We may also process information that does not identify, relate to, or reasonably link to an individual (“Non-Personal Information”). Where we de-identify or aggregate Personal Information so that it no longer identifies an individual, we will maintain it in de-identified form and will not attempt to re-identify it, except as permitted by applicable law. To the extent permitted by law, we may use and disclose Non-Personal Information for any lawful purpose.

We do not intentionally collect or process sensitive categories of Personal Information (such as health, biometric, or precise geolocation data) unless explicitly provided by you, required for a specific purpose, or otherwise permitted by applicable law.

4. Purposes and Legal Bases for Processing

We use Personal Information for the purposes described below and rely on the legal bases identified, where required by applicable law. We limit collection, use, and retention to what is necessary for the purposes set out in this Privacy Policy.

In compliance with applicable U.S. state consumer privacy laws (including the CCPA), the purposes in the table above include both business purpose and commercial purpose disclosures. Business purpose disclosures are those made to service providers and contractors (listed in Section 5), who are contractually restricted from using Personal Information for their own independent purposes. Commercial purpose disclosures - those that may constitute a “sale” or “share” under applicable law - include disclosures to analytics providers, digital advertising networks, and social media platforms for personalization, analytics, and advertising purposes. See Section 10 for how to opt out of such disclosures.

We may use artificial intelligence and similar technologies as part of these processing activities. Our commercial terms with the providers of these services limit the scope of their personal information processing activities to exclusively support our Services, and they are commercially restricted from using personal information for their own product improvement purposes. Where AI involves Personal Information, we use it only where legally permissible, in compliance with this Privacy Policy, and in a manner consistent with our commitments and values. We do not use AI or automated processing to make decisions that produce legal or similarly significant effects without appropriate human involvement.

5. Information Sharing and Disclosure

We may disclose your Personal Information to the following categories of recipients. Disclosures to service providers, affiliates, and professional advisors are made for business purposes only; such recipients are contractually restricted from using Personal Information for their own independent purposes. Disclosures to analytics providers, digital advertising networks, and social media platforms may constitute “sales” or “shares” under applicable U.S. state privacy law and are identified as such where applicable.

• Service providers that perform services on our behalf - including IT and system administration, hosting, payment processing, analytics, marketing, event management, customer support, data enrichment, and AI/ML services. We require all service providers to enter into written agreements imposing appropriate data-protection and security obligations.

• Affiliates within our corporate group, for purposes such as customer support, marketing, technical operations, event management, and account administration. Our current affiliates are:

     - Ketch Kloud Limited, a company registered in England & Wales (company number 13839786), having its registered office at 5 New Street Square, London, United Kingdom, EC4A 3TW;
     - Ketch Kloud India Private Limited, a company incorporated in India (CIN: U72900PN2022FTC213591), having its registered office at Office No. 201, Metropolis, Sr. No. 22/3 Balewadi, Pune, Maharashtra, India - 411045.

• Business and technology partners that help us provide, enhance, or resell our Services, or offer complementary services, where necessary to fulfill your requests or, where required, with your consent.

• Referring partners - if you signed up for our Services after clicking a referral link from a partner participating in one of our Partner Referral Programs, we may disclose limited information about your sign-up (such as the fact and date of registration, and a partial or hashed identifier) to the referring partner so that they can confirm the referral and receive any reward owed under the Program. We do not disclose your account contents, usage, or other Personal Information to the referring partner without your separate consent.

• Event and promotion sponsors for events, webinars, or promotions you register for or participate in. Where required by law, we will obtain your consent. In some cases, you may provide information directly to the sponsor, in which case the sponsor’s privacy policy will govern.

• Analytics and advertising partners, including social media platforms and advertising networks, to measure performance and deliver relevant content and advertisements.

• Customers and account administrators - if you use our Services as part of an organization, we may disclose Personal Information to that organization or the partner responsible for your access to the Services for purposes such as account management, verification, security, and enforcement of our terms.

• Third-party integrations - where you connect or interact with third-party services through our platform, we may disclose Personal Information as necessary to enable those integrations and provide the requested functionality.

• Professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary for legal, financial, or compliance purposes.

• Acquirers in connection with a merger, acquisition, reorganization, or sale of assets, subject to appropriate safeguards.

• Courts, regulators, and law enforcement where required to comply with applicable law or legal process.

• Other recipients with your direction or consent, or as otherwise described at the time of collection.

We may also share Non-Personal Information and Aggregate Data for any lawful purpose, including analytics, product improvement, and business operations.

Certain disclosures may be considered “sales” or “shares” of Personal Information under applicable U.S. state privacy laws. Details on how to exercise your rights are set out in Section 10. As noted above, we do not sell or share Personal Information that we process on behalf of our customers.

6. Cross-Border Data Transfers

Your Personal Information may be transferred to, and stored by us in, the United States, and may also be processed by our affiliates and the third parties identified in Section 5 in their respective locations. Your Personal Information may therefore be processed in jurisdictions that do not provide the same level of data protection as your own.

Where required, we conduct transfer impact assessments and implement supplementary measures to ensure an adequate level of protection. Transfers of Personal Information from the EEA, the United Kingdom, or Switzerland to the United States rely on either:

• our certifications under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF (collectively, the “DPF”); or
• EU Standard Contractual Clauses (with the UK addendum where applicable) or another lawful transfer mechanism approved by the European Commission or other applicable regulator.

Ketch is certified to the U.S. Department of Commerce under each of the EU-U.S. DPF, the UK Extension, and the Swiss-U.S. DPF, and adheres to the relevant DPF Principles in respect of Personal Information received from the EU, the UK (and Gibraltar), and Switzerland. To learn more, and to view our certification, visit https://www.dataprivacyframework.gov. If there is any conflict between this Privacy Policy and the DPF Principles, the DPF Principles will govern.

EEA, UK, and Swiss individuals have the right to:

• confirm whether we hold Personal Information about them, and to access, correct, amend, or delete that information, by contacting privacy@ketch.com; 
• opt out of disclosures to third parties not acting as our agents, or of uses for purposes other than those for which the information was originally collected (or subsequently authorized), by contacting privacy@ketch.com;
• direct unresolved DPF complaints first to us, and then, if not satisfactorily addressed, to JAMS at https://www.jamsadr.com/dpf-dispute-resolution (free of charge); and
• under certain conditions, to invoke binding arbitration for residual claims - see https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction.

Ketch remains liable for any onward transfer of Personal Information by an agent acting on our behalf, unless we prove we are not responsible for the event giving rise to the damage. The Federal Trade Commission has investigation and enforcement authority over our compliance with the DPF Principles.

In limited circumstances, we may be required to disclose Personal Information in response to lawful requests by public authorities, including for national security or law enforcement purposes.

If you believe we have not handled your Personal Information correctly, please contact us at privacy@ketch.com. You also have the right to lodge a complaint with the supervisory authority in your country.

7. Modifying Your Account Information

If you have an account with us, you can review, update, correct, or delete your Personal Information by logging in and editing your profile, or by emailing privacy@ketch.com. 

8. Security: How We Protect Your Personal Information

We implement appropriate technical, administrative, and physical safeguards to protect Personal Information against unauthorized access, disclosure, alteration, destruction, loss, or misuse - including access controls, encryption, monitoring, and other industry-standard measures. No method of transmission over the Internet or electronic storage is completely secure, however, and we cannot guarantee absolute security.

Access to your account is protected by your username and password. You are responsible for maintaining the confidentiality of your credentials and for all activities under your account. We will not request your password in unsolicited communications.

9. Communications and Direct Marketing

We may communicate with you regarding updates to our Services, changes to legal terms, and customer support matters. Where such communications constitute direct marketing, we will do so only where permitted by applicable law, including where we have your consent or can rely on another valid legal basis.

You may opt out of marketing communications at any time by following the unsubscribe instructions in our communications. You may continue to receive non-marketing communications, such as service-related or legally required notices (including security or data-breach notifications).

10. Your Privacy Choices and Rights

Subject to applicable data protection laws, you may have the right to the following rights, as described below:

• Know / Access: request information about the Personal Information we have collected about you, including the categories of data, sources, purposes, recipients, and (where applicable) specific pieces of Personal Information.
• Data portability: request a copy of your Personal Information in a portable, commonly used format.
• Correction: request correction of inaccurate or incomplete Personal Information.
• Deletion: request deletion of your Personal Information, subject to legal exceptions.
• Restrict processing: request that we limit our processing of your Personal Information in certain circumstances.
• Object: object to processing, including for direct marketing purposes, at any time.
• Opt out of sale, sharing, or targeted advertising: opt out of the “sale” or “sharing” of your Personal Information, or its use for targeted advertising, as defined under applicable law.
• Automated decision-making: not be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently engage in such processing.

You may also access, update, or delete certain Personal Information directly through your account settings, where available.

To exercise your rights, contact us at privacy@ketch.com or submit a request here. You are not required to create an account to submit a request. Where permitted by law, we may take reasonable steps to verify your identity (and, where applicable, an authorized agent’s authority) before responding to access, correction, and portability requests. Identity verification is not required for opt-out requests, including requests to opt out of sale, sharing, or targeted advertising. We may decline requests where permitted by law, including where we cannot verify your identity or where an exception applies. In certain jurisdictions, we may limit responses to access requests to a specified number within a 12-month period.

We will not discriminate against you for exercising your privacy rights.

In certain U.S. states with comprehensive consumer privacy laws (such as California, Colorado, Virginia, Connecticut, Texas, Montana, Oregon, and others), you also have the right to appeal to your state attorney general’s office if you disagree with how we honor your rights. We also extend an internal appeal process to all U.S. residents: if we deny or cannot fully honor your privacy request, you may submit an appeal by contacting us at privacy@ketch.com with the subject line “Privacy Request Appeal.” If, after we have processed your appeal, you are still unsatisfied with our response, depending on your state of residency, you may have a right to file a complaint with your state attorney general. 

If you are located in the EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

Authorized agents. A person legally authorized to act on your behalf may submit requests for you. You may also submit requests on behalf of your minor child, where permitted by law. Authorized agents must provide proof of authorization, and we may also require you to verify your identity directly with us. To submit a request as an authorized agent, you must provide either: (a) a written authorization signed by the consumer granting you permission to make the request on their behalf, or (b) a valid power of attorney executed pursuant to applicable state law. We may contact the consumer directly to verify the request and confirm the agent’s authority.

Browser-based opt-out signals. We honor Global Privacy Control (GPC) signals where required by applicable law and, in many cases, globally.  You will need to enable the signal on each browser or device you use.

11. Cookies and Similar Technologies

We use cookies, web beacons, pixels, SDKs, and similar technologies to collect information - which may include Personal Information - when you navigate our Websites and Services or interact with our emails.

Device and Usage Data

When you visit our Websites or use our Services, we automatically collect information that may include: identifiers (user ID, organization ID, username, email address, user type); commercial information; and internet activity information such as IP address (or proxy server information), device and application identifiers, location, browser type, ISP or mobile carrier, operating system and configuration, the pages and files viewed, website and webpage interactions (including searches and other actions), date and time stamps, and details of which Ketch products and product versions you are using. We use this information for the purposes described in Section 4 and may aggregate it for internal business purposes such as identifying customer opportunities and meeting customer demand.

Cookies and similar technologies

"Cookies" are small files containing a string of characters that your computer or mobile device sends to us, enabling certain features and functionality. They are unique to your account or browser. We also use technologies such as web beacons, pixels, tags, JavaScript, and SDKs, alone or with cookies, to gather information about how you use our Websites and emails.

When you visit our Websites, we and our authorized partners may use these technologies to collect information - including Personal Information - about your activities over time and across different sites. These technologies help us understand usage, remember your preferences, and improve and personalize your experience.We use both session cookies, which expire when you close your browser, and persistent cookies, which remain on your device until deleted or expired. You can control or disable cookies through your browser settings, but doing so may affect the functionality of our Websites and Services.

Where required by applicable law, we obtain your consent before placing non-essential cookies and similar technologies, and you may withdraw consent at any time through our cookie preference center.

We use the following categories of cookies and similar technologies, which align with the purposes exposed in our cookie preference center:

Opting-Out

In addition to using our cookie preference center, you may opt out of non-essential cookies through your browser settings, and you may opt out of interest-based advertising through the “Your privacy choices” link in any ketch.com Website footer. Blocking or deleting cookies may affect Website functionality.

While some browsers offer a “do not track” or “DNT” signal, there is no common industry standard for it, and we do not currently respond to DNT signals. We do honor Global Privacy Control (GPC) signals, as described in Section 10.

For more information about cookies, visit https://www.allaboutcookies.org and https://www.youronlinechoices.com.

12. Children's Privacy

We do not knowingly collect Personal Information from children. Our Websites and Services are not designed for use by individuals under the age of 16, and in particular are not designed for children under the age of 13. If we learn that we have collected information from someone under 13, we will delete it. If you believe this has occurred, please contact us at privacy@ketch.com. 

13. Questions and Contact Information

Ketch’s worldwide data protection officer can be contacted at dpo@ketch.com. 

EU and UK Representative. VeraSafe has been appointed as Ketch’s representative in the European Union and the United Kingdom for data protection matters under Article 27 of the EU GDPR and the UK GDPR. If you cannot reach Ketch as described in this section, you may contact VeraSafe:

• via the contact form at https://www.verasafe.com/privacy-services/contact-article-27-representative 
• by telephone: +420 228 881 031 (Netherlands) or +44 (20) 4532 2003 (UK)
• by post: VeraSafe Netherlands BV, Keizersgracht 555, 1017 DR Amsterdam, Netherlands; or VeraSafe United Kingdom Ltd., 37 Albert Embankment, London SE1 7TL, United Kingdom.

Other privacy questions or requests:
• by email: privacy@ketch.com
• by post: Ketch Kloud, Inc., Attn: Privacy, 548 Market ST PMB 62319, San Francisco, California, USA 94104-5401