Privacy Policy

This policy explains what personal data ZKO Creative Ltd collects when you use zko.world, contact us, follow us or work with us, why we collect it, how long we keep it, and the rights you have over it.

1. Who we are

ZKO Creative Ltd (trading as ZKO Creative) is a creative and advertising agency registered in England and Wales, company number 14285845, VAT number 440 1833 27. Our studio is at 48a1 High St, Marlow SL7 1AW.

We are the data controller for the personal data described in this policy. We work with clients in the UK and internationally, and this policy is governed by the law of England and Wales.

Questions about this policy or your data go to hello@zko.world, or by post to our studio address above.

2. What this policy covers

It covers zko.world and the ways you can contact us from it, the analytics, measurement and advertising technologies we use or may use on it, our social media pages, our dealings with clients, suppliers and applicants, and our integration with TikTok (section 11). It does not cover third-party websites we link to, which have their own policies.

3. The data we collect

Contact and careers forms

When you use the contact or careers form we collect your name, email address, the message you write, and the services or skills you tick. The form is protected against bots by Google reCAPTCHA v3 and a hidden honeypot field, and reCAPTCHA sends Google your IP address and browser information to score the submission. The form content is emailed to us through our email delivery provider, Resend.

Direct contact

If you email, call or message us on social media, we hold what you send us and our replies, so we can answer you and pick up the thread later.

Clients, prospects and suppliers

For the people we work with we hold business contact details, correspondence, briefs, proposals, contracts, invoices and payment records. We collect this directly from you or your organisation, and sometimes from public sources such as your company website or LinkedIn when we are researching a prospective client or partner.

Applicants

If you apply to work with us we hold your application, portfolio links and anything you send us during the process, together with our notes on it.

Analytics and measurement, with your consent

If you accept non-essential cookies we use Google Analytics 4 to understand how the site is used and how people find it. This can include:

• the pages you view, in what order, how long you spend on each, and how far down you scroll;
• what you interact with: links and buttons clicked, videos played, files downloaded, forms started and submitted (never the contents of a form);
• how you reached us: the site or search engine you came from, and any campaign tags or advertising click identifiers in the link you followed;
• your device type, operating system, browser, screen size and language;
• your approximate location (country, region and city), derived from your IP address and then discarded; Google Analytics 4 does not store full IP addresses;
• a random identifier stored in a cookie, so repeat visits by the same browser can be recognised;
• where we have Google signals switched on, aggregated demographics and interests (age range, gender, interest categories) for visitors who are signed in to Google and have ads personalisation turned on in their Google account. We only ever see this in aggregate.

We may also use a heatmap or session replay tool (such as Microsoft Clarity or Hotjar) to see how pages are used, with text you type masked. We never send names, email addresses, phone numbers or message contents to any analytics tool, and we do not try to identify individual visitors from analytics data. Nothing is loaded until you accept, and you can withdraw at any time (section 7).

Advertising and remarketing, with your consent

We advertise our own services from time to time. To measure whether an advert led to an enquiry, and to show our adverts to people who have visited the site, we may use advertising tags from Google Ads, Meta (Facebook and Instagram), LinkedIn and TikTok. These set cookies or use similar identifiers to recognise your browser on their platforms, record that you visited zko.world or completed an enquiry, and build audiences for our adverts. We do not run any of these tags at the moment. If we add one it will only run after you choose Accept all in the cookie banner, it will be listed in section 7, and the banner will ask you again.

Social media

We have pages on LinkedIn, Instagram, X, Facebook and TikTok. When you follow, like, comment or message us there, the platform processes your data under its own policy, and we see what you send us plus the aggregated audience statistics the platform gives page owners.

Technical and security data

Our hosting provider, Vercel, keeps short-lived server logs including IP address, request URL and user agent, used to run the site securely and diagnose faults.

We do not collect special category data and we do not knowingly collect data from children under 16.

4. Why we use it, and our lawful basis

Under UK GDPR Article 6 we rely on the following bases:

• Answering enquiries and messages. Contact details and message content. Basis: legitimate interests in responding to people who contact us.
• Delivering work to clients and managing supplier relationships. Business contact details, contract and billing records. Basis: contract, and legitimate interests in running our business.
• Keeping accounting and tax records. Invoices and payment records. Basis: legal obligation (Companies Act 2006, HMRC rules).
• Recruitment. Applications, portfolios and notes. Basis: legitimate interests in hiring, and steps before a contract.
• Protecting forms from spam and abuse. IP address and browser data via reCAPTCHA. Basis: legitimate interests in site security.
• Understanding how the site is used and improving it. Analytics and measurement data. Basis: consent, given through the cookie banner; the aggregated reports we then rely on under legitimate interests in improving the site and our services.
• Measuring and targeting our own advertising. Advertising and remarketing data. Basis: consent, given through the cookie banner.
• Running and securing the site. Server logs. Basis: legitimate interests in security and reliability.
• Publishing our own content to TikTok. Authorisation tokens for our own accounts. Basis: legitimate interests in promoting our work.
• Telling you about our work, if you ask us to. Email address. Basis: consent. We do not send marketing emails to anyone who has not opted in; if we start a newsletter, every email will carry an unsubscribe link.

Where we rely on legitimate interests we have weighed them against your rights and interests and are satisfied they are not overridden. You can ask us for that assessment. We do not use your data for automated decision-making that has legal or similarly significant effects on you.

5. How long we keep it

• Enquiries and messages: up to 24 months after our last contact, unless the enquiry becomes a project, in which case the client retention below applies.
• Client and supplier records: for the life of the relationship and 6 years after the end of the tax year in which it ends, as required for accounting and limitation purposes.
• Applications: 12 months after the application closes, so we can get back in touch about similar roles. Ask us and we will delete it sooner.
• Analytics data: Google Analytics event data is kept for a maximum of 14 months, then only in aggregate reports that cannot identify you. Session replay recordings, where used, for no more than 12 months.
• Advertising audiences: for the shortest period the platform offers, and never more than 18 months from your visit.
• Cookie choice: your consent choice is stored for 12 months, after which we ask again.
• Server logs: kept by our host for a short rolling period, measured in days.
• TikTok authorisation tokens: until they expire, are revoked, or we stop using the integration, whichever is first.

6. Security

We use access controls, encryption in transit, and limit who in the team can see what, in proportion to the sensitivity of the data. No transfer over the internet is completely secure, so we cannot guarantee the security of data you send us before it reaches us.

7. Cookies and similar technologies

We follow the Privacy and Electronic Communications Regulations (PECR). Strictly necessary cookies and storage run without consent because the site does not work properly without them. Everything else waits until you choose Accept all in the banner, which covers both analytics and advertising cookies. Reject non-essential is presented with equal prominence and is remembered just the same.

Strictly necessary

• zko-cookie-consent, set by zko.world in your browser's local storage. Remembers whether you accepted or rejected non-essential cookies. Lasts 12 months.
• _GRECAPTCHA, set by Google reCAPTCHA (google.com). Spam and abuse protection on the contact and careers forms, loaded only when you start using a form. Lasts 6 months.

Analytics

• _ga, set by Google Analytics. Distinguishes visitors. Lasts 2 years.
• _ga_KZ2H0JSWPV, set by Google Analytics. Keeps track of a visit (session) for our property. Lasts 2 years.

Advertising

None at the moment. If we add Google Ads, Meta, LinkedIn or TikTok tags (section 3) they will be listed here with their cookie names and lifetimes, and the banner will ask for your consent again.

Where the site embeds a video from YouTube or Vimeo, we use the providers' privacy-enhanced modes (youtube-nocookie.com and Vimeo's do-not-track setting), and the player only loads when you choose to play a video. Those providers may still set cookies needed to play it, under their own policies.

To change your choice, use Cookie Settings in the footer of any page. If you withdraw consent, Google Analytics stops immediately and we expire the cookies it set. You can also delete or block cookies in your browser settings, although blocking strictly necessary ones may stop the forms working. For Google's own controls see Google's ads settings and the Google Analytics opt-out add-on.

8. Who we share it with

We do not sell personal data. We share it only with the people who help us run the business:

• Google LLC: Google Analytics (with your consent), reCAPTCHA, and Google Ads where we use it. Google's privacy policy is at policies.google.com/privacy.
• Advertising platforms we may use, with your consent: Meta Platforms, LinkedIn and TikTok, each under its own privacy policy, and only once their tags are listed in section 7.
• Analytics tools we may use, with your consent: Microsoft (Clarity) or Hotjar, under their own privacy policies.
• Resend, Inc.: delivers the emails generated by our contact and careers forms.
• Vercel, Inc.: hosts this website and our content management system, and keeps the server logs described above.
• YouTube (Google) and Vimeo: only if you play an embedded video.
• TikTok: only in the form of our own accounts' authorisation tokens and the content we publish to them (section 11).
• Professional advisers such as our accountants, insurers and lawyers, where needed.
• Partner creatives and agencies who work with us on a project, strictly to the extent a brief requires, and under confidentiality terms.
• Regulators, courts and law enforcement where the law requires it.

9. International transfers

Some of the providers above process data in the United States. Where personal data leaves the UK we rely on one of the safeguards recognised by UK GDPR: the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge) where a provider is certified, or the International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses. We also work with clients outside the UK; where we transfer their personal data we use the same safeguards.

10. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you, and get a copy of it.
• Rectification of anything inaccurate or incomplete.
• Erasure, where we no longer need the data or you withdraw consent.
• Restriction of processing while a question about it is resolved.
• Object to processing based on legitimate interests, and to any direct marketing.
• Portability of data you gave us, in a machine-readable format.
• Withdraw consent at any time, where consent is our basis. Withdrawing it does not affect processing that happened before.

To exercise any of these, email hello@zko.world. There is no fee. We will respond within one month, and may ask you to confirm your identity first. If a request is complex we may take up to two further months and will tell you why.

11. Our TikTok integration

We connect to the TikTok Content Posting API solely to publish video content we produce to TikTok accounts owned and operated by ZKO Creative. The integration is internal and first-party. In practice that means:

• We store the authorisation tokens TikTok issues for those accounts, and the minimum metadata needed to upload a video and confirm it published. Nothing else.
• We do not collect, access or process data from TikTok users or the public: no viewer data, no follower lists, no comments, no profile information, no engagement data beyond what TikTok shows us as the account owner.
• We do not use the API on behalf of clients or any other third party.
• Tokens are stored encrypted with access limited to the people who run our publishing, and are deleted when revoked or no longer needed.

Our full statement on the integration is in the TikTok API Terms tab. TikTok's own handling of data on its platform is governed by TikTok's privacy policy.

12. Complaints

If you are unhappy with how we have handled your data, tell us first and we will try to put it right. You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline 0303 123 1113. Online at ico.org.uk/make-a-complaint.

If you are outside the UK you may also complain to the data protection authority where you live.

13. Changes to this policy

We will update this policy when our practices or the law change, and the date at the top will move. Where a change is significant we will say so on the site. This page is the current version.