Privacy
Policy

Section 01

Overview

At 69 Kelvin, we take privacy seriously - not just as a legal obligation, but as a core value. We are a lean B2B SaaS growth studio. We do not sell your data. We do not build advertising profiles. We do not share your information with third parties except where operationally necessary to deliver our services or required by law.

This policy is written in plain language wherever possible. Where legal or technical terms are necessary, we explain them. If you ever have a question that this document does not answer clearly, you are encouraged to contact us directly.

By using our website or engaging our services, you consent to the data practices described in this Privacy Policy. If you do not agree with any part of this policy, please discontinue use of our website & services & contact us to discuss alternatives.

Section 02

Who We Are

The data controller responsible for your personal information is:

As the data controller, we determine the purposes & means of processing your personal data. In cases where we process data on behalf of our Clients (e.g., when setting up GA4 or GTM for a Client's website visitors), we act as a data processor on their behalf. The Client is the data controller for their end-users' data in those scenarios.

Section 03

Data We Collect

We collect the minimum amount of personal data necessary to operate our business & deliver our services. The categories of data we may collect include:

A. Identification & Contact Data

• Full name & preferred name
• Business email address
• Company name, role/title & website URL
• Phone number (only if provided voluntarily)
• LinkedIn or social media profile URLs (if provided)

B. Project & Business Data

• SaaS product description, target audience & current growth metrics
• Current marketing stack & tools in use
• Project goals, timelines & budget range
• Intake form responses & scoping call notes
• Files, assets & materials you upload or share with us

C. Communication Data

• Email correspondence, including attachments
• Meeting recordings & transcripts (only where you have given explicit consent)
• Feedback, revision requests & approval communications

D. Financial Data

• Invoice records & payment confirmation references
• We do not store full credit card numbers or bank account details - payment processing is handled by PCI-DSS compliant third-party processors (see Section 08).

E. Technical & Usage Data

• IP address & approximate geolocation (country/city level)
• Browser type, version & operating system
• Pages visited, time on site & navigation paths on our website
• Referral source (how you found our website)
• Device type & screen resolution

Section 04

How We Collect Data

We collect personal data through the following channels:

• Direct Submission: When you fill out our intake form, contact form, or any other form on our website, or when you email, message, or call us directly.
• Engagement Process: During scoping calls, Sprint onboarding, Deliverable reviews & handoff communications.
• Automated Collection: Through cookies, pixels & analytics tools as you browse our website (see Section 09 for full details).
• Third-Party Sources: Occasionally, we may receive information about prospective clients from referral partners, LinkedIn, or public professional directories. We only use this data to reach out once with a relevant message; if there is no interest expressed, the data is deleted.

Section 05

How We Use Your Data

We use the personal data we collect for the following specific purposes:

• Service Delivery: To execute Sprint engagements, communicate about project progress, deliver Deliverables & provide post-Sprint support as agreed.
• Onboarding & Scoping: To understand your business needs, assess project fit, prepare proposals & structure the correct SOW.
• Billing & Payments: To issue invoices, process payments & maintain accurate financial records as required by law.
• Legal & Contractual Compliance: To enforce our Terms & Conditions, manage disputes & comply with applicable laws & regulations.
• Website Analytics: To understand how visitors use our website so we can improve content, performance & user experience. All analytics data is processed in aggregate wherever possible.
• Marketing Communications: To send relevant updates, case studies, or service announcements to Clients & prospects who have opted in. You may unsubscribe at any time.
• Portfolio & Case Studies: To document project outcomes & create anonymized or attributed case studies & portfolio entries, subject to the portfolio rights outlined in our Terms & Conditions.
• Internal Operations: For record-keeping, team coordination, quality improvement & business development purposes within 69 Kelvin.

We will never use your data for purposes that are incompatible with the purposes listed above without your prior consent.

Section 06

Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), United Kingdom, or other jurisdictions where GDPR or equivalent legislation applies, we process your personal data on the following legal bases:

• Contract Performance (Art. 6(1)(b) GDPR): Processing is necessary to fulfill our obligations under the engagement agreement - specifically to deliver the Services you have contracted.
• Legitimate Interests (Art. 6(1)(f) GDPR): We process data for our legitimate business interests including improving our services, maintaining security, preventing fraud & reaching out to prospective clients through non-intrusive B2B communications. We have assessed that these interests are not overridden by your rights.
• Legal Obligation (Art. 6(1)(c) GDPR): Certain processing is required to comply with our legal obligations, such as tax record-keeping & responding to lawful requests from authorities.
• Consent (Art. 6(1)(a) GDPR): Where we rely on consent - such as for marketing emails or the use of non-essential cookies - we will obtain your explicit consent & you may withdraw it at any time without penalty.

Section 07

Data Sharing & Disclosure

We do not sell your personal data. Period.

We may share your personal data only in the following limited circumstances:

• Within Our Team: Your project data is shared with the 69 Kelvin team members who are actively working on your Sprint. Access is role-based & limited to what each team member needs.
• Trusted Service Providers: We share data with a small number of vetted third-party service providers who help us operate our business (see Section 08). These providers are bound by data processing agreements & are prohibited from using your data for their own purposes.
• Legal Requirements: We may disclose your information when required by applicable law, court order, subpoena, or governmental or regulatory authority. We will notify you of such requests unless legally prohibited from doing so.
• Business Transfers: In the event of a merger, acquisition, or sale of substantially all of our assets, your data may be transferred to the acquiring entity. We will notify you via email and/or a prominent notice on our website at least 30 days prior to such a transfer & give you the opportunity to request deletion of your data.
• With Your Consent: We may share data in other ways with your explicit prior consent.

Section 08

Third-Party Services We Use

To operate effectively, 69 Kelvin uses the following categories of third-party services. Each is carefully selected for data security & compliance standards:

• Payment Processing: Stripe - PCI-DSS Level 1 certified. Stripe processes payment card data directly & we never see or store your full card number. Stripe's privacy policy governs their data handling.
• Email & Communication: Gmail / Google Workspace - Used for project communication. Google's enterprise data processing terms apply.
• Project Management: Notion / Linear - Used internally for project tracking. Client data is kept in locked, access-restricted workspaces.
• Video Calls: Google Meet / Zoom - Used for scoping & review calls. Recordings are only made with explicit consent & are deleted within 90 days of Sprint completion.
• File Sharing: Google Drive - Used for secure delivery of Deliverables & exchange of Client Content. Access is restricted to you & the 69 Kelvin team.
• Analytics (Our Website): Google Analytics 4 - Used to understand website traffic. We have configured GA4 with IP anonymization enabled & data retention set to 14 months.
• Hosting: Vercel / Netlify - Our website & some Deliverables may be hosted on these platforms. Both operate under SOC 2 Type II compliance.

We periodically audit our third-party vendors for compliance & reserve the right to change providers, in which case this section will be updated.

Section 09

Cookies & Tracking Technologies

Our website uses cookies & similar tracking technologies to improve your browsing experience & to help us understand how visitors use our site. Here is a breakdown of what we use & why:

Essential Cookies

These cookies are strictly necessary for the website to function. They cannot be disabled. They do not collect personally identifiable information.

• Session management
• Security & CSRF protection
• Load balancing

Analytics Cookies

We use Google Analytics 4 to collect anonymized usage data. These cookies help us understand page performance, traffic sources & visitor behavior in aggregate. They are only active if you consent via our cookie banner.

Performance Cookies

These cookies help us improve the speed & rendering performance of our website by understanding which browsers & devices visit most frequently.

Your Cookie Choices

On your first visit, you will be presented with a cookie consent banner. You may accept all cookies, reject non-essential cookies, or manage individual preferences. You can update your cookie preferences at any time by clicking the "Cookie Settings" link in the footer. You may also clear cookies through your browser settings at any time, though this may affect website functionality.

Section 10

Data Retention

We retain personal data only as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

• Active Client Data: Retained for the duration of the engagement plus 2 years thereafter, to handle any post-Sprint support, warranty claims, or disputes.
• Financial Records: Retained for 7 years from the invoice date to comply with US tax & accounting obligations.
• Prospect / Inquiry Data: If an inquiry does not result in an engagement, contact information is retained for 12 months for legitimate follow-up. After 12 months, it is securely deleted unless you have opted into marketing communications.
• Marketing Email Lists: Retained until you unsubscribe or request deletion.
• Website Analytics Data: Anonymized aggregate data may be retained indefinitely. IP-linked session data is retained for 14 months in GA4.
• Deliverable Files: Project files are retained on our systems for 90 days after Sprint completion to facilitate any urgent handoff needs. After 90 days, files are deleted from our internal systems. It is the Client's responsibility to maintain their own copies.

When data reaches the end of its retention period, it is securely deleted or anonymized using industry-standard methods.

Section 11

Security Measures

We implement appropriate technical & organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Access Controls: Role-based access within our team; only those who need access to specific Client data have it.
• Encryption in Transit: All data transmitted between your browser & our website is encrypted using TLS 1.2 or higher (HTTPS).
• Encryption at Rest: Sensitive project data & financial records are stored on encrypted drives & cloud services.
• Two-Factor Authentication: All 69 Kelvin team members are required to use two-factor authentication on all business-critical platforms.
• Vendor Due Diligence: We only engage third-party processors who maintain industry-recognized security certifications (SOC 2, ISO 27001, PCI-DSS where applicable).
• Incident Response: In the unlikely event of a data breach that affects your personal data, we will notify you within 72 hours of becoming aware of the breach (as required under GDPR Art. 33-34) & will communicate the nature of the breach, the data affected & the steps taken to mitigate harm.

Section 12

Your Rights

Depending on your location, you may have the following rights regarding your personal data. We honor all legally applicable rights without exception:

Rights Under GDPR (EEA & UK Users)

• Right of Access (Art. 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data.
• Right to Erasure / "Right to be Forgotten" (Art. 17): Request deletion of your personal data where it is no longer necessary, consent is withdrawn, or there is no overriding legal basis for retention.
• Right to Restrict Processing (Art. 18): Request that we limit how we use your data in certain circumstances.
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format to transfer to another controller.
• Right to Object (Art. 21): Object to processing based on legitimate interests or direct marketing at any time.
• Right to Withdraw Consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

Rights Under CCPA / CPRA (California Residents)

• Right to Know: Request disclosure of the categories & specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete: Request deletion of your personal information, subject to certain legal exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioral advertising. This right is therefore always honored by default.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

How to Exercise Your Rights

To exercise any of the rights above, contact us at privacy@69kelvin.com. We will respond within 30 days (or sooner where required by law). We may need to verify your identity before processing the request. There is no fee for exercising your rights unless the request is manifestly unfounded or excessive.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK, or the relevant EU supervisory authority).

Section 13

International Data Transfers

69 Kelvin operates with team members in the United States & India. As such, your personal data may be transferred to & processed in countries outside your home jurisdiction, including countries that may have different data protection standards.

For transfers of personal data from the EEA or UK to countries not deemed "adequate" by the European Commission, we rely on the following safeguards:

• Standard Contractual Clauses (SCCs) approved by the European Commission for transfers to our service providers;
• The EU-US Data Privacy Framework where applicable;
• Binding Corporate Policies or equivalent safeguards for transfers to countries without adequacy decisions.

You may request details of the specific safeguards in place for any international transfer by contacting us at privacy@69kelvin.com.

Section 14

Children's Privacy

69 Kelvin's services are directed exclusively at businesses & professional individuals. Our website & services are not intended for, nor directed at, children under the age of 16 (or the applicable age of digital consent in your jurisdiction).

We do not knowingly collect personal data from children. If you believe that we have inadvertently collected information from a child under the applicable age of consent, please contact us immediately at privacy@69kelvin.com & we will take immediate steps to delete such information from our records.

Section 15

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page;
• Display a prominent notice on our website for at least 30 days;
• Send an email notification to active Clients where the change materially affects how we process their data.

We encourage you to review this page periodically. Your continued use of our website or services following any changes constitutes your acceptance of the updated Privacy Policy.

Section 16

Contact & Data Requests

For all privacy-related inquiries, data subject requests, or concerns about this Privacy Policy, please reach out to us. We treat all privacy communications with the utmost urgency & confidentiality.

Response time: Within 5 business days for general inquiries, within 72 hours for breach notifications & within 30 days for formal data subject requests.