1. In summary
- We collect only what we need to run this site, answer applications and deliver client work.
- We do not sell personal information and we do not build advertising profiles from your visit.
- Optional analytics and marketing cookies stay off until you turn them on.
- We honour Global Privacy Control (GPC) signals automatically.
2. Information we collect
We collect three categories of information:
- Information you give us — name, work email, company, website, business type, platforms, ad spend range, budget range and the challenge you describe, submitted through /apply.
- Information from a client engagement — account access, brand assets, analytics data and correspondence needed to deliver the services.
- Technical information — device and browser type, approximate region derived from IP, pages viewed, referring URL, timestamps, and consent preferences. Server logs are retained for security and fault diagnosis.
3. How we use it
- To assess applications and respond within 2 business days.
- To contract, invoice and deliver services (payment data is handled by Stripe; we never store full card numbers).
- To operate, secure and improve this website.
- To meet legal obligations and enforce our agreements.
- To send service messages, and — only where you opted in — occasional updates you can unsubscribe from at any time.
4. Legal bases
Where the GDPR or UK GDPR applies, we rely on: consent for optional cookies and marketing messages; steps necessary to take before entering a contract for your application; performance of a contract for client engagements; legitimate interests for site security, aggregation analytics and responding to enquiries, balanced against your rights; and legal obligation where records must be kept.
7. Retention
- Applications that do not proceed: 12 months from the last contact, then deleted or anonymised.
- Client records and delivery files: for the engagement plus 24 months, to meet tax, accounting and dispute requirements.
- Server logs: 90 days.
- Consent records: as long as needed to demonstrate compliance.
8. Your rights
Depending on your location, you may request access, correction, deletion, portability, restriction or objection to processing, and you may withdraw consent at any time without affecting earlier processing.
You may also complain to your local supervisory authority. In the United States, residents of certain states may have additional rights to know, delete or opt out of sale or sharing — we do not sell or share personal information as those terms are defined.
To exercise a right, email privacy@ofkofficial.com. We respond within 30 days and may ask for verification of identity.
9. Security
We use access controls, least-privilege account provisioning, encrypted transport, mutual NDAs with the team, and documented handling for client credentials. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you and the relevant authority within the timeframes required by law.
10. International transfers
We are based in the United States and process data there. Where data moves across borders, we rely on appropriate safeguards such as standard contractual clauses, and we can provide details on request.
11. Children
This site and our services are directed at businesses and are not directed at children under 16. We do not knowingly collect information from children.
12. Contact
Privacy enquiries: privacy@ofkofficial.com. Data controller: ZENITHIA LLC, New Mexico, USA. General enquiries: hello@ofkofficial.com.
Questions about this document? Write to legal@ofkofficial.com and we will respond in writing.
Apply for a Growth Audit