Privacy Notice

1. Who we are

The Folk Agency ("we", "us") is a performance marketing agency that buys and manages advertising for ecommerce brands. We are the controller of the personal data described in this notice. You can reach us at privacy@thefolkagency.com for any question about this document.

We handle personal data under the Brazilian General Data Protection Law (Law 13.709/2018, the LGPD) and, where we serve people in the European Economic Area or the United Kingdom, under the General Data Protection Regulation (Regulation 2016/679, the GDPR).

2. Data we collect

We collect three groups of data.

• Data you give us directly: name, work email address, company name, monthly advertising budget, and whatever you write in a brief or a message.
• Data we generate while working for a client: business contact details, campaign notes, meeting records and correspondence.
• Data collected automatically when you visit this site: IP address, browser and device type, referring page, pages viewed, and the date and time of the visit.

We do not ask for special category data, and we ask that you do not send it to us. We do not buy contact lists and we do not build profiles of visitors for resale.

3. Why we process it

We process personal data for these purposes and on these legal bases.

• To answer an enquiry and prepare a proposal: our legitimate interest in running our business, and steps taken at your request before a contract.
• To deliver services under a signed agreement: performance of a contract.
• To invoice, collect and keep accounting records: performance of a contract and compliance with legal obligations.
• To measure and improve this website: our legitimate interest in keeping the site functional and understandable.
• To send service updates and, where you have opted in, marketing messages: consent, which you can withdraw at any time.

When we rely on legitimate interest, we balance that interest against your rights and expectations. You can ask us for a summary of that assessment at any time.

4. Cookies and analytics

This website works without advertising or profiling cookies. If we use a cookie, it is a functional or statistical cookie that keeps the site running or tells us how many people read a page. Where the law requires consent, we ask for it before the cookie is set, and you can refuse without losing access to any part of the site.

Your browser settings let you block or delete cookies. Blocking functional cookies may change how the site behaves.

5. Who we share it with

We share personal data only where it is needed to run the service. The categories of recipient are: hosting and email providers, advertising platforms that serve our clients' campaigns, analytics providers, accountants and legal advisers, and public authorities where the law requires a response.

Advertising platforms such as Meta, Google, TikTok, Taboola, Outbrain and RevContent process campaign data under their own terms when they serve ads. We do not sell personal data, and we do not share it for third party marketing.

6. International transfers

Some providers we use store data outside Brazil. When that happens, we rely on a transfer mechanism recognised by the LGPD, such as standard contractual clauses or an adequacy decision, and on the equivalent safeguards required by the GDPR for transfers out of the European Economic Area. You can ask which mechanism applies to a specific provider.

7. How long we keep it

Enquiries that do not turn into a client relationship are deleted 24 months after the last contact. Contract, billing and campaign records are kept for the period required by Brazilian tax and civil law, and in any case no longer than five years after the end of the relationship, unless a dispute or a legal obligation requires a longer period.

8. Your rights

Under the LGPD and the GDPR you can ask us to confirm whether we process your data, to give you access to it, to correct it, to anonymise, block or delete data that is unnecessary or excessive, to port it to another provider, to delete data processed with your consent, and to tell you who we have shared it with. You can also object to processing based on legitimate interest and ask for a review of automated decisions.

Write to privacy@thefolkagency.com and we answer within 15 days for LGPD requests and within one month for GDPR requests. If you are not satisfied, you can complain to the Brazilian National Data Protection Authority (ANPD) or to your local supervisory authority in the European Economic Area or the United Kingdom.

9. Security

We use access controls, encrypted connections, and short retention periods to protect personal data. Access is limited to the people who need it for the work described above. If a breach creates a risk to your rights, we notify the competent authority and the people affected as the law requires.

10. Children

Our services are aimed at businesses, and this site is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has sent us data, write to us and we delete it.

11. Changes to this notice

We update this notice when our tools or the law change. The date at the top of the page always shows the current version. Material changes are announced to clients by email before they take effect.

12. Contact

Data protection questions: privacy@thefolkagency.com. General enquiries: hello@thefolkagency.com.