1. Who we are

KK ("we", "us", "the site") is the multilingual crypto education publisher that operates kkinvesting.io. For the purposes of the EU and UK GDPR, the operator of this site is the Data Controller. For questions or requests related to your personal data, email [email protected].

2. Data we collect

We receive personal data in three ways:

• Automatically (technical data): IP address, browser type and version, operating system, access time, session duration, pages viewed, referrer, and screen resolution. This is collected through server logs, Google Analytics 4, and Cloudflare Web Analytics.
• Cookies and local storage: used for language preferences (Polylang), consent state, traffic analytics, and affiliate-link attribution (see Section 6).
• Data you provide voluntarily: your name, email address, and message content when you contact us by email or a form on the site; your email address when you subscribe to our newsletter.

We do not collect credit card or bank account numbers, crypto wallet private keys or seed phrases, or scans of passports or government-issued IDs. Any message that asks you to send us data like that is not from KK — please report it to [email protected].

3. How we use your data

• To serve the site and its localized language versions
• To analyze traffic and user behavior so we can improve content and UX
• To reply to your emails and inquiries
• To send you the newsletter you subscribed to (every email carries an unsubscribe link)
• To detect and prevent abuse, spam, fraud, and automated scraping
• To comply with legal obligations, including lawful requests from regulators and courts
• To disclose, where required, our affiliate relationships — consistent with the FTC’s guidance at 16 CFR Part 255

We do not sell your personal information for money. We do not use your personal data to train AI models. We do not engage in cross-context behavioral advertising outside of standard affiliate-link attribution.

4. Legal basis (GDPR / UK GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your personal data under Article 6 of the GDPR (and its UK equivalent) on the following bases:

• Consent (Art. 6(1)(a)): analytics and advertising cookies, newsletter subscriptions. You can withdraw consent at any time through our cookie banner or by emailing us.
• Legitimate interests (Art. 6(1)(f)): site security, fraud and abuse prevention, basic aggregated traffic analysis, and technical logging.
• Performance of a contract (Art. 6(1)(b)): responding to questions or partnership inquiries you send us.
• Legal obligation (Art. 6(1)(c)): responding to lawful requests from competent authorities.

5. Third-party processors and sharing

We work with the following third-party processors, each bound by its own privacy commitments and acting only on our documented instructions:

• Google Analytics 4 (Google LLC): traffic analytics, with IP anonymization enabled.
• Cloudflare, Inc.: CDN, DDoS protection, and Web Analytics.
• WordPress / Automattic: site hosting and infrastructure.
• Crypto brand affiliate programs: when you click an affiliate link and register, the partner receives attribution data (typically an anonymous click ID). They do not receive any data you submitted to our forms or newsletter.

We do not share your contact details or newsletter list with our affiliate partners.

6. Cookies and similar technologies

• Strictly necessary cookies: required for core site features such as the Polylang language switcher and recording your cookie consent. These cannot be disabled.
• Analytics cookies: Google Analytics 4 and Cloudflare Web Analytics. Enabled only after you opt in.
• Preference cookies: remember your dark-mode choice, font size, and similar UI preferences.
• Affiliate / attribution cookies: first-party click tracking for affiliate links. Disabling these does not block the sign-up; it just means we can’t be credited for the referral.

You can manage cookies through your browser settings, our consent banner (shown on your first visit and reachable again from the site footer), or Global Privacy Control (GPC) / Do Not Track (DNT) signals from your browser or OS. We honor GPC as a valid opt-out signal under CCPA/CPRA. Turning off analytics or preference cookies won’t stop you from reading the site, but some features (like remembering your language) may need to be set again each visit.

7. International data transfers

Our servers and some third-party processors are located in the United States, the European Union, and the Asia-Pacific region. Where we transfer personal data out of the EEA or UK to a country that has not been granted an adequacy decision by the European Commission or the UK ICO, we rely on the European Commission’s 2021 Standard Contractual Clauses (SCCs) or the UK’s International Data Transfer Addendum, supplemented by case-by-case transfer-impact assessments where required. You can email [email protected] for a copy of the relevant clauses.

8. Data retention

• Server access logs: 14 days
• Google Analytics 4 user and event data: 14 months
• Support and reader correspondence: 24 months after the matter is resolved, for customer-service continuity
• Newsletter subscription records: until you unsubscribe; after unsubscribing we keep a suppression record indefinitely so we can honor your opt-out, as required by US CAN-SPAM and UK PECR

9. Your rights

GDPR (EU / UK / Switzerland): you have the right to access your personal data, correct inaccurate data, request erasure, restrict or object to processing, port your data to another provider, withdraw consent where processing is based on consent, refuse purely automated decision-making, and lodge a complaint with your national supervisory authority (for example, the UK ICO or, for EU-wide matters, Ireland’s DPC).

CCPA / CPRA (California residents): you have the right to know what personal information we collect and how we use it, to correct inaccurate data, to delete personal information, to opt out of "sale" and "sharing" for cross-context behavioral advertising, to limit the use and disclosure of Sensitive Personal Information, and to not be discriminated against for exercising these rights. California residents can also exercise rights under the "Shine the Light" law (California Civil Code Section 1798.83). Minors under 16 are subject to opt-in rules. See Section 10 for how to submit a "Do Not Sell or Share" request.

PIPEDA (Canada): you have the right to access your personal information held by us, request correction, and withdraw consent subject to legal and contractual restrictions.

Australia (Privacy Act 1988 / APP): you have the right to access and correct your personal information as set out in Australian Privacy Principles 12 and 13.

To exercise any of these rights, email [email protected]. We reply within 30 days; complex requests may be extended once by a further 60 days, and we will tell you in advance if that applies. We do not charge a fee unless your request is manifestly unfounded or excessive.

10. Do Not Sell or Share My Personal Information (California)

We do not sell your personal information for money. We may, however, "share" certain identifiers (such as cookie IDs and affiliate click IDs) with analytics and advertising partners in ways that qualify as "sharing" under the CPRA. If you are a California resident and want to opt out of this sharing, you have two options:

• Turn on Global Privacy Control (GPC) in your browser. We honor GPC as a valid CCPA/CPRA opt-out signal at the device level.
• Email us at [email protected] with the subject line "Do Not Sell or Share — California". Include the email address or cookie ID you use on the site so we can apply the opt-out.

You may also authorize an agent to submit this request on your behalf, subject to verification in line with CCPA/CPRA regulations. We will not discriminate against you in any way for exercising this right.

11. Children’s privacy

The site is intended for adults (18 and older). We do not knowingly collect personal information from children under 16 in the EEA/UK, under 13 in the United States (per the Children’s Online Privacy Protection Act, COPPA), or under the applicable age of consent in any other jurisdiction. If you are a parent or guardian and believe your child has provided data to us, contact [email protected] and we will delete it within 72 hours.

12. Data security

We use reasonable technical and organizational safeguards: site-wide HTTPS with TLS 1.3, Cloudflare WAF, two-factor authentication on admin accounts, least-privilege access, encrypted backups, and periodic penetration testing. No system is ever perfectly secure; in the event of a personal-data breach, we will notify the competent supervisory authority within 72 hours as required by GDPR Art. 33, and notify affected users directly where the breach is likely to result in a high risk to their rights and freedoms.

13. Changes to this policy

We may update this policy from time to time to reflect changes in the law, in the services we use, or in our own practices. Material changes will be flagged at the top of this page with a new "Last updated" date, and we will announce them on the homepage or in the newsletter. We recommend reviewing the policy at least once a year.

14. Contact us and our DPO

Questions about this policy, requests to exercise your rights, or reports of a suspected privacy incident:

• General privacy questions: [email protected]
• Data Protection Officer (DPO): [email protected]
• General editorial contact: Contact page