Privacy Policy & Data Protection Declaration

1. Data Controller Identification

This statement details how the Pin Engine acts as a Data Controller and Data Processor in accordance with Section 2 of the Data Protection Act (No. 24 of 2019, Laws of Kenya) and Article 4(7) of the EU General Data Protection Regulation (GDPR).

2. Categories of Data Processed

The application strictly collects and processes technical metadata necessary to fulfill image syndication operations:

• Media Metadata: File size, image dimensions, MIME types, and randomized cryptographic storage filenames.
• Syndication Attributes: Pinterest board names, subsection labels, campaign UTM destination links, titles, descriptions, and keyword tags.
• Technical Telemetry: IP addresses, user agent headers, and request timestamps recorded strictly for rate limiting (ThrottleFilter) and diagnostic security logging (Section 25, KDPA 2019).

3. Legal Basis for Processing

Processing is carried out under the following legal bases:

• Contractual Performance (Section 30(1)(b), KDPA; Art. 6(1)(b), GDPR): Processing is mandatory to generate valid RSS 2.0 XML feeds and RFC 4180 CSV exports requested by the user.
• Legitimate Interests (Section 30(1)(c), KDPA; Art. 6(1)(f), GDPR): IP auditing and rate limiting to defend server infrastructure from brute-force attacks and resource exhaustion.

4. Cross-Border Data Transfers & Public Syndication

Media assets stored in the public directory (/public/uploads/pins/) are publicly accessible by design to permit Pinterest crawlers (operating from international cloud infrastructure in the United States and globally) to retrieve and publish images. Pursuant to Section 48 and 49 of the Kenya Data Protection Act, you explicitly consent to the cross-border syndication of your uploaded image assets to third-party distribution nodes.

5. Data Retention & Erasure (The Unlink Standard)

In accordance with Part 8 of the Architectural Standard:

• Transient upload packages (temporary extraction directories) are permanently purged immediately after database ingestion.
• Archived pin sets trigger a soft-delete lifecycle; upon permanent deletion, associated media files are removed from the filesystem using atomic unlink routines.

6. Your Rights as a Data Subject

Under Part IV of the Kenya Data Protection Act 2019 and Chapter III of the GDPR, you possess the right to:

• Access all pin sets, item records, and metadata linked to your profile.
• Request rectification of inaccurate item titles, links, or keywords.
• Request complete erasure of your media assets and associated feeds.
• Lodge a complaint with the Office of the Data Protection Commissioner of Kenya (ODPC) at [email protected] or your applicable EU Supervisory Authority.