Privacy Policy & AVG Compliance

1. Scope and Purpose

Shugar Media B.V. (“Shugar Media”, “we”, “us”, or “our”) operates as a premier performance marketing agency and adtech software developer headquartered in Amsterdam, Netherlands. We respect your privacy and are committed to protecting personal data in strict compliance with the European General Data Protection Regulation (Regulation (EU) 2016/679 - GDPR) and the Dutch GDPR Implementation Act (Uitvoeringswet Algemene verordening gegevensbescherming - UAVG).

This Privacy Statement governs the processing of personal data collected via our website (shugar-media.digital), our client intelligence suite (Shugar Engine™), and during our execution of performance media buying services involving the TikTok Marketing API and TikTok Events API (Conversions API).

2. Categories of Personal Data We Process

Depending on your interaction with us, we process the following categories of data:

• Client Representative & Commercial Contacts: Full name, professional email address, corporate telephone number, job title, company name, billing details, and contract communication history.
• Inquiry & Intake Data: Monthly ad spend parameters, target markets, creative requirements, and business goals submitted via our project intake forms.
• AdTech Telemetry & Attribution Signals: When clients integrate their TikTok Business Center with Shugar Engine™, we process advertising performance metrics, campaign IDs, adset IDs, click identifiers (ttclid), and pseudonymised conversion event data (SHA-256 hashed email or phone numbers transmitted via server-to-server Conversions API) strictly for measurement and optimization.
• Technical Website Telemetry: Anonymized IP addresses, browser user-agent, device screen resolution, referring URLs, and essential security tokens.

3. Legal Bases for Processing (Article 6 GDPR)

We process personal data strictly under one or more lawful bases set forth in Article 6(1) GDPR:

4. TikTok Marketing API & Data Processing Roles

Shugar Media integrates with the official TikTok for Business Marketing API (v1.3) via OAuth 2.0 PKCE authentication. In relation to client advertising accounts:

• Data Controller vs. Processor: Our client brand retains primary Data Controller status for its customer audience data. Shugar Media acts as a Data Processor under a signed Data Processing Agreement (DPA) compliant with Article 28 GDPR.
• Pseudonymisation at Rest: All customer matching signals (such as phone numbers or email addresses used for TikTok Custom Audiences or Server CAPI event dispatching) are hashed on client-side or agency edge servers with irreversibly encrypted SHA-256 protocols before transmission. Raw, plain-text PII is never stored in Shugar Engine™ databases.
• Strict Placement Isolation: Our deployment routines enforce TikTok-only placements (PLACEMENT_TIKTOK) and explicitly disable Pangle and external publisher networks, preventing cross-network data leakage to untrusted third parties.

5. International Data Transfers & Sub-Processors

Where personal data is transferred outside the European Economic Area (EEA), Shugar Media ensures that appropriate safeguards are in place in accordance with Chapter V of the GDPR:

6. Data Retention Policies

We do not retain personal data longer than necessary for the purposes for which it was collected:

• Active Client Contracts & Commercial Communications: Retained for the duration of the commercial engagement plus 5 years to defend against potential legal claims.
• Financial & Tax Invoicing Records: Retained for exactly 7 years pursuant to Article 52 of the Dutch State Tax Act (Algemene wet inzake rijksbelastingen).
• TikTok Marketing API Attributed Telemetry: Stored on a rolling 90-day retention schedule, after which aggregated campaign totals are preserved without individual click IDs.
• Project Intake Inquiries: Non-converting prospect data is purged automatically after 180 days.

7. Your Rights under the GDPR (Articles 15–22)

As a European data subject, you hold comprehensive rights regarding your personal data:

To exercise any of these rights, email our Data Protection Officer at privacy@shugar-media.digital. Under Dutch law, we will respond within 30 days. You also maintain the right to lodge a complaint directly with the Dutch supervisory authority:

8. Security Safeguards (Article 32 GDPR)

Shugar Media employs stringent technical and organizational security protocols:

• Mandatory TLS 1.3 encryption in transit for all HTTPS and API calls.
• AES-256 encryption at rest for database volumes and credential vaults.
• Hardware security keys (FIDO2 / WebAuthn) for internal administrative dashboard access.
• Automated hourly secret rotation for TikTok Marketing API OAuth refresh tokens.
• Zero-trust network architecture isolating development and production client environments.