Koko Agency values the privacy of its visitors, leads, and clients. This policy describes how we collect, use, and protect personal data in compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and the Personal Information Protection Act (PIPA) of British Columbia.
1. Who we are (Controller)
Koko Agency, with offices in New Westminster, British Columbia, Canada. Responsible for handling data collected by this site: lucas@kokoagency.ca.
2. What data we collect
We only collect what is necessary to provide our services and improve the experience:
| Category | Examples | When |
|---|---|---|
| Contact data | First name, last name, email, phone, company | Contact form / newsletter |
| Browsing data | IP address, user-agent, referrer page, visited URL | Automatically when accessing the site |
| Conversion data | UTM source/medium/campaign, gclid, fbclid | When arriving via a tracked campaign link |
| Message data | Content you fill in on the form | When submitting the form |
| Persistent identifier | A random ID stored in the _kid cookie (13 months), linked to the pages you view and, once you give them, your email or phone | On your first visit; refreshed each time you return |
3. What we use it for
- Respond to your contact and evaluate business opportunities (legal basis: performance of contract / pre-contractual measures)
- Send the Koko Journal newsletter if you subscribe (legal basis: consent)
- Improve the site and security (legal basis: legitimate interest)
- Recognise you across visits and devices using the
_kididentifier, so we can measure which campaign brought you and avoid asking for the same information twice (legal basis: legitimate interest; you can object at any time — see section 7) - Advertising measurement and remarketing on Meta and Google (legal basis: your consent, given through the cookie banner — nothing is sent to them before that)
- Koko’s own marketing and communication: campaigns, event invitations, content and offers for our products, and building lookalike audiences on advertising platforms. Where you already have an existing relationship with us — you bought a ticket, became a lead, answered a survey, or signed a contract — we rely on legitimate business interest, and you may object at any time through the channels in section 6
- Comply with legal obligations (accounting, tax)
4. Who we share data with
We use trusted providers to operate the site. Data may be processed by:
- Supabase: database of leads and CRM
- Resend: transactional email and newsletter delivery
- Cloudflare: DNS and abuse protection
- Hetzner (Germany): hosting of this site and of the identity database
- Meta Platforms: advertising measurement, via the Conversions API — only if you consent. Contact details (email, phone) are sent hashed with SHA-256, never in clear text
- Google (Analytics 4 and Ads): audience measurement and conversion — only if you consent
We do not sell personal data. We do not share it with third parties for marketing purposes unrelated to Koko.
5. Retention
We keep data for as long as necessary for its purpose:
- Leads that did not become clients: up to 24 months, after which we anonymize
- Active clients: for the contract period + 7 years (tax record requirements)
- Newsletter: until you unsubscribe
- Server logs: 30 days
_kidcookie: 13 months from your last visit- Browsing events tied to an identifier: 25 months, then deleted automatically
6. Your rights (PIPEDA / BC PIPA)
You have the right, at any time, to:
- Confirm the existence of, and access, your personal data
- Correct incomplete, inaccurate, or outdated information
- Request anonymization, blocking, or deletion
- Port your data to another provider
- Withdraw consent (including unsubscribing from the newsletter)
- Be informed about who we share data with
- File a complaint with the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia
To exercise any right, email lucas@kokoagency.ca. We respond within 30 days.
7. Cookies and how we recognise you
Until August 2026 this section stated that we did not use advertising cookies. That was inaccurate — the site already loaded the Meta Pixel and Google Analytics. This is the corrected description.
| Cookie | What it does | Lifetime | Needs consent? |
|---|---|---|---|
_kid | A random identifier that lets us recognise the same browser across pages and visits. It contains no name, email, or anything readable — just a random number that points to your record on our own servers. | 13 months | No (legitimate interest). You can delete it — see below. |
_ksid | Groups the pages of a single visit into one session. | 30 minutes | No |
_fbp, _fbc | Meta advertising cookies. | Up to 90 days | Yes |
_ga, _ga_* | Google Analytics measurement. | Up to 2 years | Yes |
_kid and _ksid are set by t.kokoagency.ca, a server we run ourselves. They are
HttpOnly, which means no script on the page — ours or anyone else's — can read them.
Nothing is sent to Meta or Google until you accept in the banner. If you choose "Only measurement"
we keep the data on our own servers and share it with no one. If you refuse, we still record the visit under
_kid for our own statistics, and you can erase that too.
If you already had a record with us — a ticket, a course, a contact form, a
survey — that data is also linked to your _kid when you return to the site, and is used
for the purposes in section 3, including Koko’s own marketing. That does not rest on the cookie
banner but on the relationship that already exists, and you can object the same way: email us, or use
the deletion link below.
To delete everything we hold about your browser, open t.kokoagency.ca/esquecer from this browser, or email us. The deletion is immediate and covers every device we have linked to you.
8. Security
We apply reasonable technical and organizational measures: mandatory HTTPS, encrypted credentials, restricted access following the principle of least privilege, daily backups. No system is 100% secure. In the event of a material incident, we will notify affected individuals and the relevant privacy commissioners within the legal timeframes.
9. International transfer
Some providers (Resend, Cloudflare, Supabase, Hetzner, Meta, Google) may store data on servers outside Canada, including in the United States and European Union. Transfers follow PIPEDA requirements through contractual clauses and providers with an adequate level of protection.
10. Changes to this policy
We may update this policy periodically. The "Updated on" date indicates the latest revision. Material changes will be communicated through our contact channels.
11. Privacy Officer contact
Murilo Souza · lucas@kokoagency.ca