Kolsquare is committed to GDPR compliance.
At Kolsquare, privacy isn't a checkbox. It's built into everything we do: how we collect data, how we use it, and how long we keep it. As a B Corp certified company, we hold ourselves to the highest standard to protect our users' data and interests.
EU-hosted
Data is stored in Benelux
CNIL
Registered in France
B Corp
Certified responsible company
Art. 28
GDPR-compliant DPA available
The 7 GDPR principles
Kolsquare follows the 7 important GDPR principles to ensure your personal data is protected.
Lawful, fair & transparent
We always rely on a valid legal basis to use your data. Under GDPR, every use of personal data must be grounded on a lawful basis. Kolsquare uses two:
Legitimate interest
For publicly available influencer profile data — analysing public professional activity is a recognised legitimate interest for B2B marketing intelligence.
Contract performance
For data belonging to the brands and agencies who use our platform — we process it because it's necessary to deliver the service they've signed up for.
We make it transparent for our customers how Kolsquare processes data.
Secure use of cloud service providers with data storage in Europe and corresponding contractual and technical safeguards.
Purpose limitation
Data collected for one reason stays used for that reason. Kolsquare gathers influencer data for a single clear purpose: helping brands and agencies run better influencer marketing campaigns.
Influencer profile data
Used for campaign matching, performance measurement and aggregated market analysis. That same analysis is what powers our editorial content. In every case the data is aggregated or drawn from publicly available sources, and it is used to give the market accurate, sourced insight into influencer marketing, never to single out or target an individual creator.
Client user data
Used to deliver and improve the Kolsquare platform. It is not shared with third parties for their own purposes, other than our processors acting on our instructions and under contract.
Client account data
Client account data is only used to run your account.
Analytics data
Analytics data helps us understand how the platform is used and make it better for you.
We map every data type to a specific purpose in our internal Records of Processing Activities (ROPA), which we review at least once a year.
Data minimisation
Less is more. We only collect data that is genuinely needed to do what we say we do. Before adding any new data field or data source to our platform, we ask ourselves: do we actually need this?
For influencer data specifically, we don't collect everything publicly available on the web: we apply selective criteria (such as follower thresholds and public professional relevance) to identify the limited set of profiles genuinely useful for influencer marketing, rather than harvesting public data indiscriminately.
Influencer data
Public profile information, engagement metrics, and audience data for a selective set of professionally relevant profiles meeting defined criteria (such as follower thresholds). No private messages or personal home addresses.
Client data
Work name, professional email, company name, and role: enough to run your account and nothing more.
.svg)
Platform usage
We never track what you do outside Kolsquare.
Accuracy
We work hard to keep data correct and up to date. If something's wrong, you can ask us to fix it.
Influencer metrics are refreshed regularly so follower counts and engagement rates reflect real-time reality.
We have processes to flag and remove profiles that no longer exist on social platforms.
Platform users (brands and agencies) can update their account details at any time from their settings.
Influencers who spot incorrect information in their Kolsquare profile can contact us and we'll correct it within 30 days.
Integrity & confidentiality (Security)
Protecting your data is a technical and human commitment. We invest in security measures at every level, from the servers that store your data to the people who access it.
EU-hosted infrastructure
All data is hosted on Google Cloud Platform in Benelux, subject to strict EU law.
Encrypted connections
Every connection to Kolsquare — website, app, API — is secured with HTTPS/TLS. Your data is encrypted both in transit and at rest.
Two-factor authentication
Access to all production systems is protected by two-factor authentication. No single password can unlock sensitive data.
Strict access control
Only the team members who genuinely need access to a system can get it, and only at the level they need. We review access rights regularly.
Device security
All Kolsquare employee devices have full disk encryption, screen lock, and are managed through a centralized device policy.
Monitoring & incident response
Our systems are monitored 24/7 for unusual activity.
If something goes wrong, where Kolsquare acts as the data controller (e.g. for influencer profile data) we will notify the CNIL within 72 hours where required by law, and will inform affected individuals where the risk is high. Where Kolsquare acts as a processor on behalf of a client, we notify that client without undue delay so they can meet their own notification obligations.
Accountability
We don't just say we're compliant, we document it. We can demonstrate to regulators at any time exactly how we handle data and why. The measures below are a non-exhaustive illustration of our accountability practices.
Records of Processing Activities (ROPA)
A live internal register of every data processing operation.
DPIA and security assessments
We have conducted privacy and security assessments which we keep up to date.
Data Protection Officer (DPO)
Kolsquare has a designated privacy contact who oversees GDPR compliance.
CNIL registration
As a French company, Kolsquare is registered with France's data protection regulator.
Data Processing Agreements (DPAs)
In place with our processors, with SCCs or other appropriate safeguards where needed, and kept under regular review and update.
Staff training
All employees receive GDPR training. Privacy obligations are in every employment contract.
Annual reviews
We audit our data practices every year and update this page when anything material changes.
Data storage & data processing
Where your data lives & who touches it
Data flows through a predictable, controlled chain. Here is the full picture.
Collected
Public social data from platforms. Client data entered directly into the platform.
.svg)
Stored in the EU
All data held on GCP in the European Union.
Accessed by
Kolsquare staff with role-based access, and your own team. Never sold to advertisers.
Deleted
Automatically removed when retention periods expire, or immediately on your request.
Our commitment to GDPR: data protection & privacy
Compliance is the minimum. We aim higher. The points below are a non-exhaustive illustration of our commitments.
B Corp certified
Kolsquare is a certified B Corp and we're legally required to balance profit with purpose. Responsible data handling is part of that commitment.
CNIL registered
We are registered with France's data protection authority and cooperate fully with regulatory requests and audits.
Privacy by design
Every new Kolsquare feature goes through a privacy review before launch. Data protection is built in, not bolted on afterwards.
DPA available
If you use Kolsquare and need a Data Processing Agreement, contact privacy@kolsquare.com.
Trained team
Every Kolsquare employee receives regular privacy training. Data protection obligations are embedded in every contract.
Annual review
We audit our privacy practices every year. When something changes, we update our policies and tell you about it.
Your rights over your data
Under GDPR, you have specific rights, and we make them easy to exercise. Just send us an email and we'll respond within 30 days.
FAQ: Common questions
Is Kolsquare GDPR-compliant?
Kolsquare is committed to using and processing personal data in accordance with the EU 2016/679 – “GDPR” and other applicable data protection laws, and continuously works to strengthen its compliance practices.
I'm an influencer, why is my data on Kolsquare?
Kolsquare analyses publicly available social media profiles to help brands find the right creators for their campaigns. If your profile is public on Instagram, TikTok, YouTube, or similar platforms, it may appear in our database. This falls under 'legitimate interest' a recognized legal basis under GDPR for B2B marketing analysis of public professional data. If you'd like your profile removed, contact us and we'll take it down within 30 days.
Where does Kolsquare store my data?
Data is stored in Europe (Belgium and Netherlands) on Google Cloud Platform.
Does Kolsquare sell my data?
No. Kolsquare does not sell personal data to third parties. Data is used solely to deliver influencer marketing services to our clients.
How do I request access to or deletion of my data?
Email privacy@kolsquare.com with your request. We'll respond within 30 days. Platform users can also submit requests directly from their account settings.
I'm a Kolsquare client, do I need to sign a DPA?
If you process personal data through Kolsquare, then yes, a Data Processing Agreement is required under Article 28 GDPR. Our standard DPA is available in your account settings. If you have any question, contact privacy@kolsquare.com.
I am Kolsquare client, how do you utilize my client user data?
Client user data is used solely to deliver and improve the Kolsquare platform.
I am a Kolsquare client, how do you utilize my account data? (Work name, professional email, company name, and role)
We only use it to manage your access to the platform and your user rights, so you can perform all the tasks you need on the platform.
Does Kolsquare use cookies?
Kolsquare uses cookies for essential platform functionality and for analytics. We do not use third-party advertising cookies or share cookie data with ad networks.
What happens if there's a data breach?
Where Kolsquare acts as the data controller (in particular for influencer profile data), we are required by law to notify the CNIL within 72 hours. If the breach creates a high risk to you personally, we will also notify you directly by email. Where Kolsquare processes data on behalf of a client (e.g. brands and agencies), we notify that client without undue delay so they can fulfil their own notification obligations. Our incident response team is on call 24/7.
Who should I contact if I have a privacy concern?
Our Privacy team: privacy@kolsquare.com. We aim to respond within 5 business days. If you're not satisfied, you have the right to lodge a complaint with the CNIL: www.cnil.fr.
