Privacy Policy

Effective date / Last updated: November 5, 2026

Introduction

This Privacy Policy explains how TWENTY THIRTEEN LTD ("kovelirosolution", "we", "our", or "us") collects, uses, shares, and protects information when you use the kovelirosolution platform, websites, and related services (the "Services"). For the purposes of applicable data protection law, the data controller is TWENTY THIRTEEN LTD, 42 Ickwell Road, Northill, Biggleswade, Beds, United Kingdom, SG18 9AB. By using the Services, you acknowledge this policy. If you do not agree with it, please do not use the Services.

1. Information we collect

1.1 Information you provide

• Account information: name, company name, work email, country, and password credentials when you register.
• Account verification details: information we ask for to confirm that an account is genuine and used for legitimate advertising, where required.
• Campaign content: campaign settings, budgets, creative assets, audience definitions, and reporting preferences you configure in the platform.
• Communications: the content of support requests, contact form messages, and feedback you send us.

1.2 Information collected automatically

• Usage data: pages viewed, features used, session activity, and timestamps within your workspace.
• Network and device data: IP address, browser type, device type, operating system, and approximate location derived from IP.
• Cookies and similar technologies: necessary cookies for sign-in and session security, plus analytics, advertising, and functionality cookies where you consent to them.

1.3 Information from advertising activity

• Delivery data: impressions, clicks, and completion events associated with campaigns you run.
• Audience and measurement data: audience segments and conversion events you choose to attach, processed to report on campaign performance.

2. How we use information

• To provide, operate, and maintain the Services.
• To deliver, pace, and measure the campaigns you configure.
• To generate reports, dashboards, and audience insights for your workspace.
• To verify accounts and prevent misuse, fraud, and invalid activity.
• To respond to support requests and communicate about your account.
• To improve the platform, including debugging, testing, and product development.
• To send product updates and marketing communications, where permitted and with consent where required.
• To meet legal, regulatory, and contractual obligations.

3. Legal bases

Where UK data protection law applies, we process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Our legal bases are contract performance, legitimate interests (such as securing the platform and improving the Services, balanced against your rights), consent where required, and compliance with legal obligations. Where processing relies on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.

4. Sharing information

We do not sell personal data. We share information only as needed to run the Services:

• Service providers: hosting, data storage, analytics, email delivery, and customer support tools that process information on our behalf under contract.
• Delivery and measurement partners: partners involved in serving or measuring campaigns you choose to run.
• Fraud and security providers: partners that help filter invalid traffic and protect the platform.
• Legal and regulatory: where required by law, court order, or a valid governmental request.
• Business transfers: as part of a merger, acquisition, or transfer of assets, subject to this policy.
• With your direction: where you ask us to share information with a third party.

5. Cookies and your choices

We use necessary cookies to keep you signed in and to secure sessions. With your consent, we also use analytics, advertising, and functionality cookies. Where applicable, cookies and electronic marketing are subject to the Privacy and Electronic Communications Regulations (PECR), alongside UK data protection law. You can accept, reject, or customise optional cookie categories at any time using the Cookie Settings link in the footer, or manage cookies through your browser settings. You can opt out of marketing using the unsubscribe instructions in a message or by contacting us.

6. Data security

We apply technical and organisational measures designed to protect personal data. These measures may include, for example:

• encryption of data in transit and at rest where appropriate;
• role-based access controls and least-privilege administration;
• logging of workspace and administrative activity;
• penetration testing on a scheduled cadence, with findings tracked to resolution;
• vulnerability management for dependencies and services;
• security and privacy guidance for team members.

No method of transmission or storage can be guaranteed absolutely secure, and we cannot guarantee that a security incident will never occur.

7. Data retention

We keep personal data for as long as needed to provide the Services and for legitimate business or legal purposes, such as maintaining records, resolving disputes, and meeting legal obligations. When data is no longer needed, we delete or de-identify it.

8. Your rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or restrict the processing of your personal data, to object to certain processing such as direct marketing, and to request data portability. To exercise these rights, contact privacy@koveliro.com. We will respond within the timeframe required by applicable law.

For UK data protection concerns, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint/. You may also lodge a complaint with the competent data protection authority in your country or region. Where other data protection laws apply — for example the EU GDPR, or US state privacy laws such as the CCPA/CPRA — we handle rights requests in accordance with those laws.

9. International transfers

If providing the Services involves transferring personal data outside the UK, any restricted transfer must comply with applicable UK data protection law. Depending on the destination and circumstances, the relevant safeguard may be UK adequacy regulations, the UK International Data Transfer Agreement (IDTA), or the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, together with any required transfer assessment and supplementary measures. Where EU GDPR applies, restricted transfers must use a permitted EU transfer mechanism. Contact us for information about safeguards relevant to your personal data.

10. Children

The Services are intended for business use and are not directed to children. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced through the platform or by email, and the "last updated" date will be revised.