Privacy Policy

Last updated: April 10, 2026

1. Introduction and Data Processing Roles

BLNG Agency ("the Agency") respects your privacy and is committed to protecting your personal data. This policy explains how we collect, use, and safeguard personal data in strict compliance with the European Union General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act (CCPA) as amended. We act as a Data Controller regarding the information collected directly from visitors to blngagency.com and individuals who inquire about our agency services. Conversely, we act strictly as a Data Processor (or "Service Provider" under the CCPA) when we access, migrate, or configure customer data on behalf of our Clients within their respective Shopify stores, Klaviyo accounts, or other third-party marketing platforms.

2. Data We Collect as a Controller

When you visit blngagency.com or engage our commercial services, we may collect:

Identity and Contact Data: Name, email address, phone number, and business details provided via contact forms or during client onboarding.
Financial Data: Billing addresses and payment details. Payment processing is handled securely via encrypted third-party payment gateways; the Agency does not store full credit card numbers on its servers.
Technical and Usage Data: Internet Protocol (IP) address, browser type, device identifiers, and analytics data detailing how you interact with our website interface.

3. Lawful Basis for Processing (GDPR Compliance)

Under the GDPR, we process your personal data under the following documented lawful bases:

Contractual Necessity: To provide commercial quotes, process milestone payments, and deliver the purchased agency services.
Consent: When you explicitly opt-in to receive our agency marketing communications or accept non-essential tracking cookies.
Legitimate Interests: To analyze website traffic, improve our service offerings, and protect our business from fraud, provided these commercial interests do not override your fundamental privacy rights.
Legal Obligation: To retain tax, accounting, and contractual records as required by Slovak and overarching EU law.

4. Data Processing on Behalf of Clients (Processor/Service Provider Obligations)

When building Shopify stores, setting up Klaviyo flows, or managing Paid Media campaigns, we may temporarily access the personal data of our Clients' end-customers (e.g., consumer email addresses, purchase histories). In these circumstances:

We process this data strictly on the documented instructions of the Client, who serves as the Data Controller.
We do not sell, share, or retain this end-customer data for our own commercial purposes, fully complying with CCPA prohibitions on secondary data use by Service Providers.
We cooperate fully with our Clients regarding cybersecurity audits and risk assessments related to the processing of consumer data, as required by updated CCPA regulations.
Upon project completion and handover, we do not retain administrative access to end-customer databases unless retained for ongoing support under a separate, explicit agreement.

5. Data Sharing, Artificial Intelligence, and Sub-Processors

We do not sell your personal data to data brokers. We share data only with trusted third parties essential to our operations:

Platform Partners (including Shopify and Klaviyo) to facilitate store builds and integrations. In alignment with Shopify's 2026 Partner Program updates, we utilize approved Universal Commerce Protocol (UCP) standards and treat all Merchant Data as strictly confidential.
Analytics and Marketing providers (such as Google Analytics and Meta) subject to your affirmative cookie consent.
If leveraging generative Artificial Intelligence tools or Shopify's agentic commerce features to assist in development, we ensure that no confidential Client data or sensitive personal information is utilized to train public AI models.

6. International Data Transfers

BLNG Agency is headquartered in Slovakia (within the European Economic Area). If we transfer data outside the EEA or the UK (for example, utilizing US-based servers or SaaS software), we ensure appropriate legal safeguards are in place, utilizing mechanisms such as the European Commission's Standard Contractual Clauses (SCCs) or recognizing equivalent adequacy decisions.

7. Data Retention Protocols

We retain Client contact and billing data for the duration of the business relationship and up to 10 years thereafter to comply with mandatory Slovak accounting and commercial laws. Analytics data is systematically anonymized or deleted within 14 months of collection.

8. Your Data Subject Rights

Depending on your applicable jurisdiction (EU, UK, or California), you possess specific rights regarding your data:

The right to access, correct, or request the erasure of your personal data.
The right to object to processing or withdraw consent for marketing communications at any time.
The right to request data portability in a structured, commonly used format.
The right to lodge a formal complaint with your local supervisory authority (e.g., the Office for Personal Data Protection of the Slovak Republic, or the UK Information Commissioner's Office).

To exercise these rights, contact us at agency@bling-authority.com. We will process and respond to verified requests within the legally mandated timeframe (typically 30 to 45 days).

9. Children's Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected data from a minor, we will take prompt steps to delete that information.

10. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or applicable law. Material changes will be communicated via our website. Continued use of our services after such changes constitutes acceptance of the updated policy.

Contact: agency@bling-authority.com | Legal notice