This Privacy Policy explains what personal data Danny Clans Media Limited ("Company", "we", "us") collects through the customer dashboard at dashboard.dannyclans.systems ("Dashboard"), why, who sees it, how long we keep it and what your rights are. It applies to the Dashboard; the public website at dannyclans.com has its own policy.
We are the data user responsible for this data under the Personal Data (Privacy) Ordinance of Hong Kong SAR. Where you are in the European Economic Area, the United Kingdom or California, the additional rights in section 5 also apply.
1. What Information We Collect
Account Information
- Name, work email address and phone number.
- Password, stored as a salted hash and never as typed; and the two-factor secret if you turn that on.
- Business name, address, tax or registration number, and your business registration certificate, which Advertising Platforms require.
Payment Information
- The amount, date, method and reference of each deposit, and any proof of payment you upload.
- Card payment identifiers from our card processor. We never see or store your card number.
- For USDT, the transaction hash and the sending address as recorded on the blockchain.
- The bank account you name in your service agreement, for refunds.
Advertising Information
- The advertising accounts opened for you and their platform identifiers.
- Business Manager IDs you give us, and screenshots you upload when clearing funds.
- Every movement of money between your wallet and your accounts, and the invoices, receipts and statements that record it.
Signature and Consent
- When you sign your service agreement: the typed or drawn signature, the time, your IP address and browser, and the consent statements you ticked.
- Each time you accept the dashboard Terms, Privacy Policy and Refund Policy: the version, the date and time, your IP address, your browser identification string, how you accepted (at registration or after a change), and a SHA-256 fingerprint of the exact text shown to you. We also archive that text. Every acceptance is kept, not only the latest, and you can see and download each from the Documents page of your Dashboard.
Verification Information
- Identity or business documents you provide when we ask under our KYC & AML Verification Policy, and the result of any sanctions or blockchain-analytics check that we or our payment providers carry out.
Technical and Usage Information
- Your IP address and browser details on sign-in and on each request, the devices you have marked as trusted, and a log of actions taken in your account.
- Support tickets and messages you send us.
What you must give us, and what happens if you do not
- To open an account: your name, a work email address and a password. Without them there is no account.
- To apply for an advertising account: your business name, address, registration or tax number and registration certificate, because every Advertising Platform requires them. Applications are held until they are complete.
- When we ask under the KYC & AML Verification Policy: the documents requested. If they are not provided, the account may be suspended and deposits and refunds held until they are, as section 12 of the Terms describes.
- Everything else — a phone number, trusted devices, two-factor authentication, support messages — is voluntary. Not giving it limits only the feature it belongs to.
Where you give us personal data about other people — directors, owners, an authorised representative — you confirm that you are entitled to, and that you have told them where to find this policy. You can keep your own details up to date on the Profile page at any time, and we will correct anything you tell us is wrong.
2. How We Use Your Information
- To run your account: verify deposits, move money as you instruct, open and manage advertising accounts, issue invoices, receipts and statements, and answer support.
- To apply to Advertising Platforms on your behalf, which means submitting your business details and documents to Meta, Google, TikTok and others as part of applications you ask us to make.
- To keep the Dashboard safe: recognising sign-ins from unfamiliar devices, unusual payment patterns, and misuse.
- To meet our legal obligations: keeping business and tax records, preventing money laundering, checking that we are not dealing with sanctioned parties, and responding to lawful requests.
- To tell you things about your account — a deposit cleared, an application decided, an agreement to sign. We do not send marketing from the Dashboard.
We will not use your data for any purpose not listed here, or for direct marketing, without first telling you and obtaining your express consent; you would be able to opt out at any time, free of charge.
3. Cookies and Tracking Technologies
The Dashboard sets only the cookies it needs: one to keep you signed in, one to protect forms against forgery, and one to remember a device you have chosen to trust for fifteen days. If your browser blocks them, you cannot sign in. It sets no advertising, analytics or tracking cookies, and no third-party pixels. The public website has its own Cookie Policy.
4. Who We Share It With, and Do Not Sell
- Our staff, on a need-to-know basis with permissions set per role. Access to money-moving functions and to your bank details is restricted, and every action is logged.
- Advertising Platforms, when you ask us to apply or to share an account: your business details and documents, and the Business Manager IDs you give us.
- Payment providers: our card processor (currently Stripe) receives what a card payment needs; our USDT payment provider (currently OSL) sees transactions to the addresses it issues for you and may carry out its own blockchain-analytics and sanctions screening of the sending address; our banking provider (currently Airwallex) sees incoming transfers and their remitter details. Each has its own privacy policy for data it holds in its own right.
- Screening services, if we use them, receive only the name or address being checked and return a result.
- The providers who host the Dashboard and deliver our email, including the sign-in codes and notifications it sends you, under contracts that limit what they may do with the data and how long they may keep it.
- Regulators, courts and law enforcement where the law requires it, and professional advisers under a duty of confidence.
We do not sell personal data, and we do not share it with anyone for their own marketing. If you are a California resident this is the "Do Not Sell" disclosure you are entitled to: there is nothing to opt out of.
5. Your Rights
Everyone (PDPO)
You may ask whether we hold personal data about you, ask for a copy of it, and ask us to correct it. Write to the Data Protection Officer at help@dannyclans.com or at the address in section 10; we respond within forty days and may ask you to prove who you are first. We may charge a fee for a copy, which will not be excessive. If we cannot meet an access request we will tell you in writing within forty days and say why. If we decline to correct something because we believe it is accurate, we will say why and attach your version to the record so that anyone reading it sees both. You may complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong SAR.
EEA and UK residents (GDPR)
In addition: the rights to erasure, to restrict processing, to data portability, to object, and to withdraw consent where processing is based on it. Our lawful bases are performance of our contract with you, our legal obligations, and our legitimate interest in running the Dashboard safely. You may complain to your local supervisory authority.
California residents (CCPA)
In addition: the rights to know what we collect and whether it is sold (it is not), to delete, to opt out of sale (there is none), and not to be discriminated against for exercising these rights.
Retention periods in section 6 limit erasure: records the law requires us to keep are kept for that period even after a request.
6. Data Retention
- Financial records — deposits, top-ups, clearances, invoices, receipts, statements and the ledger behind them: seven years after the transaction, as tax and company law require.
- Your signed service agreement and the record of your acceptance of our Terms: seven years after your account closes.
- Account information: while your account is open and for three years after it closes.
- Business documents you uploaded: while your account is open and for as long as an application made with them may be questioned by an Advertising Platform, then deleted.
- Sign-in and activity logs: twelve months.
- Support tickets: three years after they are resolved.
When you close your account we delete or anonymise everything not covered by a period above.
7. Security
Connections are encrypted. Passwords are stored as salted hashes. Two-factor authentication is available to you and required for our staff. Uploaded documents and generated agreements are stored outside the public web root and served only to the account they belong to. Staff access is by role and is logged. Bank details on an agreement are visible only to staff who need them to pay refunds.
No system is perfectly secure. If we learn of a breach that affects your data we will tell you without undue delay, what we know and what we are doing, and we will notify the Office of the Privacy Commissioner for Personal Data where its guidance calls for it. We keep a record of every security incident, whether or not it is reported.
8. Automated Checks and International Transfers
We do not make decisions about you by automated means. Our USDT payment provider may apply its own screening to incoming payments, and our card processor to card payments; if a payment is held as a result, a member of our staff reviews it and decides what happens, and you may ask us to reconsider and to explain the outcome.
The Dashboard is hosted on servers we control with an infrastructure provider in Germany, in the European Union. Our card processor operates from the United States and Singapore, our banking provider from Australia, Singapore and Hong Kong SAR, and our USDT provider from Hong Kong SAR. Where personal data leaves Hong Kong SAR we transfer it only to providers who commit in writing to protect it to a standard equivalent to this policy.
9. Children
The Dashboard is for businesses and is not intended for anyone under 18. We do not knowingly collect data from children; if we learn we have, we delete it.
10. Contact Us
Questions and requests about your data, including access and correction requests, go to the Data Protection Officer, Danny Clans Media Limited, S022, 2/F, The Capital, 61–65 Chatham Road South, Tsim Sha Tsui, Hong Kong, or by email to help@dannyclans.com.
11. Last Updated
This policy was last updated on 2026-09-05 (revision 2). If we change it in a way that matters we will show you the new version in the Dashboard and ask you to accept it; the version you accepted, and when, is recorded against your account.