1. Who we are
This website (https://paskogroup.com) and the landing pages that link to this policy are operated by PaskoGroup. The controller of your personal data (in Peru, the titular del banco de datos personales) is:
| Controller | Jorge Pasco Romero, trading as PaskoGroup |
|---|---|
| National ID (DNI, Peru) | 09866445 |
| Address | Lima, Peru |
| marketing@paskogroup.com | |
| Website | https://paskogroup.com |
Jorge Pasco Romero is also the person responsible for the protection of personal information (Privacy Officer for the purposes of PIPEDA, Quebec Law 25, the Australian Privacy Act and the NZ Privacy Act). You can reach him at the contact details above.
2. Applicable laws
We serve clients in Peru and in Tier-1 markets, so we apply one high, uniform standard — prior opt-in consent for every non-essential cookie or pixel — and honour the specific rights each law grants you:
- Peru: Personal Data Protection Law No. 29733 and its Regulation approved by Supreme Decree No. 016-2024-JUS.
- European Union / EEA: General Data Protection Regulation (EU) 2016/679 (GDPR) and the ePrivacy Directive 2002/58/EC as implemented in each Member State.
- United Kingdom: UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR) and the Data (Use and Access) Act 2025.
- United States: the California Consumer Privacy Act as amended by the CPRA, the California Online Privacy Protection Act (CalOPPA), the comprehensive privacy laws of other states (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others), the CAN-SPAM Act and the Children's Online Privacy Protection Act (COPPA).
- Canada: the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25), the provincial private-sector laws of Alberta and British Columbia where applicable, and Canada's Anti-Spam Legislation (CASL).
- Australia: the Privacy Act 1988 and the Australian Privacy Principles (APPs), as amended by the Privacy and Other Legislation Amendment Act 2024, and the Spam Act 2003.
- New Zealand: the Privacy Act 2020 and its Information Privacy Principles (IPPs), and the Unsolicited Electronic Messages Act 2007.
3. Personal data we collect
Data you give us
- Strategy call booking: full name, work email, company and website, monthly ad spend range, chosen date, time and time zone.
- Promotion partnership application: name, work email, product URL, payout model and amount, monthly conversion capacity, vertical, target markets and your compliance confirmation.
- Newsletter (The Pasko Briefing): email address.
- Direct communications: anything you send us by email, phone or WhatsApp.
Data collected automatically — only with your consent
- Analytics: pages viewed, clicks, scroll depth, referring site, campaign parameters (UTM), approximate location derived from a truncated IP address, device, browser and operating system type, and — via Microsoft Clarity — heatmaps and session replays in which form inputs are masked.
- Advertising: cookie and pixel identifiers, ad-click identifiers (e.g.
fbclid,ttclid), page events and conversion events, which Meta and TikTok may match to accounts on their platforms.
Data that is always processed
Our hosting provider processes technical data (IP address, request time, user agent) in server logs to deliver the site and keep it secure. We also store your language and consent choices in your browser. These are strictly necessary and do not require consent.
We do not ask for, and ask you not to send us, sensitive data (health, ethnic origin, religious or political beliefs, biometric data, sexual life, union membership, precise geolocation or government ID numbers).
4. Purposes and legal bases
| Purpose | Legal basis (GDPR art. 6 / Ley 29733) | Retention |
|---|---|---|
| Schedule and hold strategy calls, answer enquiries | Steps at your request before a contract (art. 6(1)(b)); in Peru, consent given when you submit the form or the pre-contractual exception of art. 14 Ley 29733 | 24 months after last contact, unless a contract follows |
| Evaluate promotion partnership applications | Pre-contractual steps (art. 6(1)(b)); consent (Peru) | 24 months after the decision |
| Deliver and manage client contracts, invoicing | Performance of a contract (6(1)(b)); legal obligation (6(1)(c)) for tax records | Contract term + period required by tax law (in Peru, up to 5 years) |
| Send the newsletter | Consent (6(1)(a)); express consent under CASL, Spam Act, UEMA and Ley 29733 | Until you unsubscribe |
| Website analytics (Matomo, Google Analytics, Microsoft Clarity) | Consent (6(1)(a) and ePrivacy art. 5(3)) | See section 5 and the Cookie Policy |
| Ad measurement, retargeting and audiences (Meta Pixel, TikTok Pixel) | Consent (6(1)(a) and ePrivacy art. 5(3)); opt-out right under US state laws | See section 5 and the Cookie Policy |
| Security, fraud prevention, defence of legal claims | Legitimate interests (6(1)(f)); legal obligation | Server logs up to 90 days; longer only if needed for a specific incident or claim |
You may withdraw consent at any time, as easily as you gave it, through Cookie settings or by emailing us. Withdrawal does not affect processing carried out before it.
5. Analytics and advertising tools
None of these tools load until you opt in through our cookie banner. If your browser sends a Global Privacy Control (GPC) signal, advertising tools stay off.
| Tool | Provider | What it does |
|---|---|---|
| Matomo Analytics | Self-hosted by PaskoGroup or Matomo Cloud (InnoCraft Ltd, New Zealand) | Privacy-focused visit statistics. IP addresses are anonymised; data is not shared with third parties for their own purposes. |
| Google Analytics 4 | Google Ireland Ltd (EEA/UK/CH) and Google LLC (USA) | Visit and conversion statistics. Cookie lifetime limited to 13 months; Google signals and ad personalisation are enabled only if you also accept marketing. Google Privacy Policy |
| Microsoft Clarity | Microsoft Ireland Operations Ltd and Microsoft Corporation (USA) | Heatmaps and session replays to find usability problems. Text typed into forms is masked. Microsoft Privacy Statement |
| Meta Pixel | Meta Platforms Ireland Ltd (EEA/UK) and Meta Platforms, Inc. (USA) | Measures the results of our Facebook and Instagram ads and builds audiences for retargeting. Meta Privacy Policy |
| TikTok Pixel | TikTok Technology Ltd (Ireland) and TikTok Information Technologies UK Ltd (EEA/UK); TikTok Inc. (USA); TikTok Pte. Ltd (rest of world) | Measures the results of our TikTok ads and builds audiences. TikTok Privacy Policy |
For the collection and transmission of data through the Meta and TikTok pixels, we and each platform may be joint controllers (GDPR art. 26; CJEU judgment C-40/17 Fashion ID). Each platform is solely responsible for what it does with the data afterwards, under its own policy. You can also manage ad preferences directly in your Meta and TikTok account settings.
Cookie names, durations and domains are listed in our Cookie Policy.
7. International transfers
We are based in Peru, and our providers process data in Peru, the United States, the European Union (mainly Ireland), the United Kingdom and, for TikTok, possibly Singapore and other countries where its group operates. For this reason, your data may be processed outside your country.
- From Peru: we inform you of these cross-border flows (art. 15 Ley 29733) and transfer only to recipients that offer adequate protection or with your consent.
- From the EEA, UK and Switzerland: we rely on adequacy decisions where they exist (including the EU-US Data Privacy Framework and the UK Extension for certified recipients such as Google, Microsoft and Meta) and otherwise on the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum, with supplementary measures where needed.
- Australia (APP 8) and New Zealand (IPP 12): we take reasonable steps to ensure overseas recipients protect your information in a way comparable to your local law.
- Canada / Quebec: we assess the protection offered by the destination before communicating personal information outside Quebec, as required by Law 25.
Contact us to obtain a copy of the relevant safeguards.
8. Retention and security
We keep personal data only for as long as needed for the purposes in section 4, then delete or anonymise it. Your consent choice is stored for 12 months, after which we ask again; we also ask again whenever we add tools or purposes.
We apply technical and organisational measures appropriate to the risk, including HTTPS encryption, access restricted to people who need it, multi-factor authentication on our accounts, IP anonymisation in analytics and masking of form inputs in session replays. If a security breach is likely to harm you, we will notify you and the competent authorities within the deadlines required by law (e.g. 72 hours to EU/UK authorities; to the OAIC under the Notifiable Data Breaches scheme in Australia; to the Privacy Commissioner in New Zealand and Canada; and to the ANPD in Peru).
9. Your rights
Depending on where you live, you have the following rights. Exercising them is free and you will not be discriminated against for doing so.
- Peru (Ley 29733): information, access, rectification and update, inclusion, cancellation (deletion), opposition (ARCO rights), revocation of consent and objective treatment (not to be subject to decisions based solely on automated processing). If we do not respond in time or you disagree with the answer, you can file a claim with the Autoridad Nacional de Protección de Datos Personales (ANPD) of the Ministry of Justice and Human Rights.
- EU/EEA and UK: access, rectification, erasure, restriction, data portability, objection (including an absolute right to object to direct marketing), withdrawal of consent and the right not to be subject to solely automated decisions with legal or similarly significant effects. You may lodge a complaint with your local supervisory authority or, in the UK, the Information Commissioner's Office (ICO). We respond within one month (extendable by two months for complex requests).
- Canada: access, correction and withdrawal of consent (PIPEDA); in Quebec, also data portability, de-indexation, and to be informed of and to submit observations on automated decisions. Complaints: Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information. We respond within 30 days.
- Australia: access and correction (APPs 12 and 13), and to deal with us anonymously or using a pseudonym where practicable (APP 2). If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC). We respond within 30 days.
- New Zealand: access and correction (IPPs 6 and 7). Complaints: Office of the Privacy Commissioner. We respond within 20 working days.
- United States: see section 10.
How to exercise your rights: email marketing@paskogroup.com with the subject “Privacy request”. We may ask for information to verify your identity, using only data we already hold where possible. An authorised agent may act on your behalf with written proof of authorisation.
10. US state privacy notice
This section applies to residents of California and of other US states with comprehensive privacy laws, and constitutes our notice at collection.
| Category (CCPA) | Examples | Sold or shared? |
|---|---|---|
| Identifiers | Name, email, cookie and pixel IDs, IP address | Cookie/pixel IDs and IP may be shared with Meta and TikTok for cross-context behavioural advertising, only if you opt in |
| Internet or network activity | Pages viewed, clicks, ad interactions | Same as above |
| Approximate geolocation | Country/city derived from IP | No |
| Professional information | Company, website, ad spend range, business details in applications | No |
| Inferences | Inclusion in advertising audiences | Created by Meta/TikTok only if you opt in |
We do not collect sensitive personal information as defined by the CCPA, and we have no actual knowledge of selling or sharing personal information of consumers under 16. Purposes and retention periods are set out in sections 4 and 8; sources are you, your device, and the platforms in section 5.
Your rights: to know/access, delete and correct your personal information; to opt out of its sale, sharing for cross-context behavioural advertising and targeted advertising; and not to be discriminated against for exercising these rights. Residents of states that provide it may appeal a denial by replying to our decision with the subject “Privacy appeal”; we will respond within the legal deadline (typically 45 or 60 days) and, if we deny the appeal, tell you how to contact your state Attorney General.
Do Not Sell or Share My Personal Information: marketing technologies are off by default. To keep them off or switch them off, use Your Privacy Choices. We honour the Global Privacy Control signal as a valid opt-out. We do not respond to “Do Not Track” browser signals, which have no agreed standard, but GPC achieves the same result.
We respond to verifiable requests within 45 days (extendable by 45 more when reasonably necessary).
11. Email marketing
We only send marketing emails to people who have subscribed or with whom we have a relationship that the law allows us to contact. Every message identifies PaskoGroup, includes our contact details and a one-click unsubscribe link, and opt-outs are processed promptly (within 10 business days at the latest, as required by CAN-SPAM and CASL). We comply with CAN-SPAM, CASL, PECR, the Australian Spam Act 2003, the NZ Unsolicited Electronic Messages Act 2007 and Peruvian Law No. 28493.
12. Children, automated decisions and changes
Children: our services are for businesses and professionals. We do not knowingly collect data from anyone under 18 (and in any case not under 13 in the US, 14 in Peru or 16 in the EU). If you believe a minor has sent us data, contact us and we will delete it.
Automated pre-screening: the promotion partnership form applies an automatic preliminary filter based on the conversion capacity and payout model you declare. It only tells you immediately whether the minimum requirements are met; it has no legal effect, and you can always ask a person to review your application, express your point of view and request the reasons for the outcome by writing to us.
Changes: we will update this policy when our practices or the law change, and indicate the new effective date at the top. If changes are material, we will tell you through the site and, where required, ask for your consent again.
13. Contact and complaints
For any question or complaint about privacy, contact Jorge Pasco Romero at marketing@paskogroup.com. We would appreciate the chance to resolve your concern first, but you can always go directly to the authority:
- Peru — Autoridad Nacional de Protección de Datos Personales (ANPD), Ministry of Justice and Human Rights: gob.pe/anpd
- EU/EEA — your national data protection authority: EDPB members list
- United Kingdom — Information Commissioner's Office: ico.org.uk
- California — California Privacy Protection Agency: cppa.ca.gov; other states — your state Attorney General
- Canada — Office of the Privacy Commissioner: priv.gc.ca; Quebec — Commission d'accès à l'information: cai.gouv.qc.ca
- Australia — Office of the Australian Information Commissioner: oaic.gov.au
- New Zealand — Office of the Privacy Commissioner: privacy.org.nz
If there is any discrepancy between the English and Spanish versions of this policy, the version in the language of the user's jurisdiction prevails; for Peru, the Spanish version prevails.