Marquorum Privacy Notice

1. Scope and controller

Akii Technologies, Ltd is the controller of personal data described in this Notice. It is a private company registered in the Dubai International Financial Centre under commercial licence number CL12662, with its registered office at IH-00-01-03-OF-05, Level 3, Innovation One, Dubai International Financial Centre, Dubai, United Arab Emirates. Marquorum is a brand and service operated by Akii Technologies, Ltd, not a separate legal entity.

This Notice covers visitors, applicants, creators, affiliates, administrators, partner contacts, payees, and other people who interact with the Marquorum website, account, dashboard, referral infrastructure, support, governance, communications, and payout operations. Product customer data may also be governed by the privacy notice of the customer-facing product.

2. Personal data we collect

• Identity and account data, such as verified email, account identifier, Google provider identifier stored as a one-way hash when you choose Google sign-in, basic profile name, role, age-of-majority confirmation, session and access status, and legal acceptance evidence.
• Creator and application data, such as display name, country, public channels, handles, audience and reach ranges, content formats, languages, audience territories, experience, interests, application answers, review state, and communications.
• Eligibility and compliance data, such as legal identity, address, tax residence, tax documentation, country and sanctions screening evidence, fraud signals, review decisions, holds, and case history, where required and collected through an approved secure workflow.
• Offer and promotion data, such as applicable published schedules, creator code, referral links, discount preferences, asset access, campaign identifiers, traffic and attribution events, conversion status, commission ledger, adjustments, and governance eligibility.
• Payout data, such as PayPal recipient email, confirmation status, encrypted destination record, payout amount, currency, reference, status, returned or unclaimed state, and reconciliation evidence. We do not ask for or store your PayPal password.
• Communications and support data, such as required notices, email preference history, unsubscribe and suppression evidence, delivery events, support requests, attachments, and administrator notes.
• Technical and security data, such as request time, limited device and browser information, one-way hashes derived from IP address and user agent, session tokens stored as one-way hashes, security events, integration events, and audit logs.
• Privacy-safe analytics, such as page type, approved interaction type, anonymous cohort hash, event time, operational performance, consent choice, permitted campaign tags, and completed application events. We do not send Google Analytics an email address, account identity, form content, magic-link token, creator code, or unapproved URL parameter.

3. Sources of personal data

We collect information directly from you, from your authorized organization, from public social profiles and content you identify, from Akii-owned products connected to Marquorum, from selected partners and product systems involved in an offer, and from service providers such as Google, PayPal, and Resend.

We may receive transaction, subscription, refund, dispute, entitlement, attribution, and payout status from product and payment systems. We may receive sanctions, fraud, identity, tax, or public-record information from lawful screening sources. We do not treat PayPal KYC as the sole basis for Marquorum eligibility or sanctions decisions.

4. Purposes and lawful bases

• Contract and steps at your request. We use account, application, offer, attribution, commission, governance, support, and payout information to provide Marquorum, form and perform the Terms and Offer Schedules, and process requested access or applications.
• Legal obligations. We use identity, tax, sanctions, payout, security, complaint, and record information to comply with applicable laws, court orders, regulatory duties, accounting, reporting, and lawful requests.
• Legitimate interests. We operate and improve the network, secure accounts, prevent abuse and fraud, measure service performance, administer relevant portfolio communications, enforce agreements, establish or defend claims, and manage business continuity. We assess necessity, proportionality, and your rights before relying on this basis.
• Consent. We rely on consent where applicable law requires it, including certain electronic marketing, optional channels, or processing of particular data. You may withdraw consent at any time without affecting earlier lawful processing.
• Vital, public, or other lawful grounds. We may use information where necessary to protect a person, perform a task in the public interest, or rely on another basis expressly available under applicable law.

5. Account access and legal acceptance

When you request a passwordless email link, we use your email, limited request evidence, a single-use token, delivery status, and return path to send and secure the link. Merely opening the link does not create a session. Confirmation consumes the link, verifies the email for Marquorum, records the applicable Terms agreement and Privacy acknowledgement, and creates a revocable session.

When you choose Google sign-in, Google authenticates you and returns a stable account identifier, verified email address, basic profile name, and a signed identity token. We store the Google account identifier only as a one-way hash, do not receive your Google password, request only identity scopes, do not request access to Google services such as Gmail or Drive, and do not retain Google access or refresh tokens. Google processes the sign-in under its own terms and privacy policy.

We retain the legal document type, version, content hash, effective date, displayed acceptance text, acceptance action, verified identity, timestamp, source surface, and one-way security hashes. This evidence protects both parties and supports DIFC electronic-record requirements.

6. Applications, eligibility, and automated support

We use application and public channel information to evaluate creator fit, identity, country availability, channel ownership, audience relevance, compliance, capacity, risk, and portfolio needs. Some rules automatically block impossible or unsupported actions, such as an unavailable country, expired access link, duplicate ballot, unapproved offer, invalid payout state, or missing required evidence.

We do not use solely automated processing to make a final decision that produces a legal or similarly serious effect unless the decision is necessary for the contract, authorized by law with safeguards, or based on valid explicit consent. Material adverse cases are designed for manual review. You may contact us to request human review where applicable.

7. Network Updates and your right to object

Network Updates may include new portfolio offers, Akii-owned and selected partner offers, creator opportunities, practical promotion education, case studies, and network news. Marquorum remains the sender. We do not give selected partners the Marquorum subscriber list or let them send directly under your Marquorum preference unless a separate notice and lawful basis permits it.

Where applicable law permits an opt-out model, we use the membership relationship and our legitimate interest in keeping members informed about relevant network opportunities. A verified member is enrolled when the account is confirmed. You may refuse before joining by emailing hello@marquorum.com from the address you plan to use, or object at any time through the unsubscribe link, public email-preference page, dashboard control, or the same email address. The choice is free and does not affect application review, account access, offers, commissions, payouts, or voting.

Where a law requires prior consent for promotional email, including rules that apply to certain individual subscribers, we request separate consent or do not send unless a lawful exception applies. Acceptance of the Terms is not recorded as marketing consent in those circumstances. Every promotional email identifies the sender and contains a working no-login unsubscribe. We apply an objection promptly in Marquorum and reconcile it with our email provider.

Required account, security, application, accepted-offer, compliance, commission, payout, governance, incident, support, and legal messages are separate. We may continue sending those while the relevant relationship or duty exists, but we do not insert unrelated promotion when the marketing rules do not permit it.

8. PayPal and payout data

When you set a PayPal destination or receive a payout, Akii Technologies, Ltd and PayPal each process information for their own responsibilities. We provide PayPal with recipient details, amount, currency, reference, purpose, and related payout instructions. PayPal may return account, eligibility, delivery, failure, return, restriction, fee, transaction, or reconciliation information.

PayPal is an independent controller for its account, verification, risk, legal, and payment activities. Its processing is governed by the PayPal Privacy Statement and the agreements applicable to your account. We do not control PayPal's KYC, eligibility, account restriction, international transfer, retention, or disclosure decisions.

9. Who receives personal data

• Akii Technologies, Ltd personnel and authorized contractors who need the information for their role and are subject to confidentiality and access controls.
• Infrastructure and service providers, including Google for optional account authentication and consent-based website analytics, Supabase for database and authentication infrastructure, Railway for application hosting, Resend for email delivery and contact preferences, and providers used for security, storage, support, professional advice, and operational tooling.
• PayPal and other approved payment or payout providers for destination verification, distribution, reconciliation, risk, compliance, and reporting.
• Akii-owned products and selected partners only to the extent necessary to operate an offer, verify attribution, support a customer or creator, reconcile transactions, investigate a dispute, or meet an allocated legal responsibility.
• Professional advisers, auditors, insurers, banks, investors, acquirers, and transaction counterparties under appropriate confidentiality and due-diligence controls.
• Courts, regulators, law enforcement, tax authorities, sanctions authorities, and other competent bodies where disclosure is required or lawfully necessary.

10. No sale of personal data

We do not sell personal data or personal information for money. We do not share it for cross-context behavioural advertising. If a future practice is treated as a sale or regulated sharing under an applicable law, we will provide the notice and choice that law requires before starting it.

11. Cookies and analytics

Marquorum uses strictly necessary cookies for session security, confirmation protection, Google sign-in state and code-verifier protection, and account access. These cookies are needed for the service and are not advertising cookies.

Our first-party public analytics endpoint accepts only narrowly defined page-view, affiliate-action, and offer-view events. It creates a one-way anonymous cohort value and does not retain a raw network address, raw user agent, URL query, account identity, or browser credential.

Google Analytics is active across Marquorum by default until you opt out. It helps us understand visits, permitted campaign sources, navigation, and completed affiliate applications. You can reject analytics from the first-visit cookie notice or turn it off at any time on the Cookie Settings page. The choice is stored in your browser and does not affect account access, an application, offer eligibility, commissions, payouts, or governance. Opting out stops future Google Analytics collection from that browser and removes accessible Google Analytics cookies.

While analytics is active, Google Analytics may process a privacy-filtered page location, permitted campaign parameters, a privacy-filtered referrer, interaction events, a completed affiliate application event, browser and device characteristics, language, and approximate location derived from the network connection. Google may set first-party identifiers such as _ga. We configure Google Analytics without Google Signals, advertising personalization, advertising storage, advertising user data, cross-site behavioural advertising, or form-field capture. Magic-link tokens, Google sign-in codes, creator codes, email addresses, account identifiers, application answers, and unapproved URL parameters are excluded from the Analytics page location and event payloads.

Google acts as our service provider for this analytics processing under the applicable Google Analytics terms and data-processing terms. User-level and event-level Analytics data is retained for 14 months unless a shorter period is required or we delete it sooner. Aggregated reports may remain after source-level retention expires. For information about Google's processing, see the Google Analytics privacy and safeguards reference below.

We do not use Google Analytics for advertising on Marquorum. If we later introduce advertising features, cross-site tracking, or another non-essential analytics provider, we will update this Notice and provide the controls and prior choice required by applicable law before enabling it.

12. International transfers

Marquorum is an international network operated from the DIFC. Providers, product systems, selected partners, and users may be located outside the DIFC and the United Arab Emirates. Personal data may therefore be processed in other countries.

We use a transfer mechanism available under applicable law, such as a recognized adequate jurisdiction, contractual safeguards, approved standard clauses, binding rules, a necessary contract transfer, a legal obligation, or another permitted derogation. We assess the recipient, purpose, data, country, security, onward transfers, and enforceable rights where required. You may ask for information about the safeguards relevant to your data.

13. Retention

We retain personal data only for the purpose collected and for legitimate legal, accounting, security, audit, dispute, and enforcement needs. We consider the relationship, record type, sensitivity, risk, applicable limitation periods, provider rules, and mandatory retention duties.

• Access requests and unconsumed authentication evidence are normally retained for up to 90 days, while security evidence may be retained longer where an incident or abuse pattern requires it.
• Active account, profile, agreement, offer, commission, payout, governance, and support records are retained during the relationship and normally for up to six years after closure or final settlement.
• Tax, accounting, sanctions, fraud, payment, and payout evidence may be retained for up to ten years where applicable law, risk, an authority, or a legal claim reasonably requires it.
• Unsuccessful or withdrawn application data is normally retained for up to 24 months to manage reapplication, capacity, disputes, and abuse prevention, unless a shorter period is appropriate or a longer legal hold applies.
• Routine technical and security logs are normally retained for up to 24 months. Aggregated or irreversibly anonymized analytics may be retained without an account-level period.
• Marketing objections, unsubscribe evidence, and minimum suppression data are retained for as long as reasonably necessary to honor the choice and prevent re-import or accidental re-enrollment.
• Backups cycle out under the provider schedule. Data subject to a dispute, investigation, legal hold, security incident, or authority request is retained until the hold ends.

14. Security

We use technical and organizational measures designed for the nature and risk of the processing. These include passwordless single-use access, scanner-safe confirmation, hashed tokens and request evidence, encryption for sensitive payout destinations, role-based access, least privilege, immutable ledgers and evidence, row-level database security, signed integrations, rate limits, suppression controls, backups, monitoring, and tested recovery procedures.

No system is completely secure. You must protect your email account, device, session, and connected services and notify us promptly of suspected compromise. If a personal data breach creates a legal reporting duty, we will notify the DIFC Commissioner and affected people as applicable.

15. Your rights

Depending on applicable law and the circumstances, you may have the right to be informed, access personal data, receive a copy, correct inaccurate data, erase data, restrict processing, object to processing, withdraw consent, receive portable data, and request human review of certain automated decisions. You may object to direct marketing at any time and without charge.

A right may be limited by another person's rights, legal privilege, confidentiality, security, fraud prevention, a legal duty, an ongoing claim, or an applicable exemption. We will explain a refusal where the law permits. We do not charge for an ordinary request, but applicable law may allow a reasonable fee or refusal for a manifestly unfounded, excessive, or repetitive request.

To exercise a right, email hello@marquorum.com or write to the registered office. You do not need a Marquorum account. We may verify your identity, email control, authority, country, and request scope before disclosing or changing data. We aim to respond within one month where the DIFC Data Protection Law applies, subject to lawful extensions for complexity or volume.

16. Questions and complaints

Contact us first at hello@marquorum.com so we can investigate and respond. You may also lodge a complaint with the DIFC Commissioner of Data Protection or another competent supervisory authority that applies to you. Exercising a right or making a complaint will not result in retaliation.

The DIFC Data Protection Law may also provide a private right of action through the DIFC Courts in circumstances defined by that law.

17. Children

Marquorum is a professional network for adults. It is not directed to children, and applicants must be at least 18 and of legal majority where they live. If you believe a child provided personal data, contact us so we can investigate and take appropriate action.

18. Changes to this Notice

We may update this Notice to reflect changes in law, service, providers, products, partners, or processing. The version and effective date identify the current Notice. We will provide reasonable advance notice of a material change through email, dashboard notice, or a new acknowledgement where appropriate, unless an immediate update is required by law or security.

A new Notice does not convert an earlier unlawful purpose into a lawful one. If a change requires consent or another specific action, we will obtain it before that processing begins.

19. Controller contact

Akii Technologies, Ltd, IH-00-01-03-OF-05, Level 3, Innovation One, Dubai International Financial Centre, Dubai, United Arab Emirates. Email: hello@marquorum.com. This contact method is available without creating an account.