Privacy Policy

1. Who we are

5DM Media Path ("Media Path", "we", "us") is a platform operated by 5DM Africa, based in Nairobi, Kenya. It lets advertisers, agencies and media partners plan campaigns, launch them across advertising channels, and optimize and measure results in one place. The service is available at v1.mediapath.africa. For the personal data described in this policy, 5DM Africa is the data controller, except where a customer uploads its own audience data, in which case that customer is the controller and we act as its processor.

2. What we collect

Account information. Your name, work email address, organisation, role and the permissions assigned to you, plus your password in hashed form when you sign in with a password.

Campaign and workspace data. Advertiser settings, journeys, campaigns, tactics, budgets, schedules, creatives and reports that you create or import.

Audience and conversion data. First-party audience lists, pixel and conversion events, and similar data that you or your organisation choose to upload or send to us.

Channel data. Data returned by advertising channels you connect, such as campaign structure, spend, impressions, clicks and conversions.

Technical data. IP address, browser and device type, pages visited and security logs, collected to keep the service secure and working.

3. Google user data

If you choose to connect a Google account, Media Path asks you to authorise access through Google's OAuth consent screen. We request only the permissions needed for the features you use:

• Campaign Manager 360 (dfareporting, dfatrafficking, ddmconversions): to read your CM360 profiles, advertisers, campaigns, placements, creatives and reports; to create or update trafficking objects you ask us to manage; and to upload offline conversions you choose to send.
• Google Ads (adwords): to read your Google Ads accounts, campaigns and performance metrics, and to apply changes that you request from within Media Path.

We use this data only to provide and improve these user-facing features inside Media Path: displaying your campaigns and results, building reports, and carrying out the actions you request. We store the access and refresh tokens Google issues so that the connection keeps working until you disconnect it.

We do not sell Google user data, use it for advertising or for building user profiles, share it with data brokers, or use it to develop, improve or train generalised artificial-intelligence or machine-learning models. We do not allow people at 5DM Africa to read your Google user data unless you give consent for specific items, it is needed for security or to investigate abuse, it is needed to comply with applicable law, or it is aggregated and anonymised for internal operations.

Limited Use disclosure. Media Path's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google at any time from Media Path, and you can also remove our access from your Google Account at myaccount.google.com/permissions. When access is removed we stop calling Google APIs on your behalf and delete the stored tokens.

4. How we use personal data

To create and secure your account; to run the platform and deliver the campaign, reporting and measurement features you ask for; to provide support; to send service notices such as security alerts and policy changes; to keep the platform secure and prevent fraud and abuse; to understand how the product is used so we can improve it; and to meet legal obligations.

5. Who we share data with

We do not sell personal data. We share it only with: advertising channels and ad-tech platforms that you connect, and only as needed to carry out the actions you request (for example Meta, Google, LinkedIn, TikTok, X and programmatic or DOOH partners, each under its own terms); infrastructure and service providers who process data for us under contract, such as hosting and content-delivery providers; other users in your own organisation or partner hierarchy, according to the roles and permissions set in the platform; and authorities or advisers where required by law or to protect our rights.

6. Storage and security

Data is transmitted over encrypted connections (HTTPS/TLS). Access and refresh tokens and other secrets are kept server-side, outside publicly accessible folders, and are not exposed to your browser. Access inside the platform is controlled by role: super admins, partner admins and client users each see only the accounts they are entitled to. No system is completely secure, and we will notify affected users and the relevant authority of a personal data breach as the law requires.

7. Where data is processed

Data may be processed on servers outside Kenya, and by the channels you connect, which operate globally. Where we transfer personal data across borders we do so in line with the Kenya Data Protection Act, 2019.

8. How long we keep data

We keep account and workspace data while your account is active. Google access and refresh tokens are kept until you disconnect Google or revoke access, then deleted. When an account is closed, or when you ask us to delete data, we delete or anonymise it within 30 days, except where we must keep certain records for legal, tax or security reasons. Routine backups are overwritten on their normal cycle.

9. Cookies and browser storage

We use essential cookies and browser storage (such as session storage) to keep you signed in and to remember workspace settings. We do not use them for third-party advertising. If we add analytics cookies, they will be optional and controlled through a cookie preference setting.

10. Your rights

Under the Kenya Data Protection Act, 2019, and similar laws that may apply to you, you can ask us to access the personal data we hold about you, correct it, delete it, restrict or object to certain processing, and give you a copy in a portable format. To make a request, email us at the address below. You also have the right to complain to the Office of the Data Protection Commissioner of Kenya (odpc.go.ke).

11. Children

Media Path is a business tool and is not intended for people under 18. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this policy as the product or the law changes. We will post the new version here with a new "last updated" date, and we will notify account holders of material changes.

13. Contact

5DM Africa, Nairobi, Kenya
Email: [email protected]