Privacy

1. Who is responsible for your information

Connektik Sarl-S, 21, rue Charles Rausch, L-7247 Helmsange, Luxembourg, is the controller for the personal data it processes to operate BrandsOnMe.

Contact / Help is our main contact route. You may also write to the postal address above or email [email protected]. Please identify a privacy request as such.

This notice covers visitors, account users, creators, sponsor representatives, and people who contact us or appear in campaign material. It explains our processing; it is not a request for blanket consent.

2. Information we collect and where it comes from

• Account information: name, email address, password hash, language, marketing preference, account status, and records of the terms accepted.
• Public creator and campaign information: public name, biography, city/country, profile photo, clothing images, event details, advertising spots, and published descriptions. Public content may be viewed internationally and indexed by search engines.
• Business information: sponsor business identity, registration and VAT details, billing address, billing contact, team membership, brands, artwork, and permissions. A business contact's details can be personal data.
• Private creator information: legal identity, age/date of birth, address, tax residence, tax identifiers, business/VAT status, verification records, and payout-account status. Identity checks may require further information through a separately identified verification process.
• Transactions and delivery: reservations, payments, refunds, invoices, credit notes, creator earnings, evidence files, social-post links, review outcomes, disputes, and support correspondence.
• Technical and security information: session identifiers, access times, browser/device information, network addresses in relevant logs, security events, and audit records. Optional event check-ins can include precise location only when you choose to share it.
• Sources include information you supply, sponsor colleagues who invite you or manage the business account, creators or sponsors submitting evidence, relevant public business/VAT records, and payment/verification providers supplying transaction or eligibility updates.

3. Why we use it

Where we rely on legitimate interests, we consider the effect on your rights and use safeguards appropriate to the information. These interests do not automatically override your rights.

We identify mandatory fields when collecting information. Without necessary account, tax, verification, billing, or payout information, we may be unable to provide the relevant function. Optional marketing or location consent is not a condition of opening an account.

Where DAC7 or another applicable reporting law requires it, creator identification and reportable financial information is supplied to the competent tax authority and may be exchanged with other authorities. Applicability depends on the legal rules and our operating model; collecting tax data does not mean every creator is reportable.

4. Who can receive your information

Information is accessible to personnel and service providers who need it for their assigned tasks. Providers may support hosting, databases, file storage, email, payments, verification, security, and professional advice. We use appropriate contracts where a provider processes data on our behalf.

Relevant sponsor organization members can access the business records their role permits. Winning sponsors may receive the evidence needed to assess their campaign. Public profiles and published campaign content are visible to visitors. Private tax data, identity information, and precise location are not intended for public display.

Stripe processes payment and payout information and provides us with identifiers and status information needed to administer transactions. Its role can be processor or independent controller depending on the activity. Card details are entered in Stripe's payment interface; we do not need your full card number in a help request.

We may disclose information where required by law or a valid authority request, or where necessary and lawful to establish or defend a claim. We do not sell personal data or provide it for unrelated third-party advertising through BrandsOnMe.

The website, database, and uploaded files are hosted on our Hetzner server in Frankfurt, Germany. Mailgun provides transactional email delivery and processes recipient addresses, message content, and delivery information. Stripe provides payment processing.

• Mailgun privacy information
• Stripe privacy information
• Stripe's data-processing agreement and description of its roles

5. International processing

International users and providers can involve processing outside the European Economic Area. Where GDPR transfer rules apply, we use an applicable adequacy decision or appropriate safeguards such as standard contractual clauses, with additional measures where required. A provider's presence in Europe does not by itself mean all processing stays in Europe.

Mailgun and Stripe arrangements can involve the United States and other countries. Its applicable transfer terms must be assessed for the services we use. Ask us for information about the relevant safeguards and how to obtain a copy, with confidential information protected where appropriate.

Additional privacy rights may apply under the mandatory law of your country. Contact us about international processing or the safeguards applying to your information.

6. How long we keep information

We retain data only for the purposes that justify it, taking account of the relationship, outstanding payments, disputes, legal duties, and relevant limitation periods. Closing an account does not require the erasure of records we must lawfully keep. Data retained for a restricted purpose is not thereby available for unrelated marketing.

Luxembourg accounting records within the statutory requirement are generally retained for 10 years from the end of the financial year concerned. This does not justify retaining every profile photograph, location point, or security log for 10 years. A legal hold can require relevant records to be kept longer.

Account/profile data is needed while the account is active; after closure, we assess deletion or anonymisation and isolate information still needed for legal or contractual reasons. Campaign evidence is retained for delivery review and proportionate dispute handling, rather than indefinitely by default.

Precise location, raw verification material, technical logs, and backups require their own limited schedules. Marketing consent and opt-out records may be kept as needed to demonstrate and respect your choices. We assess each category against the period needed for verification, delivery review, security investigation, or recovery, and any specific legal retention duty.

7. Cookies and similar technologies

BrandsOnMe uses necessary cookies for sign-in, session handling, and security. The current application sets an authentication cookie called session_token for up to 30 days for ordinary accounts and up to 8 hours for administrator accounts. The application also uses a session cookie to remember the sign-in return path and current workflow. Signing out invalidates the current authentication session.

The application does not currently include an audience-analytics or advertising-tracking integration. If non-essential tracking is introduced, it must be explained and obtain prior consent where required; refusal must not prevent use of functions that do not need it.

Live checkout loads Stripe's payment technology. Payment-provider cookies support the payment session and fraud prevention. Cookie necessity depends on actual use, not simply a provider's label. Browser controls can remove cookies, but blocking necessary cookies can prevent sign-in or checkout.

8. Your rights and choices

Subject to the applicable conditions, you may request access, correction, erasure, restriction, or portability of your personal data and object to processing based on legitimate interests. You may object to direct marketing at any time. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.

Use Contact / Help, the direct email, or the postal address above. We may request proportionate information to verify your identity.

We respond without undue delay and normally within one month. Where legally permitted, complexity or the number of requests can justify up to two additional months; we will inform you within the initial month and explain why. Requests are normally free, subject to the limited exceptions allowed by law.

You may complain to Luxembourg's Commission nationale pour la protection des données (CNPD), or to another competent supervisory authority, including in your country of habitual residence or work. You do not have to contact us first.

• CNPD — data protection authority in Luxembourg

9. Security and automated checks

We use access controls, protected authentication, and encryption of designated private fields to reduce unauthorised access. No system can guarantee complete security. Do not send passwords, full payment-card details, government ID, or unnecessary sensitive information through ordinary help forms.

Automated checks can flag files, reject an invalid payment attempt, identify missing information, or prevent a transaction until eligibility conditions are met. Creators publish complete campaigns themselves. Reviewers assess delivery evidence and investigate reported or suspicious content. If a check affects you, contact us for an explanation and human review where appropriate. Any rights relating to solely automated decisions with legal or similarly significant effects are preserved.

Creators must avoid unnecessary personal information about other people in campaign material. If you appear in content and have a privacy concern, send us the precise link and enough information to locate the material.

10. Changes to this notice

We keep this notice consistent with the service and show its version and publication date. Significant changes will be brought to users' attention as appropriate. A changed notice does not by itself supply consent for a new purpose requiring consent.

11. Legal references

• GDPR — principles, legal bases, and consent
• GDPR — information and individual rights
• GDPR — international transfers
• CNPD — cookie rules
• CNPD — scope of Luxembourg accounting retention
• Luxembourg tax authority — DAC7 reporting