Privacy Policy

Last updated: June 9, 2025  ·  Effective: June 9, 2025

GUTU VADIM PERSOANĂ FIZICĂ AUTORIZATĂ, registered in Romania under registration number 1910128410069, having its registered address at Str. Castanilor nr.5 bl.C2 sc.A et.2 ap.42, Mun. Vaslui, Jud. VS, România ("PromoCreators", "we", "us", or "our"), is the data controller for the personal data collected through the PromoCreators platform and website (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Romanian law.

Please read this policy carefully. If you disagree with its terms, please discontinue use of the Service.

1. Data We Collect

1.1 Data You Provide Directly

When you register an account, set up a campaign, or contact us, we collect:

• Identity data: first name, last name
• Contact data: email address, phone number (optional)
• Account credentials: password (stored as a cryptographic hash — never in plain text)
• Company data (brands): company name, website, industry, company size, billing address
• Creator data: social media handles (Instagram, TikTok), follower count range, content categories, bio
• Financial data: bank account details for creator payouts; payment card data for brand billing (processed by our payment provider — we do not store raw card numbers)
• Communications: messages you send us via email or the contact form

1.2 Data Collected Automatically

When you use the Service, we automatically collect:

• IP address and approximate geographic location
• Browser type, operating system, and device identifiers
• Pages visited, links clicked, and time spent on pages
• Referring URLs
• Session and cookie data (see Section 5 and our Cookie Policy)

1.3 Data from Third Parties

We may receive data about you from payment processors and analytics providers acting as our data processors under data processing agreements.

2. Purposes and Legal Bases for Processing

We process your personal data on the following legal bases under Article 6 GDPR:

• Performance of a contract (Art. 6(1)(b)): to create and manage your account, process campaign payouts and billing, and provide all core platform features
• Legitimate interests (Art. 6(1)(f)): fraud detection and prevention, platform security, service improvement through aggregated analytics, and responding to support requests
• Legal obligation (Art. 6(1)(c)): compliance with Romanian and EU financial, tax, and anti-money-laundering obligations (e.g., retaining financial records for the period required by law)
• Consent (Art. 6(1)(a)): for marketing communications and non-essential cookies, where you have given explicit consent. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

3. How We Use Your Data

Specifically, we use your data to:

• Create and maintain your account and authenticate your sessions
• Process brand billing and creator payouts (including the 15-day anti-fraud hold)
• Send transactional emails: account confirmation, payout notifications, password resets
• Communicate with you about your account, campaigns, and support requests
• Detect, prevent, and investigate fraud and abuse
• Analyze aggregate usage trends to improve the Service
• Comply with legal and regulatory obligations

We do not sell your personal data to third parties, and we do not use it for automated individual decision-making with legal effects.

4. Data Sharing and Disclosure

We share your data only in the following circumstances:

• Service providers (data processors): hosting providers, payment processors, and email delivery services — under written data processing agreements that restrict their use of your data to the services they provide to us
• Between platform parties: brand campaign details (budget, payout rates, campaign description) are visible to creators who apply; creator profiles are visible to brands reviewing applications
• Legal requirements: if required by Romanian or EU law, court order, or government authority
• Business transfers: in connection with a merger, acquisition, or sale of assets — you will be notified in advance and given the opportunity to delete your account

5. Cookies and Tracking

We use cookies and similar technologies to operate the Service and analyze usage. For full details see our Cookie Policy. In summary:

• Strictly necessary cookies: required for login sessions and security — these cannot be disabled
• Analytics cookies: used to understand how the Service is used (requires your consent)
• Preference cookies: to remember your settings (requires your consent)

You can manage cookie preferences through your browser settings or our cookie consent banner. Disabling non-essential cookies will not affect your ability to use the core Service.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Upon account deletion, we delete or anonymize your personal data within 90 days, except:

• Financial and transaction records, which are retained for 10 years to comply with Romanian fiscal law
• Data we are required to keep by court order or regulatory authority

7. Your Rights Under GDPR

As a data subject, you have the following rights regarding your personal data:

• Right of access (Art. 15): request a copy of the personal data we hold about you
• Right to rectification (Art. 16): request correction of inaccurate or incomplete data
• Right to erasure (Art. 17): request deletion of your personal data, subject to legal retention obligations
• Right to data portability (Art. 20): receive your data in a structured, machine-readable format
• Right to object (Art. 21): object to processing based on legitimate interests
• Right to restriction (Art. 18): request restriction of processing in certain circumstances
• Right to withdraw consent: where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at support@promocreators.net. We will respond within 30 days. You also have the right to lodge a complaint with the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), the Romanian supervisory authority, at www.dataprotection.ro.

8. International Data Transfers

Our servers and some service providers may be located outside Romania or the EEA. Where we transfer personal data outside the EEA, we ensure appropriate safeguards are in place (e.g., EU Standard Contractual Clauses) as required by GDPR Chapter V.

9. Security

We implement appropriate technical and organizational measures to protect your personal data, including TLS encryption for data in transit, password hashing, access controls, and regular security reviews. In the event of a personal data breach affecting your rights, we will notify you and the ANSPDCP as required by GDPR Article 33–34.

10. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by updating the "Last updated" date above at least 14 days before changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

12. Contact Us

For any questions about this Privacy Policy or to exercise your data rights, contact us:

• Email: support@promocreators.net
• Mail: GUTU VADIM PERSOANĂ FIZICĂ AUTORIZATĂ, Str. Castanilor nr.5 bl.C2 sc.A et.2 ap.42, Mun. Vaslui, Jud. VS, România