Who is the data controller
The controller of your personal data is NanoBuzz sp. z o.o., ul. Kościelna 45B/14, 60-537 Poznań, Poland, entered in the National Court Register under KRS 0001131220, NIP 7812077628, REGON 529868223.
For any privacy matter, including exercising your rights described below, write to us at kontakt@nanobuzz.agency (given here as plain text) or by post to the registered office address, marking your letter "data protection".
What data we process
We process the following categories of data, depending on how you use the Club:
- Application data: name, contact details, social media handles, niche and audience description you submit in the join form
- Account data: login details, profile information and settings in the creator panel or client portal
- Campaign collaboration data: briefs accepted, content drafts, publication links, shipping addresses for creator packs, payout and invoicing details
- Social media statistics: audience and performance metrics collected with your consent to match you with campaigns and report results
- Cookies and analytics data: usage data collected on the website subject to your choices in the consent banner, with Google Consent Mode applied
Purposes and legal bases
We process your data to review applications and operate your membership, to arrange and run campaign collaborations including shipping and payments (performance of a contract, Article 6(1)(b) GDPR), to comply with accounting and tax obligations (legal obligation, Article 6(1)(c)), to analyse and improve the website and platform and to establish or defend legal claims (legitimate interest, Article 6(1)(f)), and to collect social statistics and use non-essential cookies (consent, Article 6(1)(a)). Consent can be withdrawn at any time without affecting prior processing.
How long we keep your data
Application data of creators who are not accepted is kept for up to 12 months, unless you consent to a longer period for future recruitment. Account and collaboration data is kept for the duration of your membership and afterwards as long as required for accounting, tax and potential claims, generally up to 6 years. Analytics data is kept according to the retention settings of the tools listed below. When a retention period ends, data is deleted or anonymised.
Who we share data with
We use carefully selected processors bound by data processing agreements: hosting and infrastructure providers, Supabase (database and authentication for the app), analytics providers operating under Consent Mode, courier companies for creator pack delivery, and accounting services. Brand clients see campaign collaboration data in a client-safe form needed to run their campaign. Some providers may process data outside the European Economic Area; where that happens, we rely on appropriate safeguards such as Standard Contractual Clauses.
Your rights
Under the GDPR you have the right to access your data and receive a copy, to rectify inaccurate data, to erasure, to restriction of processing, to data portability, and to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warszawa. To exercise any right, contact us as described above; we respond within the deadlines set by the GDPR.