Update: cookies and data protection contact, 7 September 2026
This section supplements the V3 notice below for website measurement and contact details. It does not rewrite earlier consent or application-data retention terms. The controller is NanoBuzz sp. z o.o., ul. Kościelna 45B/14, 60-537 Poznań, Poland, KRS 0001131220, NIP 7812077628, REGON 529868223.
Data Protection Officer: Jarosław Szymczak. For data matters relating to NanoBuzz.club and NanoBuzz.agency, contact gdpr@nanobuzz.agency. You may also write to the registered office, marked “data protection”.
Necessary storage
Supabase sign-in, form security and information needed to resume an application provide the service you request. They do not depend on advertising consent. We also store your cookie choice (nb_consent_v1) for up to 180 days. Consent is not copied between domains. Refusing optional cookies does not block applications, sign-in or campaign participation.
Analytics and marketing: separate choices
Analytics runs only after voluntary consent: Google Analytics 4, delivered through Google Tag Manager, measures public page visits and application outcomes. Reports distinguish Club, agency, creator and client journeys. Our event payloads exclude names, emails, phone numbers, form text, URL queries and private-page identifiers. Tags do not run in private workspaces, sign-in pages or private-token response links.
Marketing requires a separate choice. TikTok Pixel may measure selected public campaign pages; TikTok Events API may confirm an application using an event identifier for deduplication and an advertising click identifier when available. We do not add contact information to these events. The Pixel does not load on pages carrying URL parameters or fragments. Google and other advertising tags run only within the marketing choice and the scope of each tag. Cookie consent is separate from email, SMS, community or campaign choices.
Optional processing and device access rely on consent (Article 6(1)(a) GDPR and applicable cookie rules). No external measurement scripts are downloaded before a choice. Reject and accept are offered at the same level. Open “Cookie settings” at any time to change categories or withdraw consent; reloading stops tags already loaded. Withdrawal does not affect prior lawful processing.
Providers, periods and your rights
Providers include Vercel (hosting), Supabase (data and authentication), Google (Tag Manager and Analytics), and TikTok where marketing consent applies. Typical Google _ga cookies may last up to two years and TikTok _ttp up to 13 months; periods depend on provider settings and may be shortened by the browser or withdrawal. Technical data includes device and connection information; providers may receive an IP address as part of a connection. Processing outside the EEA relies on an applicable transfer mechanism, such as an adequacy decision or Standard Contractual Clauses, depending on the recipient. Ask the Data Protection Officer for details of safeguards and retention.
Your rights include access, correction, deletion, restriction, portability, objection where applicable and withdrawal of consent. You may complain to the President of UODO, ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland. UODO
Addendum dated 16 September 2026: contract delivery and signing
For contracts, we record the personal link source, unverified technical opening, document interaction, signature-form start and confirmed acceptance. This supports contract delivery, administration and verification, and contact reliability (GDPR Article 6(1)(b) and (f)). Opening or clicking a link is not a signature. This measurement uses no cookies, fingerprinting or third-party trackers, and does not copy IP addresses, national identity numbers or emails into measurement records. Detailed measurement events are deleted after 90 days; aggregate counts contain no creator identifiers. Contract evidence and correspondence follow the separate retention rules in this policy.
Who is the data controller
The controller of your personal data is NanoBuzz sp. z o.o., ul. Kościelna 45B/14, 60-537 Poznań, Poland, entered in the National Court Register under KRS 0001131220, NIP 7812077628, REGON 529868223.
For any privacy matter, including exercising your rights described below, write to us at kontakt@nanobuzz.agency (given here as plain text) or by post to the registered office address, marking your letter "data protection".
What data we process
We process the following categories of data, depending on how you use the Club:
- Application data: name, contact details, social media handles, niche and audience description you submit in the join form
- Account data: login details, profile information and settings in the creator panel or client portal
- Campaign collaboration data: briefs accepted, content drafts, publication links, shipping addresses for creator packs, payout and invoicing details
- Social media statistics: audience and performance metrics collected with your consent to match you with campaigns and report results
- Cookies and analytics data: usage data collected on the website subject to your choices in the consent banner, with Google Consent Mode applied
Purposes and legal bases
We process your data to review applications and operate your membership, to arrange and run campaign collaborations including shipping and payments (performance of a contract, Article 6(1)(b) GDPR), to comply with accounting and tax obligations (legal obligation, Article 6(1)(c)), to analyse and improve the website and platform and to establish or defend legal claims (legitimate interest, Article 6(1)(f)), and to collect social statistics and use non-essential cookies (consent, Article 6(1)(a)). Consent can be withdrawn at any time without affecting prior processing.
How long we keep your data
We maintain an ongoing register of applications and collaboration history, including applicants who were not selected. For new applications covered by this notice, we do not automatically delete the whole application or its address merely because 14 days have passed. This does not permit or promise retention forever. Each category is kept only for as long as necessary for its specific purpose and lawful basis. We review retention periodically, respect your rights and delete or anonymise data that is no longer needed.
Application details are used while reviewing the application and resolving its outcome. We may then retain a limited history of decisions and contact where necessary for accountability, preventing misuse or legal claims, subject to an assessment of legitimate interests and your rights under Article 6(1)(f) GDPR. This does not automatically justify keeping the entire form, every message or an address for the same period. Future matching within the voluntary community relies on the separate choice described at sign-up and ends when that consent is withdrawn or its purpose ends, apart from any limited evidence lawfully needed for claims.
An address supplied before selection is for preparing a possible shipment. Its continued necessity is assessed separately from application history. Once the logistical need ends, we keep it only for another specific purpose with a proper lawful basis; otherwise we delete or anonymise it. We reconfirm the address before every new shipment. A database entry does not authorise shipment.
Account data is kept while you use the account and afterwards only as required by law or needed for legal claims. Accounting and tax documents follow the applicable statutory periods, generally five years from the end of the relevant tax year, including any statutory extension, suspension or interruption. Cookie and analytics data follows the periods disclosed in the consent settings.
Community participation, future commercial email and future commercial SMS are separate, optional choices. Declining them does not affect a current campaign application. Retaining a record is not marketing consent. You can withdraw the relevant choice through our contact page or an available account function. Data needed under another lawful basis may remain, but withdrawal ends marketing in that channel.
This update does not rewrite earlier notices or consents. In particular, it does not automatically extend a previously stated 14-day address period or the 12-month period in the earlier English notice. Earlier records require a separate review of the information originally provided, the purpose, lawful basis and necessary scope. Before a new use, we assess compatibility and provide the required information. Publishing a new notice is not fresh consent. The historic N1165 flow still records V2 acknowledgements; these refer to the archived V2 text and are not V3 acknowledgements.
Who we share data with
We use carefully selected processors bound by data processing agreements: hosting and infrastructure providers, Supabase (database and authentication for the app), analytics providers operating under Consent Mode, courier companies for creator pack delivery, and accounting services. Brand clients see campaign collaboration data in a client-safe form needed to run their campaign. Some providers may process data outside the European Economic Area; where that happens, we rely on appropriate safeguards such as Standard Contractual Clauses.
Your rights
Under the GDPR you have the right to access your data and receive a copy, to rectify inaccurate data, to erasure, to restriction of processing, to data portability, and to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa. To exercise any right, contact us as described above; we respond within the deadlines set by the GDPR.