Privacy policy
Draft — Privacy Policy of the Amplifyou platform
Version [1.0], in force from 29.08.2026.
This is a courtesy translation. In case of any discrepancy between this text and the Romanian version, the Romanian version prevails.
1. Who we are
1.1. The Amplifyou.ro platform (the „Platform”) is operated by Inventive PLUS SRL, with its registered office in Corbeanca, strada Primaverii nr. 138A, trade register no. J2017000738237, VAT no. RO37119745, email hello@amplifyou.eu, („we”, „Amplify”). We are a marketing agency.
We operate the Amplifyou platform, available at www.amplifyou.eu and on its subdomains.
For any question about your data: dpo@amplifyou.eu. Data protection officer: dpo@amplifyou.eu.
2. Who this policy is addressed to
- content creators with an account on the Platform (section 3);
- people who use the Platform on behalf of a client/brand (section 4);
- attendees of the events published on the Platform (section 5);
- visitors to the website and people who contact us (section 6);
- people who appear in creators’ materials (section 7).
The common rules (recipients, transfers, retention, security, rights) are in sections 8–13.
3. Creators
3.1. What data we process
| Category | Data | Source |
|---|---|---|
| Identification and contact | first name, last name, email, telephone, county, city | from you |
| Creator profile | content categories, social media accounts (username, link), portfolio, profile photograph, declared audience figures | from you |
| Measured audience figures | the number of subscribers and views of the YouTube channel added to the profile | from YouTube API Services (Google), based on the channel you added |
| Tax data for payment | status (natural person, sole trader/family business, company), name, personal identification number or tax number, address, IBAN, supporting documents | from you |
| Collaborations | applications to campaigns, accepted orders (version, date, time, IP address), materials uploaded, revisions, communications within the Platform, amounts due and payment status | from your use of the Platform |
| Consents | consent for the public directory, per category; consent for marketing, with the date, time, version of the text and IP address | from you |
| Technical data | IP address, type of device and browser, log of the actions in the account (audit log) | from your use of the Platform |
| Data taken over from the previous platform | see the separate Notice (Doc 1) | from the previous version of our platform (www.amplifyou.ro), also operated by Inventive Plus SRL |
3.2. Why we process it and on what legal basis
| Purpose | Legal basis (art. 6 para. (1) GDPR) | Note |
|---|---|---|
| Creating and administering the account, authentication, security | point (b) — performance of the contract (the Terms for Creators) | |
| Publishing campaigns, applying, selection, issuing and accepting orders | point (b) | |
| Displaying the collaboration profile to clients with a validated account | point (b) — the purpose of the account is for you to be proposed to clients | without email, telephone or tax data; the email address or telephone number are transmitted to a client only at the client’s request, for a specific collaboration, with your explicit consent given within the Platform for that request (point (a)); a refusal does not affect the collaboration |
| Applying the selection filters (category, county, audience) | point (b) | the selection is made by our team, not by an algorithm |
| Automatic measurement of the YouTube figures | point (f) — the legitimate interest in showing clients accurate figures | public data; you may object by removing the channel from your profile |
| Appearing in the public creator directory | point (a) — consent, per category | revocable at any time from your account |
| Paying for collaborations, tax returns, accounting records | point (c) — legal obligation (the Romanian Fiscal Code, Law no. 82/1991) | the personal identification number is processed in accordance with art. 4 of Romanian Law no. 190/2018, with restricted access |
| Storing the materials and transmitting them to the client | point (b) | |
| Service communications (activation, orders, revisions, payments, changes to the terms) | point (b) | |
| Notifications about new campaigns in your categories | point (b), with the option to turn them off | |
| Newsletter and marketing | point (a) — consent; art. 12 of Romanian Law no. 506/2004 | |
| Audit log, fraud prevention, system security | point (f) — the legitimate interest in protecting the Platform and in being able to show what happened | |
| Demonstrating acceptance of the terms and the consents given | points (f) and (c) (art. 7 para. (1) GDPR) | |
| Defending our rights in disputes | point (f) | |
| Responding to requests from authorities | point (c) |
3.3. Mandatory data. Without a name, email, categories and at least one social media account we cannot create the profile. Without tax data we cannot pay you. The rest is optional.
3.4. YouTube API Services. The Platform uses YouTube API Services for the figures of YouTube channels. By adding a channel you accept the YouTube Terms of Service and acknowledge the Google Privacy Policy https://policies.google.com/privacy. Data obtained through the API is refreshed or deleted within no more than 30 days. You may remove the channel from your profile at any time; the measured data is deleted at the next refresh.
4. Users belonging to clients (brands)
4.1. Data: first name, last name, professional email, telephone, job title, the company represented, authentication data, actions within the Platform (audit log), approvals and comments on materials, IP address.
4.2. Purposes and legal bases: administering the company’s account and access (points (b) and (f) — the contract is with the company, the legitimate interest is in managing the relationship through the designated persons); service communications (point (f)); demonstrating approvals and acceptance of the terms (point (f)); B2B marketing (point (f) or point (a), depending on the channel, with a right to object); security (point (f)); legal obligations (point (c)).
4.3. Users’ contact details are not visible to creators. Creators see the client’s name and, if the client so chooses, the name of the contact person for the campaign.
5. Event attendees
5.1. Data: first name, last name, email, telephone or other fields from the registration form; if you have an account: the link to that account; your position on the waiting list; the QR-code ticket; attendance recorded at the entrance (date, time); payment status, marked manually by our team, if the event is a paid one; photographs and video recordings made during the event.
5.2. Purposes and legal bases: registration, the waiting list, issuing the ticket, access control (point (b) — the attendance contract); payment records and invoicing (points (c) and (b)) — payment is not made through the Platform, and the invoice is issued from our invoicing system; communications about the event (point (b)); invitations to future events (point (a) — separate consent); photographs and filming at the event, used to document and promote the event and the Platform (point (f) — legitimate interest; you are informed at registration and at the entrance and may object at dpo@amplifyou.eu, in which case we do not use your image or we remove it from future materials).
5.3. If the event is organised for a client, we say so on the event page. The client receives the list of attendees, as a separate controller, in accordance with our agreement with it.
5.4. Events are intended for people over 18 years of age.
6. Website visitors and people who contact us
6.1. Technical data: IP address, date and time, the page accessed, the browser and operating system, the referring page — in the server logs. Legal basis: point (f) — security and operation. Cookies are described in the Cookie Policy .
6.2. Contact: the name, email, telephone and the content of the message sent through the form or by email. Legal basis: point (f) — the interest in responding, or point (b) if the message concerns a contract.
7. People who appear in creators’ materials
Creators are responsible for obtaining the consent of the people they film or photograph. We store the materials in order to deliver the campaigns (points (b) and (f)). If you appear in a material and wish it to be removed, write to dpo@amplifyou.eu; we will handle the request together with the creator and the client.
8. How long we keep the data
| Data | Retention period | Basis |
|---|---|---|
| Creator account and profile | the duration of the account + 3 years after closure | the general limitation period (art. 2517 of the Romanian Civil Code); defence of rights |
| Orders, contracts, payment records, tax data, invoices | 5 years from the close of the financial year in which they were drawn up | Romanian Law no. 82/1991 art. 25, the Fiscal Procedure Code |
| Accounts taken over from the old platform, not activated | 90 days from the activation email, then deletion | storage limitation |
| Public directory | until consent is withdrawn; proof of consent: 3 years after withdrawal | art. 7 para. (1) GDPR |
| Consent to pass contact details to a client | for the duration of that collaboration; proof: 3 years | art. 7 para. (1) GDPR |
| Measured YouTube figures | refreshed or deleted within no more than 30 days | Google’s developer policies |
| Materials from collaborations | for the duration of the rights granted to the client + 3 years | performance of the contract; defence of rights |
| Audit log | 3 years from the entry; when an account is deleted, the personal identifiers in the log are pseudonymised | legitimate interest; the log is not edited and is not selectively deleted during that period |
| Server logs | 12 months | Security |
| Users belonging to clients | the duration of the company’s account + 3 years | as for creators |
| Event attendees | 12 months after the event; the waiting list: 30 days after the event | performance of the contract; defence of rights |
| Photographs and filming from events | 3 years | legitimate interest |
| Marketing consent | until withdrawal; proof: 3 years after withdrawal | art. 7 GDPR |
| Contact messages | 2 years | legitimate interest |
Once the period expires, the data is deleted or anonymised. Backup copies are overwritten within no more than 60 days after deletion.
9. Who we pass the data to
9.1. Processors (they process on our behalf, on the basis of a contract compliant with art. 28 GDPR, and may not use the data for any other purpose):
| Provider | Service | Location |
|---|---|---|
| Hetzner | hosting of the Platform and file storage | Germany (EU) |
| Brevo SAS (Paris, France) | sending transactional emails | European Union: France and Germany, Google cloud in Belgium (according to Brevo’s documentation) |
| Documents Storage Solutions SRL | accounting and tax returns | Romania |
9.2. Independent controllers (they process under their own responsibility):
- clients (brands) with a validated account: they see creators’ collaboration profiles (name, county/city, categories, social media accounts, portfolio, audience figures). They are bound by contract with us to use the data only for assessing and running campaigns through the Platform and not to contact you outside it;
- Google (YouTube API Services): when we measure the figures of a YouTube channel, Google receives our request; we do not transmit your Platform data to Google;
- the social networks on which you publish the content: you carry out the publication yourself, under their terms;
- lawyers, auditors, bailiffs: where necessary for the defence of rights;
- public authorities (ANAF, the courts, ANSPDCP, the police): where the law requires it of us.
9.3. We do not sell or rent personal data.
10. Transfers outside the European Union / European Economic Area
The Platform and the files are stored in Germany. The email provider Brevo hosts the data in the European Union (France, Germany, Belgium), according to its documentation; the list of sub-processors in the Brevo processing agreement is checked for any transfers. You may request a copy of the safeguards at dpo@amplifyou.eu. Google LLC processes the requests to the YouTube API in the United States; Google LLC
11. Security
Main measures (art. 32 GDPR): two-factor authentication, mandatory for our team and available to all users; role-based access (team, creator, client), with separate panels; tax data (personal identification number, IBAN) visible only to the members of the team who make the payments, and not displayed on other screens; encryption of transmissions (HTTPS) and of backup copies; an audit log that cannot be modified or selectively deleted; storage exclusively within the European Union; contracts with all providers. If a security breach occurs that may affect you, we inform you in accordance with art. 34 GDPR and notify ANSPDCP within 72 hours (art. 33).
12. Your rights
| Right | What it means | How you exercise it |
|---|---|---|
| Access (art. 15) | to know what data we hold about you and to receive a copy | from your account: Settings → Export my data; or by email |
| Rectification (art. 16) | correction of the data | directly from your account or by email |
| Erasure (art. 17) | deletion of the data, except for the data the law requires us to keep (art. 8 above) | from your account: Settings → Delete my account; or by email |
| Restriction (art. 18) | „freezing” the data while we examine a challenge | by email |
| Portability (art. 20) | receiving the data you provided in a structured format (JSON/CSV) | from your account: Export my data |
| Objection (art. 21) | to object to processing based on legitimate interest, including direct marketing | by email; for marketing, the unsubscribe link |
| Withdrawal of consent (art. 7) | for the public directory, marketing, cookies; it does not affect earlier processing | from your account or from the banner |
| Automated decisions (art. 22) | we do not take decisions based solely on automated processing that produce legal effects concerning you | — |
Requests: dpo@amplifyou.eu or Aviatorilor 51-53 Sector 1 București. We respond within no more than one month of receipt; the period may be extended by two months for complex requests, with notice to you. We may ask you to verify your identity. Requests are free of charge; for manifestly unfounded or repetitive requests we may charge a reasonable fee or refuse (art. 12 para. (5)).
Complaints: the Romanian National Supervisory Authority for Personal Data Processing, B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, București, www.dataprotection.ro, anspdcp@dataprotection.ro. You also have the right to bring proceedings before the courts.
13. Minors
The Platform does not accept accounts for people under 18 years of age. If we learn that we hold a minor’s data obtained without a right to do so, we delete it. Parents may write to dpo@amplifyou.eu
14. Cookies
See the Cookie Policy https://amplifyou.eu/confidentialitate. At present we use only strictly necessary cookies. When we add analytics and marketing tools, we will activate them only with your consent.
15. Changes
We publish the new version on the Platform and, for significant changes, we notify you by email before it comes into force. Previous versions remain available on request.
16. Language
The policy is available in Romanian and English. In the event of any discrepancy, the Romanian version prevails.