Data protection (GDPR)
Personal Data Protection Agreement (sharing between controllers)
Annex 1 to the Terms and Conditions for Clients. Version [1.0] of 29.09.2026
This is a courtesy translation. In case of any discrepancy between this text and the Romanian version, the Romanian version prevails.
1. The parties
1.1. Inventive Plus SRL , Ilfov Corbeanca Strada Primaverii 138A, VAT no. RO37119745 („Amplifyou”), the controller of the Amplifyou platform.
1.2. The company that has accepted the Terms and Conditions for Clients (the „Client”), identified in the client account.
1.3. The agreement enters into force upon acceptance of the Terms for Clients and remains in force for as long as the Client has access to the data, plus the obligations that survive (art. 13).
2. Definitions
The terms „personal data”, „processing”, „controller”, „processor”, „data subject”, „personal data breach” have the meaning given in Regulation (EU) 2016/679 („GDPR”). „Creator”, „Campaign”, „Collaboration”, „Order”, „Materials”, „Platform”, „User” have the meaning given in the Terms for Clients. „Shared data” = the data described in art. 3.
3. The shared data and its purpose
| Category | Data | Why the Client receives it |
|---|---|---|
| Identification | first name, last name [sau nume de scenă], county, city | identifying the proposed creator |
| Creator profile | content categories, social media accounts (username, link), portfolio, audience figures declared or measured automatically | assessing the fit with the Campaign; verifying publication |
| Collaboration | Materials uploaded, revisions, communications within the Platform relating to the Campaign, the status of the deliverables | approving the Materials; running the Campaign |
| Subsequent use | the Materials for which the Client has received usage rights, including the creator’s likeness where the Order provides for it | exercising the usage rights |
3.2. The Client does not receive: the email address, the telephone number, tax data (personal identification number, personal tax number, IBAN), the amounts paid to creators, the data of creators other than those relevant to its own Campaigns.
3.3. The shared data is accessed exclusively through the Platform, by the Client’s authorised Users, with personal authentication.
3.4. Contact details on request. If, for a specific Collaboration, the Client needs a Creator’s email address or telephone number (for example, in order to ship products or for attendance at an event), it requests that data through the Platform, stating the reason. Amplifyou transmits it only after the Creator has given explicit consent within the Platform for that request (art. 6 para. (1) point (a) GDPR); a Creator’s refusal is not communicated to the Client as a ground for exclusion. Data received in this way falls under all the obligations in art. 6, is used exclusively for that Collaboration and is deleted once it ends. It may not be used to contact the Creator for other collaborations, or outside the Platform for any other purpose.
4. The roles of the parties
4.1. Amplifyou is the controller for the collection of data from creators, the administration of the Platform and the making available of the data to the Client.
4.2. The Client is an independent controller for the processing it carries out with the Shared data for the purposes in art. 3: assessing creators, approving Materials, exercising usage rights. The Client is responsible for that processing under the GDPR.
4.3. Neither party acts as a processor of the other. [ALTERNATIVĂ art. 26 — vezi clauza opțională la final.]
5. Amplifyou’s obligations
5.1. It has a legal basis for making the data available to the Client: performance of the contract with the creator (art. 6 para. (1) point (b) GDPR); the creator is informed, through the Terms for Creators and the Privacy Policy, that their profile is visible to validated clients.
5.2. It informs creators, through the Privacy Policy, about the categories of recipients (the clients) and about the purposes.
5.3. It makes reasonable efforts to keep the data accurate; figures declared by creators are labelled as such, and Amplifyou does not guarantee their accuracy.
5.4. It limits the Client’s access to the creators relevant to its own Campaigns and to the data listed in art. 3.
5.5. It disables Users’ access at the Client’s request and upon closure of the account.
6. The Client’s obligations
6.1. Limited purpose. It processes the Shared data only for the purposes in art. 3. It is prohibited from: a) using it for direct marketing towards creators, profiling for other purposes, or automated decisions; b) combining it with other databases, or building lists or databases of creators; c) exporting, copying, downloading or storing it outside the Platform, with the exception of the Materials for which it holds usage rights and of the information strictly necessary for internal approval; d) contacting creators outside the Platform, directly or through third parties, for Campaigns or for future collaborations; e) disclosing it to third parties.
6.2. Third parties. It may give access to the Shared data to its own employees on a need-to-know basis and, only with Amplifyou’s prior written consent, to a media or PR agency working for the Client on that Campaign, provided that the agency is contractually bound to at least the obligations in this agreement. The Client is liable for the agency as for itself.
6.3. Security. It applies appropriate technical and organisational measures (art. 32 GDPR): personal accounts, strong passwords, two-factor authentication where available, prompt disabling of access for people who leave, training of Users, protection of devices.
6.4. Transfers. It does not transfer the Shared data outside the European Union / European Economic Area without appropriate safeguards under Chapter V GDPR and without informing Amplifyou in advance.
6.5. Data subjects. It respects creators’ rights in respect of its own processing. If it receives a request from a creator that concerns the Platform or Amplifyou’s processing, it forwards it to Amplifyou within 3 working days.
6.6. Materials and likeness. It uses creators’ Materials and likeness only within the limits of the usage rights set out in the Order (purpose, duration, territory, channels). Going beyond them is both a breach of contract and processing without a legal basis.
6.7. Records. It keeps records of processing (art. 30 GDPR) where it is under that obligation, and includes the Shared data in them.
7. Data subject requests
7.1. Each party responds to requests concerning its own processing. The parties cooperate: they forward requests received for the other party within 3 working days and provide the information needed for the response within 5 working days.
7.2. If a creator withdraws consent for the public directory or closes their account, Amplifyou informs the Client if the Client has Collaborations under way with that creator; usage rights already transferred are not affected, except in the cases set out in the Order.
8. Personal data breaches
8.1. The party that discovers a security breach concerning the Shared data notifies the other party within no more than 48 hours of discovery, stating: the nature of the breach, the categories and approximate number of persons and records affected, the likely consequences, the measures taken or proposed, and the contact person.
8.2. Each party assesses its own obligation to notify the Romanian supervisory authority, ANSPDCP (art. 33), and the data subjects (art. 34). The parties coordinate their public communications concerning the incident.
9. Retention and deletion
9.1. The Client deletes the Shared data stored outside the Platform (if any) within no more than 30 days of the completion or cancellation of the Campaign, with the exception of: the Materials for which it holds usage rights, for the duration of those rights; information it is required by law to keep; information necessary for the defence of a legal claim, for as long as necessary.
9.2. At Amplifyou’s request, the Client confirms the deletion in writing.
10. Verification
10.1. On request, no more than once a year, the Client provides Amplifyou with a written statement regarding compliance with this agreement and a description of the security measures applied.
10.2. Where there is reasonable suspicion of a breach (for example, a creator contacted directly by the Client), Amplifyou may request further information and may suspend the Client’s access to the data until the matter is clarified.
11. Data transmitted by the Client to Amplifyou
11.1. The Client transmits to Amplifyou the data of its Users (name, professional email, telephone, job title) and, where applicable, lists of people invited to events. The Client warrants that it has a legal basis for the transmission and that the persons concerned have been informed.
11.2. Amplifyou processes that data as a controller, in accordance with the Privacy Policy, for the administration of the client account, the running of Campaigns and the organisation of events.
12. Liability
12.1. Each party is liable for its own infringements of the GDPR and of this agreement, including for fines imposed by authorities and for compensation owed to data subjects through its own fault. Where both parties are liable towards a data subject (art. 82 para. (4) GDPR), the party that has paid has a right of recourse in proportion to fault.
12.2. The Client indemnifies Amplifyou against claims by creators, authorities or third parties caused by a breach of art. 6.
12.3. No cap applies to breaches of art. 6.1 and 6.4.
13. Duration and survival
The agreement applies for the duration of the client account. Art. 6, 7, 8, 9 and 12 survive for as long as the Client holds Shared data or Materials.
14. Miscellaneous
14.1. Romanian law. Jurisdiction: the court designated in the Terms for Clients.
14.2. Changes required by law or by an authority are communicated to the Client 30 days in advance.
14.3. The Romanian version prevails.
Optional clause — joint controllers (art. 26 GDPR) [se folosește numai dacă avocatul decide că selecția creatorilor e o prelucrare comună]
For the stage of assessing and selecting creators for a Campaign, Amplifyou and the Client are joint controllers. Amplifyou: collects the data, makes it available through the Platform, informs the creators, responds to creators’ requests and is the point of contact for them. The Client: assesses the profiles and communicates its preferences through the Platform. The essence of this arrangement is made available to creators in the Privacy Policy. Creators may exercise their rights against either party. For all other processing the parties remain independent controllers.