Privacy policy

Crenzy Creativity S.R.L., VAT no. RO42954326, 63 Grigore Ionescu Street, Bucharest. Requests regarding personal data are sent to office@zeff.ro.

Account data: first and last name, email address, password (stored encrypted), language and display preferences.

Creator profile data: city, niches, languages spoken, equipment, video portfolio, rates and availability. For verifying independent Creators, visible only to the Operator's team: full name, date of birth, phone number, social media accounts, the series and number of the identity document and the contract signed in the Platform (the identification details in it, the name typed as a signature, the date, time and IP address).

The image, voice and first name of Creators as they appear in the portfolio and in Project Content, and those of the people appearing in the Content, for whom the Creator warrants having their consent.

Data about Creators represented by a Creator Agency: the profile, portfolio, rates and data needed for Projects are entered by the agency, which warrants that it has the Creators' consent or another legal basis to provide them. If the agency invites them, the Creator receives their own account at the email address provided by the agency. When a Creator joins an Agency, their payment and tax details are removed from the account, and their earlier Projects and amounts do not become accessible to the Agency. When the representation ends, the Projects and amounts from the representation period remain with the Agency, and the Creator sees them without amounts.

Tax and payment data: billing details, tax identification number, bank account and, for private individuals, the data required for the assignment contract and tax filings.

Creator Agency data: name, tax number, billing details, bank account and the people in the agency's team. For creators and companies outside Romania: the country, the foreign tax number, the SWIFT/BIC code and, where applicable, the tax residence certificate. Tax numbers are checked in the public ANAF and VIES registers.

For Creators with whom the Operator signed a contract outside the Platform and for accounts prepared by the Operator's team at the request of a company or a creator: the contract, if any, kept in private storage accessible only to the Operator's team, and the data needed to prepare the account (the name, the email address and, for companies, the tax number checked with ANAF or in VIES). The account becomes active only after its holder opens it from the link received by email.

Company data: name, tax number, contact person, verification data.

Usage data: messages and files exchanged in Projects, the history of deliveries and approvals, a technical log (IP address, the city, region and country approximately derived from the IP address, device type, browser and operating system, the time of visits and actions), needed for account security, preventing fraud and duplicate accounts, and proving the acceptance of contracts. The visit log is kept for 12 months.

Website statistics: the page visited, the source of the visit, the country, the device type and the browser, counted with an anonymous identifier that changes every day; the IP address is not kept and no cookies are used. For signed-in users, the visit is linked to the account and its type, so the team can see who is using the Platform at that moment.

Phone or browser notifications: if the user turns them on, the technical address of the browser subscription, used only to send the notifications.

Error log: when a page, a save or an upload fails, we keep the technical error message, the page, the browser and, if the user is signed in, the account and its type, so we can fix the problem. The team receives an email without personal data, only the account type.

Sign-up log: for each sign-up step (the form, the confirmation link, creating the account) we keep the time, the result, the email address used, the account type chosen, the technical code of any error and the browser, so we can help anyone who cannot sign up and fix any problem quickly.

Reports of illegal content: the name and email address of the reporting person, the reported content, the reasons and the decision taken.

Messages sent through the contact form: the name, the email address, the company or brand if provided, the topic, the message and the site language. To limit abusive submissions we keep a cryptographic fingerprint of the IP address, from which the address cannot be recovered.

Providing the service, including contracting, payment and delivery of Projects: performance of a contract (art. 6(1)(b) GDPR).

Displaying Creators' public profile and portfolio on the Platform and in the public catalogue, if the Creator chose to appear in it, and delivering the Content to the Brand with the license: performance of a contract.

Verifying Creators and companies, including Creators' identity and age, fraud prevention and Platform security: the Operator's legitimate interest (art. 6(1)(f)).

Website statistics, without cookies and without identifying visitors: the Operator's legitimate interest in understanding how the Platform is used.

Project messages are processed automatically so that contact details do not appear in conversations: the Operator's legitimate interest in Projects being contracted and paid in the Platform, with protection for both sides.

The performance score of Creators and Brands, calculated from activity on the Platform (deadlines, payments, cancellations, reviews, disputes, attempts to communicate outside the Platform), for the quality and safety of collaborations: performance of the contract and the Operator's legitimate interest. The score has no effect on its own: warnings and the termination of an agreement are decided by a person on the Operator's team.

The badges displayed on profiles (for example on-time delivery, rating or completed projects), calculated daily from the same activity and from reviews, to show other users the results achieved on the Platform: the legitimate interest of the Operator and of the users. The account holder chooses which badges are displayed. Badges have no legal effect and do not limit access to the Platform.

Invoicing, accounting records and tax obligations: legal obligation (art. 6(1)(c)).

Communications about the account and Projects: performance of a contract. Commercial communications are sent only with consent, which may be withdrawn at any time.

Reviewing reports of illegal content, moderation and appeals: the legal obligation under Regulation (EU) 2022/2065 on digital services.

Replying to messages sent through the contact form and limiting abusive submissions: the legitimate interest of the Operator in answering the requests it receives (art. 6(1)(f)) or, where the message concerns entering into a contract, steps taken at the request of the data subject (art. 6(1)(b)).

Data is processed by providers acting on the Operator's behalf under data processing agreements: application hosting (Vercel, servers in the European Union), database and file storage, including videos (Supabase, European Union), card payment processing (Stripe), email delivery (Resend), courier services (Sameday) for shipping products within Romania, invoicing (Oblio). To ship a product, the Creator's name, phone number and delivery address (or chosen easybox) are sent to the courier and appear on the AWB label printed by the Brand. When the product is shipped outside Romania or by a Brand from another country, the Brand receives these details for that parcel and ships it with the courier of its choice.

Phone or browser notifications pass through the browser's notification services (Apple, Google, Mozilla), which receive only the notification text. Tax numbers are checked in ANAF's public registers and in the European Commission's VIES system.

Brands see about Creators: first name, city, country, niches, portfolio, level, rating and the badges displayed; for represented Creators, the mention "Verified creator agency", without the agency's name. Creators who chose to appear in the catalogue are also visible to the other Creators on the Platform, with the same public profile, portfolio, rating and rates (the amounts due to them, without the Platform's costs). Creators' contact details are not displayed to Brands. Creators see the Brand's name, the brief and the Brand's page, with its description, rating from Creators and the badges displayed; from the company check, only whether the company is active, its legal form and the year it was founded, without the tax ID, address or financial data.

The Creator Agency sees the data of the Creators it represents, their Projects and the amounts due. A Creator working from their own account sees their Projects, without amounts, and the name of the agency representing them.

Data may be disclosed to authorities where required by law.

The database and files are stored in the European Union. Some providers are US companies (Vercel, Stripe, Resend) and may access or process data outside the European Economic Area. Transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework, for certified providers, and on the standard contractual clauses approved by the European Commission.

Account data is kept for the life of the account and for 3 years after closure, to handle potential claims.

Contractual and tax documents are kept for the statutory periods, generally 10 years.

The contract signed in the Platform, with the identification details in it, is kept as a contractual document. The Operator does not ask for or keep copies of identity documents.

Original video files of Projects are kept for as long as the Brand's license is valid and are deleted 180 days after it expires, with prior notice; until then, the Content remains available to the Brand in its library.

Files deleted from a portfolio are kept for another 30 days, for security, and are then permanently deleted.

Website statistics details are kept for 90 days; after that only daily totals remain, with no link to any visitor or account.

The error log is kept for 90 days.

The sign-up log is kept for 90 days.

The performance score is calculated from activity over the last 6 months. The warning history is kept for as long as the account exists and is deleted or anonymised with it, except for data needed to defend a legal claim.

Messages sent through the contact form are kept for 2 years from receipt. The IP address fingerprint is deleted after 30 days.

The rights of access, rectification, erasure, restriction of processing, objection, data portability and withdrawal of consent, under the conditions of the GDPR.

The right to object may be exercised at any time against processing based on the Operator's legitimate interest, unless the Operator demonstrates compelling legitimate grounds that override it or the processing is needed to defend a legal claim.

For the performance score and for decisions on warnings or the termination of an agreement, data subjects have the right to obtain human intervention, to express their point of view and to contest the decision (Article 22 GDPR).

For the data in the profile of a represented Creator, managed by the Creator Agency, the Operator also forwards the request to the agency. When such a Creator deletes their own account, their access to the profile ends and the profile remains in the agency's care.

Requests are sent to office@zeff.ro and answered within 30 days at most. You may also lodge a complaint with the Romanian supervisory authority (dataprotection.ro).

The Operator applies appropriate technical and organisational measures: separation of data per organisation at database level, encrypted communications, two-factor authentication for the Operator's team, logging of financial and contractual actions. Metadata, including location, is removed automatically from uploaded photos and videos.

The Platform is not aimed at people under 18 and does not knowingly process their data as users. Minors may appear in Content only with the written consent of their parents or legal representative, obtained by the Creator.

This policy may be updated. The current version is published in the Platform with the date of the last update.