This information is addressed to creators whose publicly available profile data we process to explore possible collaborations (Art. 14 GDPR).
The controller is BFG Media GmbH, represented by its managing director Florian Vögtle, Hauptstraße 32, 88326 Aulendorf, Germany. Data protection coordination: Elisa Graf, eg@bfg-mediagroup.com.
We process data from your publicly accessible TikTok or Instagram profile: username or handle, display name, public follower count, contact details stated in your bio (for example an email address), your public profile picture (which we cache locally) and links to and metrics of public videos.
The purpose is to assess whether your profile fits a planned marketing campaign (brand fit) and, where applicable, to reach out about a collaboration. The legal basis is our legitimate interest in initiating business relationships (Art. 6(1)(f) GDPR). Any email outreach is carried out in compliance with applicable competition law.
Where enabled, an AI may assist in assessing your public profile for content suitability (niche, video quality, rule compliance) and assign a risk or fit signal. This evaluation is solely preparatory; the final selection is always made by a human, so there is no solely automated decision with legal effect within the meaning of Art. 22 GDPR. You may object to this analysis at any time (Art. 21 GDPR). This feature is only used in production after a data protection impact assessment (Art. 35 GDPR) has been carried out.
When we reply to your message, a colleague may have a draft prepared by an AI language model. The content of your message leaves our server only in pseudonymised form: name, address, phone number, email address and bank details are automatically replaced beforehand with placeholders such as [NAME1] or [ORT1], and only restored after the model responds. The language model is provided by Ollama Inc., 2261 Market Street, San Francisco, USA. The transfer relies on Art. 6(1)(f) GDPR (our legitimate interest in responding promptly) and on the EU Commission's standard contractual clauses under Art. 46(2)(c) GDPR. The drafts are not used for training there. A human always reviews and sends the final reply. You may object to this support at any time; we will then write without AI.
When you sign an agreement via our signing page, we process the following to evidence the simple electronic signature (Art. 25 eIDAS Regulation): your typed name, your drawn signature where provided, address and email address, IP address, browser identifier (user agent), timestamp of consent, and cryptographic checksums (SHA-256) of the document before and after signing. The legal basis is Art. 6(1)(b) GDPR (contract initiation and performance) and (f) (proof of signing). The signed document including the signature certificate is stored for the duration of the collaboration and statutory retention periods; you can request a copy at any time.
When you book a call via our booking link, we process your name, your email address and any message you choose to add. The appointment is added to the Outlook calendar of the person you are meeting and a Microsoft Teams link is created; the processor is Microsoft Ireland Operations Ltd. You receive a confirmation and a reminder by email. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract). We delete appointment data once it is no longer needed.
For emails we send you, we record whether the message was opened and whether a link in it was clicked. This helps us judge whether our request reached you (Art. 6(1)(f) GDPR). You may object at any time.
When you sign up for a campaign we fetch, at your request, your public TikTok profile (display name, picture, follower count, bio) so you can confirm it is you and so nobody can sign up in your name. To verify ownership you briefly place a code we generate into your bio; we only check whether that code is present, and you can remove it right away. We store your handle, the fetched profile data, the contact details from the form, your video commitment, product wishes and the video links you submit; your rewards are calculated from these. Legal basis is the initiation and performance of the contract with you (Art. 6(1)(b) GDPR). Abandoned sign-ups are deleted.
This platform (BFG Creator Suite) is based on software by Evoliqo (evoliqo.com). BFG Media GmbH holds a valid licence and is the sole controller within the meaning of the GDPR for all data processed here; Evoliqo merely provides the software and infrastructure. In addition, we cooperate with Evoliqo as a creator platform: when you apply to or work with us, your profile and contact data (handle, name, email, public profile data) may also be added to the Evoliqo creator pool so that Evoliqo can contact you about further suitable collaborations (UGC or affiliate). The legal basis is our legitimate interest in arranging suitable collaborations (Art. 6(1)(f) GDPR). You can object to this use at any time by email; your entry in the Evoliqo pool will then be deleted. Since 12 August 2026 this also covers your TikTok Shop performance data, which we retrieve through our provider Cruva: revenue (GMV) over the past 30 days, engagement rate, views, units sold and revenue from videos and LIVE. We store it with us and in the Evoliqo creator pool so that suitable brands can find you for future collaborations. You can object to this at any time, informally. The Evoliqo privacy policy is available at https://evoliqo.com/datenschutz; the controller there is Realisator Media GmbH, Bayernring 7, 12101 Berlin, Germany.
As part of campaign planning we present selected public profile data (username, profile picture, key figures, published videos, portfolio links) to the respective client on an access-protected, non-indexed presentation page where the client can make a selection. The legal basis is Art. 6(1)(f) GDPR; you may object to being included at any time via mg@bfg-mediagroup.com.
Within our company, only the people handling your collaboration have access. Beyond that, we pass your profile and contact data to our platform evoliqo.com, where companies can build a UGC strategy and contact suitable creators directly. You may object to this at any time (see the section on objection); we will then remove your profile from the platform.
If no collaboration is initiated or you object to processing, we delete your data including the cached profile picture. If a collaboration comes about, contractual and statutory retention periods apply.
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and in particular the right to object to processing (Art. 21 GDPR). You may also lodge a complaint with a supervisory authority (Art. 77 GDPR). An informal message to us is sufficient to exercise your rights or request deletion.
If you do not wish to be contacted or want your data deleted, reply to one of our messages or write to the contact address above. We will then delete your data immediately and add your profile to a block list so it is not captured again.
Last updated: July 2026. This notice is continuously adapted to the platform's scope of functions.
The German version is legally binding. This translation is provided for convenience only.