Protecting your personal data matters to us. This policy explains which data we process, for what purpose, and which rights you have (Art. 13 GDPR).
The controller within the meaning of the GDPR is BFG Media GmbH, Hauptstraße 32, 88326 Aulendorf, Germany, registered with the commercial register of the Local Court of Charlottenburg under HRB 229907. Contact for all privacy matters: mg@bfg-mediagroup.com.
For data protection questions, contact our data protection coordinator Elisa Graf at +49 7525 92022 21 or eg@bfg-mediagroup.com.
This privacy policy covers the creator management platform operated by BFG Media GmbH, including all public pages, in particular appointment booking, electronic signing, content upload and access-protected presentation and approval pages for clients.
When you visit this website, our server processes technically necessary data (IP address, time, requested page, transferred data volume, browser identifier and referrer URL) in server log files. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure operation). Logs are deleted automatically after 14 days.
To initiate collaborations we process publicly available profile data of content creators (e.g. username, profile picture, follower counts, published videos, portfolio links) from social networks such as TikTok and Instagram. The legal basis is our legitimate interest in selecting suitable collaboration partners (Art. 6(1)(f) GDPR). Detailed information pursuant to Art. 14 GDPR is provided to creators in a dedicated privacy notice.
If you use our contact form, we process your name, email address and message solely to handle your request (Art. 6(1)(b) GDPR). To prevent abuse (rate limiting), your IP address is processed briefly in memory when submitting and is not stored permanently (Art. 6(1)(f) GDPR). The data is deleted as soon as it is no longer required and no statutory retention obligations apply.
For business email correspondence we process the content and metadata of messages. To measure the success of our outreach we also record whether an email we sent was opened and whether a link contained in it was clicked. The legal basis is Art. 6(1)(f) GDPR; you may object to this processing at any time.
If you sign in with your TikTok account (TikTok Login Kit) or connect a TikTok Shop account, we receive data from TikTok. From your profile these are your display name, username, profile picture and account identifier, together with public reach and engagement figures such as follower count, views, likes and engagement rate. Where you grant the corresponding permission, we also receive a list of your public videos with their titles, links, cover images and figures. For creators taking part in a TikTok Shop campaign we additionally process order, shipping and commission data for the campaign products. We use this data solely to check your application, to assess the fit with a campaign, to coordinate with the brand and to settle agreed compensation. The legal basis is Art. 6(1)(b) GDPR for the performance of the collaboration and Art. 6(1)(f) GDPR for our legitimate interest in checking applications; where you have given consent in the TikTok dialog, also Art. 6(1)(a) GDPR. We never receive your TikTok password. You can revoke the connection at any time in your TikTok settings under connected apps or by messaging us; we then stop retrieving further data. Data already received is deleted as soon as it is no longer required for the purpose and no statutory retention obligation applies. You may request deletion at any time at mg@bfg-mediagroup.com. We do not sell TikTok data and do not use it for advertising profiles or for any purpose other than those named.
For electronic signatures (simple electronic signature within the meaning of the eIDAS Regulation) we log the time, IP address, browser identifier, the declared consent and cryptographic checksums of the document before and after signing. This data serves exclusively as evidence of the conclusion of the contract (Art. 6(1)(b) and (f) GDPR) and is retained together with the signed document and the signature certificate.
For clients we provide access-protected pages on which selected public creator profiles can be presented and rated and content can be approved. Access is doubly secured (secret URL plus an additional access password), the pages are excluded from search engine indexing and requests are rate-limited to prevent abuse.
For online appointment booking we process name, email address and the selected slot to prepare and conduct the meeting (Art. 6(1)(b) GDPR), including automatic confirmations and reminders. Booked appointments are synchronised with the responsible contact person's calendar (Microsoft Outlook), and a Microsoft Teams meeting link is created automatically for the call. Microsoft 365 is used under a data processing agreement.
We use strictly necessary cookies only: a session cookie for login, a cookie storing your language preference and, on password-protected pages, an access cookie. Strictly necessary cookies do not require consent (sec. 25(2) German TDDDG). We do not use any third-party tracking, analytics or advertising cookies.
The platform is hosted on servers in Germany (netcup GmbH, Karlsruhe). When pages are accessed, technical access data (IP address, time, requested resource, user agent) is processed in server logs and deleted after a short period. The legal basis is Art. 6(1)(f) GDPR (operational security and abuse prevention). All connections are TLS-encrypted.
We use the following processors under Art. 28 GDPR, each for the stated purpose only: netcup GmbH (server hosting, Germany), IONOS SE (receiving and managing our mailboxes, Germany), Hostinger (technical delivery of our emails, EU), Microsoft Ireland Operations Ltd. (calendar sync for booked calls and Teams links), Ollama Inc. (AI-assisted reply drafts and assessment of profile data, USA) and Apify Technologies s.r.o. (retrieval of publicly available profile data, EU). Data processing agreements are in place with all of them.
This platform is based on the Creator Suite by Realisator Media GmbH (Evoliqo), Bayernring 7, 12101 Berlin, Germany, which we operate under a white-label licence. The controller under the GDPR for the data processed here remains BFG Media GmbH; the software runs on our own infrastructure in Germany (self-hosted) and the provider has no ongoing access to the data. Where we transfer creator data to Evoliqo as part of our cooperation, their privacy policy at https://evoliqo.com/datenschutz additionally applies; the controller there is Realisator Media GmbH.
For AI-assisted reply drafts and profile assessment we transfer correspondence content and profile data to Ollama Inc. in the USA. Processing outside the EU also cannot be fully excluded at Microsoft. Both rely on EU standard contractual clauses (Art. 46 GDPR) or the EU-U.S. Data Privacy Framework.
We store personal data only for as long as necessary for the respective purpose. Contracts, signature evidence and accounting records are subject to statutory retention periods of six or ten years (sec. 257 German Commercial Code, sec. 147 German Fiscal Code). Correspondence and profile data are deleted once they are no longer required for the collaboration or a valid objection has been raised.
We implement technical and organisational measures pursuant to Art. 32 GDPR: end-to-end TLS encryption, role-based access control, HttpOnly cookies, rate limiting against automated access, encrypted storage of credentials, separated permissions for administrative and working areas, and regular backups. Access to personal data is restricted to the persons entrusted with it.
You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21 GDPR). Any consent given may be withdrawn at any time with effect for the future. Simply contact mg@bfg-mediagroup.com.
You have the right to lodge a complaint with a data protection supervisory authority, in particular with the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, Germany.
Last updated: July 2026. This privacy policy is continuously adapted to the platform's scope of functions and the legal situation; the version published here applies.
The German version is legally binding. This translation is provided for convenience only.