Privacy POlicy
Last updated: 10.07.2026
1. Introduction and data controller
This policy explains how we process the personal data of individuals who use the website www.eyecatchers.team, in particular applicants applying through the /careers page and UGC creators applying through the /ugc-creators-ro page, as well as subscribers to our communications and visitors to the Site.
The data controller is EYECATCHERS S.R.L., with its registered office at 17 Camil Ressu Blvd, Bl. 57A, Entr. 1, 4th Floor, Ap. 19, Sector 3, Bucharest, Romania, Tax ID (CUI) 50545918, registered with the Trade Registry under no. J2024022309008.
For any question or request regarding your data, you may contact us at privacy@eyecatchers.team (dedicated to data protection) or hello@eyecatchers.team (general contact). We have not appointed a Data Protection Officer (DPO), as our activity does not fall under the cases requiring mandatory appointment set out in Art. 37 GDPR; internal responsibility for data protection rests with the company's management.
We process data in accordance with Regulation (EU) 2016/679 (GDPR), Romanian Law No. 190/2018 on measures implementing the GDPR, and Romanian Law No. 506/2004 on the processing of personal data in the electronic communications sector.
2. Processing principles
We apply the principles set out in Art. 5 GDPR: lawfulness, fairness, and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability. In practice: we collect only the data necessary for each stated purpose, we do not use it for purposes incompatible with those communicated, we retain it for limited periods, and we protect it through appropriate measures.
3. What data we process, for what purposes, and on what legal grounds
3.1. Applicants — recruitment (/careers page)
Data processed: first and last name; e-mail address; phone number; CV and/or portfolio; links to LinkedIn, personal website, or online portfolio; the role applied for; professional experience information; any other information you voluntarily provide in your application.
Purposes and legal grounds:
Evaluating the application and carrying out the selection process (reviewing the CV, arranging interviews, communicating with you) — Art. 6(1)(b) GDPR: steps taken at the data subject's request prior to entering into a contract (employment or collaboration); alternatively, Art. 6(1)(f): our legitimate interest in selecting our employees and collaborators.
Retaining the application for future opportunities (talent pool) — solely on the basis of your explicit consent (Art. 6(1)(a)), expressed via the dedicated checkbox, for a period of 12 months. Declining does not affect the evaluation of your current application in any way.
Defending our rights (for example, in the event of a challenge relating to the selection process) — Art. 6(1)(f): legitimate interest.
3.2. UGC Creators — casting (/ugc-creators-ro page)
Data processed upon application: first and last name; e-mail; phone/WhatsApp; city and country; links to TikTok, Instagram, or portfolio accounts; video samples; information on experience, availability, content niches, and rates.
Data processed later, only if a collaboration begins: billing details (sole trader/company name or personal name, address, tax code/personal numeric code if required by law, bank account).
Purposes and legal grounds:
Evaluating the collaboration application — Art. 6(1)(b): pre-contractual steps taken at your request; alternatively Art. 6(1)(f): our legitimate interest in selecting our collaborators.
Presenting your profile to Eyecatchers' clients (materials, social media links, profile information, without direct contact details unless necessary) for project-selection purposes — solely on the basis of your consent (Art. 6(1)(a)), expressed via the dedicated checkbox.
Retaining your profile in the creator database for future projects — consent (Art. 6(1)(a)), for 24 months from the last contact.
Billing and accounting records — Art. 6(1)(c): legal obligation (tax and accounting legislation).
3.3. Newsletter / commercial communications subscribers
Data processed: e-mail address and, optionally, name.
Purpose and legal ground: sending commercial communications (news, opportunities, campaigns) — consent (Art. 6(1)(a) GDPR and Art. 12 of Law 506/2004), expressed through an unticked checkbox. You may unsubscribe at any time via the link in each e-mail or by writing to privacy@eyecatchers.team. Communications are sent through the Mailchimp platform.
3.4. Visitors — browsing the Site
We process browsing data through cookies and similar technologies (Google Analytics for traffic analysis, Meta Pixel for campaign measurement) — based on your consent expressed through the cookie banner (Art. 6(1)(a)). Full details are available in our Cookie Policy.
4. Special categories of data (Art. 9 GDPR)
We do not request and do not wish to receive special category data: information concerning health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation, genetic or biometric data. Please do not include such information in your CV, free-text messages, or Materials. If you nevertheless send us such information on your own initiative, we will disregard it during evaluation, and you may request its deletion at any time; where possible, we will remove it from the stored documents.
5. Source of data and whether provision is mandatory
Your data comes directly from you, through the Site's forms. Providing the data marked as mandatory in the forms is necessary to process your application — without it, we cannot evaluate your candidacy or collaboration proposal. Optional fields may be left blank without any consequence.
6. Recipients and data processors
Your data is accessible to Eyecatchers' authorised staff, on a need-to-know basis. To operate the flows described above, we use the following providers, which process data as processors (Art. 28 GDPR), under data processing agreements:
| Provider | Role | Location / hosting |
|---|---|---|
| Tally (Tally B.V.) | Collecting applications submitted through the Site's forms | Tally B.V., Belgium/EU |
| Google LLC (Google Drive / Google Workspace) | Storing documents and applications | USA / global data centres |
| Intuit Inc. (Mailchimp) | Sending commercial communications (newsletter) | USA |
| Google LLC (Google Analytics 4) | Analysing Site traffic | USA / global |
| Meta Platforms, Inc. (Meta Pixel) | Measuring and optimising advertising campaigns | USA |
Eyecatchers' clients. If you have given your consent via the dedicated checkbox, your creator profile (materials, links, profile information) may be presented to our clients for project-selection purposes. In this context, clients act as data recipients; we do not share more data with them than is necessary for selection purposes.
Other disclosures. We may disclose data to public authorities where required by law, as well as to our advisors (lawyers, accountants) bound by confidentiality obligations, to the extent strictly necessary. We do not sell or rent your data.
7. Transfers outside the European Economic Area
Some of our providers (Google LLC, Intuit Inc./Mailchimp, Meta Platforms, Inc.) are based in the United States and may process data outside the EEA. These transfers are carried out in compliance with Chapter V of the GDPR (Art. 44–49), based on the following safeguards:
the European Commission's adequacy decision regarding the EU–US Data Privacy Framework (DPF), for providers certified under that framework;
the Standard Contractual Clauses (SCC) approved by the European Commission, accompanied, where applicable, by supplementary measures, for transfers not covered by the DPF.
You may request further information about the safeguards applicable to each transfer, including a copy of them where possible, by writing to privacy@eyecatchers.team.
8. Retention periods
We keep data only for as long as necessary for the purposes for which it was collected, as follows:
| Category | Retention period | Details |
|---|---|---|
| Unsuccessful applicants (no talent-pool consent) | 6 months from completion of the selection process | deletion or anonymisation upon expiry |
| Applicants in the talent pool (with consent) | 12 months from when consent was given | early deletion upon withdrawal of consent; possible renewal through re-contact |
| UGC Creators — profile in the database (with consent) | 24 months from last contact | early deletion upon withdrawal of consent |
| UGC Creators — active collaboration | duration of the collaboration + the period required to close out the relationship | the legal terms below apply afterwards |
| Billing documents and accounting records | 10 years, per accounting legislation | legal obligation — cannot be shortened upon request |
| Newsletter subscribers | until unsubscription or withdrawal of consent | unsubscribe via the link in each e-mail |
| Correspondence regarding GDPR requests | 3 years from resolution | for demonstrating compliance (Art. 5(2)) |
Upon expiry of these periods, data is permanently deleted or irreversibly anonymised. Data may be kept beyond these periods only where required by law or for the establishment, exercise, or defence of a legal claim, for as long as necessary.
9. Your rights
As a data subject, you have the following rights, which you may exercise free of charge:
Right of access (Art. 15) — to obtain confirmation that we process your data and a copy of it, along with information about the processing.
Right to rectification (Art. 16) — to obtain correction of inaccurate data or completion of incomplete data.
Right to erasure (Art. 17) — to obtain deletion of your data in the cases provided by the GDPR (for example, the data is no longer necessary for its purpose, you have withdrawn consent, or the processing is unlawful). This right is not absolute: we cannot delete data that we are legally required to retain (for example, accounting documents).
Right to restriction of processing (Art. 18) — to obtain a limitation on processing in the situations provided by the GDPR (for example, while the accuracy of contested data is being verified).
Right to data portability (Art. 20) — to receive the data you provided, processed on the basis of consent or contract by automated means, in a structured, commonly used format, and to transmit it to another controller.
Right to object (Art. 21) — to object to processing based on our legitimate interest, on grounds relating to your particular situation; we will stop the processing unless we demonstrate compelling legitimate grounds that override it. You may object at any time, without justification, to processing for direct marketing purposes.
Right to withdraw consent (Art. 7(3)) — at any time, as easily as it was given, without affecting the lawfulness of processing carried out before its withdrawal.
Right not to be subject to a decision based solely on automated processing (Art. 22) — we do not use such decision-making processes (see Section 10).
How to exercise your rights: write to privacy@eyecatchers.team or to our registered office address. We will respond within one month of receiving your request; this period may be extended by two months in complex cases, with notice to you (Art. 12). We may request additional information solely to verify your identity.
Complaint to the supervisory authority: if you believe that processing breaches the GDPR, you have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) — B-dul G-ral Gheorghe Magheru nr. 28–30, Sector 1, postal code 010336, Bucharest, Romania; phone: +40.318.059.211; e-mail: anspdcp@dataprotection.ro; website: www.dataprotection.ro — as well as the right to a judicial remedy.
10. Automated decision-making and profiling
We do not use solely automated decision-making processes and do not carry out profiling that produces legal effects concerning you or similarly significantly affects you. Evaluation of recruitment and collaboration applications is carried out by humans.
11. Data security
We implement technical and organisational measures appropriate to the risk, in accordance with Art. 32 GDPR, including: encrypted data transmission (HTTPS/TLS) across the entire Site; access control for storage and communication accounts based on authentication, with access limited to staff who need the data for their duties; the use of established providers with their own security certifications; and internal confidentiality training. In the event of a personal data breach likely to result in a high risk to your rights, we will inform you in accordance with Art. 34 GDPR and will notify ANSPDCP in accordance with Art. 33.
12. Minors
The Site's forms are intended exclusively for individuals who have reached the age of 18. We do not knowingly collect data from individuals under 18. If you are under 18, please do not submit data through the forms. If we become aware that we have collected data from a minor, we will delete it as soon as possible. Parents or guardians who become aware of such a situation may contact us at privacy@eyecatchers.team.
13. Updates to this policy
We may update this policy to reflect legislative, operational, or provider-related changes. The version in force is the one published on the Site, identifiable by the “Last updated” date. In the event of significant changes to processing based on consent, we will inform you and, where necessary, request renewed consent.
14. Contact
privacy@eyecatchers.team (data protection) · hello@eyecatchers.team (general) · 17 Camil Ressu Blvd, Bl. 57A, Entr. 1, 4th Floor, Ap. 19, Sector 3, Bucharest, Romania