PETALOFM AGENCY / LEGAL
Privacy Policy
This policy describes how PetalOfm Agency handles personal data when you visit our website or submit a creator application. DRAFT — All bracketed placeholders must be completed and the policy reviewed against our actual practices before publication.
01 / Data Controller
PetalOfm Agency is the trading name of [LEGAL ENTITY OR SOLE TRADER NAME], located at [REGISTERED BUSINESS ADDRESS, COUNTRY]. The controller responsible for your personal data is [CONTROLLER NAME]. Registration number: [IF APPLICABLE]. Privacy contact: [PRIVACY EMAIL]. Data protection officer or EU representative: [DETAILS, IF REQUIRED; OTHERWISE STATE NOT APPLICABLE].
02 / Information We Collect
Creator applications include your full name, email address, social profile URL, any goals or background information you provide, your 18+ confirmation, and your privacy consent response. Please do not include identification documents, financial details or sensitive personal information in the goals field. [CONFIRM WHETHER TECHNICAL DATA, SUCH AS IP ADDRESSES, DEVICE INFORMATION, LOGS OR ANTISPAM DATA, IS COLLECTED AND BY WHICH PROVIDERS]. We do not request applications from people under 18; the age checkbox is a self-declaration, not identity verification.
03 / Purposes and Legal Bases
We use application data to assess potential creator partnerships and respond to applicants. [CONFIRM THE APPLICABLE GDPR LEGAL BASIS: pre-contractual steps requested by you, legitimate interests with a documented assessment, or consent where appropriate]. Website operation, security and abuse prevention: [SPECIFY PURPOSES AND APPLICABLE LEGAL BASES]. Legal compliance: [IDENTIFY APPLICABLE OBLIGATIONS, IF ANY]. The privacy checkbox does not by itself establish the legal basis for every processing activity. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing.
04 / Data Sharing
Application information may be accessed by authorized personnel assessing your application and by service providers supporting the website and submission delivery. [CONFIRM FRAMER’S ROLE, EMAIL PROVIDER, OTHER PROCESSORS, RECIPIENT CATEGORIES AND RELEVANT CONTRACTUAL SAFEGUARDS]. Data may also be disclosed where required by applicable law. [CONFIRM WHETHER ANY OTHER SHARING, SALE OR MARKETING DISCLOSURE OCCURS].
05 / International Transfers
[VERIFY WHERE FRAMER, EMAIL AND OTHER PROVIDERS STORE OR ACCESS PERSONAL DATA]. If personal data is transferred outside the EEA or another protected jurisdiction, identify the destination countries and lawful safeguards, such as an applicable adequacy decision or Standard Contractual Clauses with any required supplementary measures. [INSERT ACTUAL TRANSFER DETAILS AND HOW TO REQUEST A COPY OF SAFEGUARDS].
06 / Data Retention
We retain personal data only for as long as needed for the stated purposes and applicable legal obligations. Unsuccessful or withdrawn applications: [RETENTION PERIOD AND STARTING POINT]. Successful applications: [RETENTION RULES OR REFERENCE TO A SEPARATE PARTNERSHIP NOTICE]. Email copies, submission records, backups and security logs: [PERIODS AND DELETION PROCESS]. Any longer retention must have a documented reason.
07 / Security
[DESCRIBE VERIFIED TECHNICAL AND ORGANIZATIONAL MEASURES, INCLUDING ACCESS CONTROLS, ACCOUNT SECURITY AND PROVIDER OVERSIGHT]. No online transmission or storage system can be guaranteed completely secure. To report a suspected security incident involving your data, contact [SECURITY OR PRIVACY EMAIL].
08 / GDPR Rights
Where the GDPR applies, you may have rights to access, rectify or erase your data; restrict processing; receive portable data; and object to processing, subject to applicable conditions and exceptions. You may withdraw consent where it is the legal basis. Send requests to [PRIVACY EMAIL]. We may request proportionate information to verify your identity and will respond within applicable legal deadlines, generally one month, with permitted extensions where necessary. You may complain to the supervisory authority in your place of residence, work or the alleged infringement. [INSERT RELEVANT SUPERVISORY AUTHORITY AND WEBSITE]. [CONFIRM WHETHER AUTOMATED DECISION-MAKING OR PROFILING OCCURS AND PROVIDE REQUIRED DETAILS IF SO].
09 / Cookies
[COMPLETE A COOKIE AND TRACKING AUDIT]. List the cookies or similar technologies actually used, their providers, purposes and durations, and distinguish strictly necessary technologies from analytics or marketing technologies. Where required by law, obtain consent before enabling non-essential tracking and provide an easy way to withdraw it. [ADD COOKIE PREFERENCE CONTROLS OR COOKIE NOTICE DETAILS]. This policy does not itself implement cookie consent controls.
10 / Contact
For privacy questions or rights requests, contact PetalOfm Agency at [PRIVACY EMAIL] or write to [LEGAL ENTITY NAME AND POSTAL ADDRESS]. [ADD ANY REQUIRED DPO OR REPRESENTATIVE CONTACT DETAILS].
11 / Last Updated
Last updated: [INSERT DATE AFTER LEGAL REVIEW]. We may update this policy to reflect changes in our practices or legal requirements. [SPECIFY HOW MATERIAL CHANGES WILL BE COMMUNICATED].