GDPR Compliance

1. Our commitment

YoCreate is committed to protecting personal data in line with the EU General Data Protection Regulation (GDPR) and the UK GDPR. This page summarises how we meet those obligations. It complements our Privacy Policy, which contains the full detail of what we collect and why.

2. Data controller

The data controller is ZANTEMARK LIMITED, a company incorporated in the Republic of Cyprus (registration number HE426044, VAT CY10426044N), with its registered office at Arch. Makariou III, 195, NEOCLEOUS HOUSE, 3030 Limassol, Cyprus. For data-protection matters you can reach us at privacy@yocreate.com.

3. Legal bases for processing

We only process personal data where we have a lawful basis under Article 6 GDPR:

• Performance of a contract — to operate the Service, deliver campaigns, engage and pay creators and suppliers, and provide the features you have requested.
• Legal obligation — to meet financial-record-keeping, tax, and anti-money-laundering requirements.
• Legitimate interests — to keep an audit trail of agreements and confirmations, to prevent fraud and abuse, and to secure the Service, balanced against your rights and freedoms.
• Consent — where we ask for it (for example, before introducing any non-essential cookies); you may withdraw consent at any time.

4. Your rights

Subject to the conditions in the GDPR, you have the right to:

• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• have your data erased (the “right to be forgotten”);
• restrict how we process your data;
• receive your data in a portable, machine-readable format and have it transmitted to another controller;
• object to processing based on our legitimate interests;
• withdraw consent where processing is based on consent; and
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (we do not carry out such automated decision-making).

5. How to exercise your rights

To exercise any of these rights, email privacy@yocreate.com. We will verify your identity and respond within one month, as required by the GDPR; we may extend this by a further two months for complex requests and will tell you if we do. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.

6. International transfers

Some of our service providers operate outside the European Economic Area, including in the United States. Where we transfer personal data outside the EEA, we rely on appropriate safeguards under Chapter V of the GDPR, such as the European Commission's Standard Contractual Clauses, together with additional measures where necessary.

7. Sub-processors

We use a limited set of processors that handle personal data only on our documented instructions and under data-processing agreements: cloud hosting (Fly.io), transactional email (Resend), electronic signature (DocuSeal), sign-in (Google OAuth), file storage (AWS S3 / Tigris), and error monitoring (Sentry).

8. Retention

We keep personal data only for as long as necessary for the purposes described in our Privacy Policy — generally for as long as your account is active, and payment-related and audit data for at least seven years to meet financial-record-keeping obligations, or longer where required by law or to defend legal claims.

9. Security and breach notification

We apply appropriate technical and organisational measures, including encryption in transit and at rest, column-level encryption of sensitive identifiers, and need-to-know access controls. In the event of a personal-data breach that is likely to result in a risk to your rights, we will notify the competent supervisory authority and, where required, affected individuals, within the timeframes set by the GDPR.

10. Supervisory authority

You have the right to lodge a complaint with a data protection authority. As we are established in Cyprus, our lead authority is the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus. You may also complain to the supervisory authority in your own country of residence.

11. Contact

For any data-protection question or to exercise your rights, write to privacy@yocreate.com.