Privacy policy

The controller responsible for processing personal data on this website is FNLY Social UG (haftungsbeschränkt), Am Kraftwerk 23, 34582 Borken, Germany, represented by its managing director Alina Schmid.

Phone: +49 5682 7369200, email: info@fnly-group.com. You can reach us at this address with any questions about data protection and to exercise your rights.

Under Art. 37 of the General Data Protection Regulation (GDPR, in German DSGVO) and § 38 of the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG), we are not obliged to appoint a data protection officer. Your data protection inquiries are handled directly by the management.

This website runs on servers that we operate ourselves. The servers are located in the data center of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, at the Falkenstein site in Germany. Hetzner provides the data center, power and network connection. We have concluded a data processing agreement with Hetzner under Art. 28 GDPR.

The connection to this website is encrypted using TLS. You can recognize this by the padlock symbol and “https” in the address bar.

Each time you visit this website, your browser transmits data to our server for technical reasons, including:

• IP address of the requesting device
• date and time of access
• page or file requested
• website from which you came to us (referrer)
• browser and operating system used
• amount of data transferred and status code of the response

Our server only processes this data in order to deliver the requested page to you. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the technical provision of the website. We do not store access logs containing this information.

If you visit fnly-agency.com without a language in the address, we redirect you to the appropriate language version. To do this, we determine the country you are in from your IP address and take your browser's language setting into account. We determine the country using a database on our own server (IP geolocation by DB-IP, db-ip.com, license CC BY 4.0). Your IP address is not transmitted to third parties for this purpose and is not stored. The legal basis is our legitimate interest in showing you the site in your language and with the information relevant to your market (Art. 6(1)(f) GDPR).

If you choose a language version yourself in the language selector, we store this choice in a cookie (“fnly_agency_locale”, lifetime one year) so that we do not redirect you again on your next visit. The cookie is necessary for this function, which you have expressly requested (§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG), and only contains the code of the selected language version.

We do not use cookies for advertising. We store your choice in the consent banner in your browser's local storage (localStorage, entry “fnly-consent”) so that the banner does not reappear on every page view. This storage is strictly necessary for the service you have requested and is permitted under § 25(2) no. 2 TDDDG.

We only load services that are not strictly necessary with your consent under § 25(1) TDDDG and Art. 6(1)(a) GDPR. You can change or withdraw your consent at any time via the “Cookie settings” link in the footer of every page. Withdrawal applies to the future.

If you consent to the “Statistics” category, we use the open-source software Matomo to measure how our website is used. Matomo runs at statistik.fnly-group.com on servers of FNLY Group in Germany, which operates audience measurement for all of the group's websites. The data is not passed on to third parties outside FNLY Group.

In doing so, we process your IP address, which is shortened by the last two bytes before storage, the pages viewed and time spent on them, the website you came from, information about your device, browser and screen size, and actions such as submitting a form. For this purpose Matomo sets the cookies “_pk_id” (stored for 13 months) and “_pk_ses” (30 minutes).

We use the analysis to improve our content and to understand which pages lead to inquiries. The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. The raw data is deleted after 395 days.

If you consent to the “Marketing” category, we use services from the advertising platforms on which we run ads: Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), the LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland), the Meta Pixel for Facebook and Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland) and the TikTok Pixel (TikTok Technology Limited, Dublin, Ireland). Without your consent, these services are not loaded.

The services set cookies or similar identifiers and transmit data such as your IP address, information about your device and browser, the pages viewed and whether you sent an inquiry or booked an appointment. This allows us to measure which ads lead to inquiries and to show ads again to visitors of our website on these platforms. The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. For data collection via the Meta Pixel, we are joint controllers with Meta under Art. 26 GDPR.

The providers may transfer data to the USA. Google LLC, Meta Platforms, Inc. and LinkedIn Corporation are certified under the EU-US Data Privacy Framework, for which an adequacy decision under Art. 45 GDPR exists. You can withdraw your consent at any time via “Cookie settings” in the footer.

If you come to us via an ad and send an inquiry, we transmit the campaign information from the page address, such as utm_campaign or gclid, together with your inquiry. This allows us to see which campaign led to which inquiry. The legal basis is our legitimate interest in measuring the performance of our advertising under Art. 6(1)(f) GDPR.

If you write to us via the contact form or the campaign inquiry, we process the information you provide there: name, email address, company, phone number, website, the selected topic, goals, platforms, budget range, period and your message.

We use this data to answer your inquiry and, where applicable, to prepare an offer. The legal basis is Art. 6(1)(b) GDPR where your inquiry is aimed at a contract, and otherwise our legitimate interest in answering inquiries under Art. 6(1)(f) GDPR.

Your information is transmitted by our server via the Microsoft Graph interface as an email to our Microsoft 365 mailbox. We do not operate a database for form submissions. To protect against misuse, the server briefly processes your IP address in memory in order to limit too many requests in a short time. It is not stored permanently and is discarded after one hour at the latest.

We delete your inquiry once it has been dealt with, unless statutory retention obligations prevent this. If your inquiry leads to a contract, the retention periods under commercial and tax law of up to ten years apply.

If you apply as a creator via our application form, we process your name, your creator name, your email address, your country, your age, your topics, the links to your channels with follower counts, your information on any existing management, your free-text answers and links to previous collaborations and, for applicants under 18, the confirmation that your parents agree. In addition, we look at the publicly visible content and metrics of your linked channels.

We use this data to review your application, hold an introductory call with you and, where applicable, conclude a contract. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures at your request).

As with the contact form, the data is transmitted via Microsoft Graph to our Microsoft 365 mailbox. If no collaboration results, we delete your application no later than six months after our rejection, unless you consent to longer storage. If a collaboration results, the terms of the contract apply.

If you contact us by email or phone, we process your information in order to deal with your request. The same legal basis and storage period apply as for the contact form.

For email, calendar and appointment booking we use Microsoft 365 from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. We have concluded a data processing agreement with Microsoft under Art. 28 GDPR.

Microsoft generally processes data for customers in the EU within the EU. A transfer to the USA cannot be ruled out. Microsoft Corporation is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission under Art. 45 GDPR exists.

We use Microsoft Bookings for online appointment booking. Your browser does not connect to Microsoft: the appointment picker on this page queries available times via our server, and only your booking is transmitted by our server to Microsoft Bookings. No cookies are set in the process.

If you book an appointment, we process your name, email address, company, phone number, optional message and the selected time in order to hold the meeting and send you a confirmation. The legal basis is Art. 6(1)(b) GDPR. To protect against misuse, the server briefly processes your IP address in memory, as with the contact form. We delete the data once it is no longer needed for the meeting and any possible collaboration.

The campaign calculator and the filters on the creator page run entirely in your browser. Your entries are neither stored nor transmitted to us.

Without your consent we do not load fonts, scripts or images from third-party servers; ad tags load only after you consent to the “Marketing” category. The content of this website is delivered from our own servers.

This website contains links to other providers' services, for example to our creators' profiles on Instagram, TikTok, Twitch and Threads and to the websites of FNLY Group. Data is only transmitted when you click such a link. The respective provider is responsible for processing on the linked pages.

Your data is only received by those who need it for the purposes stated: our staff who handle your inquiry, and the processors Hetzner and Microsoft named above. Data is not passed on for advertising purposes.

You have the following rights with regard to your personal data:

• Access under Art. 15 GDPR
• Rectification under Art. 16 GDPR
• Erasure under Art. 17 GDPR
• Restriction of processing under Art. 18 GDPR
• Data portability under Art. 20 GDPR
• Withdrawal of consent under Art. 7(3) GDPR with effect for the future

Where we process data on the basis of a legitimate interest under Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds.

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany, www.datenschutz.hessen.de.

You are not obliged to provide us with data. However, without the mandatory information in the contact form, we cannot process your inquiry. There is no automated decision-making, including profiling, under Art. 22 GDPR.

We update this privacy policy when the website or the legal situation changes. The version published here at any given time applies.