PRIVACY AND PERSONAL DATA PROTECTION POLICY – VELPACT

1. Introduction

This Privacy Policy explains how Velpact collects, uses, stores, protects and discloses the personal data of persons who access the Velpact website and platform, create an account or use the services offered.

Velpact provides intermediation services between brands, agencies and content creators, as well as services for organizing and administering marketing and promotion campaigns.

By using the platform, users can create professional profiles, publish information about their activity, discover collaboration opportunities, communicate with other users, negotiate the terms of collaborations, conclude contracts and participate in campaigns managed by Velpact.

We undertake to process personal data in accordance with Regulation (EU) 2016/679 on the protection of personal data ("GDPR") and the applicable legislation.

2. The Personal Data Controller

The personal data controller is:

• Company name: SC New River Pro SRL
• Registered office: loc. Jucu de Sus, nr. 530, jud. Cluj
• CUI: 48765504
• Trade Registry No.: J12/3835/2023
• Website: https://velpact.com
• E-mail for personal data requests: [email protected]

In this policy, the terms "Velpact", "we" and "Controller" refer to the company that administers the platform. For requests regarding the processing of personal data, you may contact us using the e-mail address indicated above.

3. What Personal Data We Collect

Depending on how you use the platform, we may collect the following categories of data:

3.1. Account and User Identification Data

• First name and surname;
• E-mail address;
• Telephone number, if provided;
• Password stored in a secure form (stored using one-way hashing algorithms);
• Account type: creator, brand or agency;
• Company name and its identification details;
• The position or role of the person representing a brand or an agency;
• Country and locality;
• Information necessary for account verification.

3.2. Creator Profile Data

In the case of creators, we may process:

• Profile photo;
• Professional description and biography;
• Fields of activity and content categories;
• Links to social media accounts;
• Audience statistics and information, if provided or authorized;
• Portfolio, Media Kit and presentation materials;
• Showreels, photographs and videos;
• Rates and services offered;
• Availability for collaborations;
• Information about professional experience.

The creator is responsible for the accuracy and legality of the information and materials they publish in their profile.

3.3. Data on Brands and Agencies

We may collect:

• Company name;
• Tax identification data;
• Registered office address;
• Contact persons' details;
• Professional e-mail addresses and telephone numbers;
• Field of activity;
• Information about the requested campaigns and collaborations;
• Budgets, objectives and campaign requirements.

3.4. Data on Collaborations, Campaigns and the Deal Room

For the operation of Velpact's services, we may process:

• Messages and communications exchanged between users in the Deal Room;
• Collaboration proposals, offers and negotiations of commercial terms;
• Electronic contracts/Pacts and the unique cryptographic identifiers (SHA-256 hash fingerprints) generated to guarantee the integrity of the agreements;
• Campaign descriptions and work instructions;
• Content created within collaborations;
• Confirmations of delivery and approval of materials;
• Complaints, claims and disputes;
• Ratings and reviews;
• Information on the progress and completion of collaborations.

3.5. Payment Data

For transactions made through the platform, we may process information such as:

• The value of the collaboration;
• Velpact commissions (e.g. 5% brand / 1% creator);
• The transaction currency;
• The payment status;
• Transaction identifiers issued by the payment processor (Stripe);
• Information on refunds;
• Data necessary for making payments to beneficiaries.

Full bank card details are managed directly and exclusively by the authorized third-party payment processor (Stripe). Velpact does not store full bank card numbers or their security codes.

3.6. Automatically Collected Data

When you access the website or the platform, we may automatically collect:

• IP address;
• Browser type and version;
• Operating system;
• Device type;
• Date and time of access;
• Pages visited;
• Information on the use of the platform;
• Cookies and technical session identifiers.

4. Purposes and Legal Bases of Processing

We process personal data only where we have a legal basis provided by the GDPR.

4.1. Account Creation and Administration

We use the data for user registration, authentication, account verification, profile administration and the provision of the platform's functionalities.

Legal basis: performance of the contract (the Terms and Conditions) or taking steps at the request of the data subject prior to entering into the contract.

4.2. Provision of Intermediation Services

We process data to enable brands and creators to discover each other, communicate in the Deal Room, negotiate and carry out collaborations through Velpact.

Legal basis: performance of the contract and, where applicable, the legitimate interest of the Controller.

4.3. Administration of Campaigns Managed by Velpact

For campaigns administered directly by Velpact, we may use the data to select creators, send instructions, coordinate activities, verify materials and communicate results to the brand.

Legal basis: performance of the contract concluded with the brand and, where applicable, performance of the contracts with the creators involved.

4.4. Payment Processing and Invoicing

We use the data necessary for collecting payments, calculating commissions, making payments to beneficiaries, issuing tax documents and managing refunds.

Legal basis: performance of the contract and compliance with tax and legal obligations.

4.5. Security and Fraud Prevention

We may use the data to identify suspicious activities, prevent unauthorized access, investigate breaches of the Terms and Conditions and protect users.

Legal basis: the legitimate interest of the Controller and, where applicable, compliance with legal obligations.

4.6. Communications and Notifications

We may send messages regarding the account, collaborations, contracts, campaigns, payments, security and important changes to the services. E-mail notifications are purely informative and do not contain the full text of confidential conversations in the Deal Room.

Legal basis: performance of the contract or legitimate interest. Commercial communications and newsletters will be sent exclusively on the basis of prior consent.

4.7. Improvement of the Platform

We may analyze how the platform is used in order to improve functionalities, the user experience and the security of the services.

Legal basis: legitimate interest or consent, depending on the technology used.

5. Profile Visibility and Confidentiality of Information

Velpact allows the publication of certain professional information to facilitate collaborations between creators and brands.

5.1. Information That May Be Visible in the Public Profile

Depending on the available options, a creator's public profile may include: the display name, profile photo, professional description, activity categories, links to social networks, the portfolio (Media Kit) and starting rates.

5.2. Information That Is Not Public by Default

Data such as the private e-mail address, telephone number, bank details, identification documents, private conversations in the Deal Room and authentication data are not intended for public display.

5.3. Confidential Commercial Information

Detailed budgets, specific offers, negotiations in the Deal Room, contracts signed with SHA-256 hash and private messages are treated as strictly confidential information.

6. Confidentiality of Communications and Collaborations

Velpact does not disclose or publish private conversations between users. Access by authorized personnel to the data in the Deal Room is granted exclusively to the extent necessary for administration, technical support, dispute resolution or compliance with legal obligations.

Users are obliged to respect the confidentiality of the information received from the other participants and not to disclose it to third parties without written consent.

7. To Whom We May Disclose Data

Personal data may be disclosed, to the strictly necessary extent, to the following categories of recipients:

• Hosting, cloud infrastructure and IT maintenance service providers;
• E-mail and notification service providers;
• Authorized payment processors (e.g. Stripe) and banking institutions;
• Invoicing and accounting service providers;
• Legal, audit and financial advisers;
• Partner brands, creators and agencies within confirmed collaborations;
• Public authorities and competent institutions, where there is an express legal obligation.

We do not sell or rent users' personal data to third parties.

8. Transfer of Data Outside the European Economic Area

Where the use of certain infrastructure providers (e.g. cloud or processing services) involves the transfer of data outside the EEA, Velpact ensures that the appropriate safeguards required by the GDPR are applied (such as European Commission Adequacy Decisions or Standard Contractual Clauses - SCC).

9. Data Retention Period

Data is stored only for the period necessary to fulfil the purposes:

• Account data: for as long as the account remains active;
• Data on collaborations and contracts (the Pacts): for the duration of the contract and thereafter in accordance with the statutory limitation periods;
• Financial and accounting documents: in accordance with the mandatory periods provided by tax legislation (e.g. 5 or 10 years);
• Marketing data: until consent is withdrawn.

10. Data Security

Velpact applies advanced technical and organizational measures: encryption of connections (SSL/TLS), storage of passwords through secure hashing, token-based authentication, strict role-based access control and continuous technical monitoring. In the event of a security incident, Velpact will follow the legal procedures provided by the GDPR.

11. Rights of Data Subjects

In accordance with the GDPR, you have the following rights:

• Right of access: you may request confirmation of the processing and a copy of the data;
• Right to rectification: you may request the correction of inaccurate data;
• Right to erasure ("right to be forgotten"): under the legal conditions provided by Art. 17 GDPR;
• Right to restriction of processing;
• Right to data portability;
• Right to object;
• Right to withdraw your consent at any time;
• Right not to be subject to a decision based solely on automated processing.

To exercise these rights, you can write to us at the e-mail address dedicated to data protection. You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP – the Romanian data protection authority - www.dataprotection.ro).

12. Minors' Data

The Velpact platform is intended exclusively for persons who have reached the age of 18. We do not knowingly collect data from minors. Accounts created by minors will be closed and the associated data will be deleted.

13. Cookies and Similar Technologies

We use cookies strictly necessary for the operation of the platform and for maintaining the authentication session. Analytics or preference cookies are used only with your consent, which can be managed through the Cookie preferences banner.

14. Links to Third-Party Platforms

The platform contains integrations and links to social networks (Instagram, TikTok, YouTube, etc.). Accessing them is subject to the privacy policies of the respective third parties.

15. Amendment of the Policy

Velpact may update this Policy. The revised version will be published on the website together with the date of the last update. In the case of substantial changes, users will be notified by e-mail or through the application.

16. Contact

For any questions regarding this policy or the processing of personal data, you can contact us at:

• Velpact / Company: [legal name]
• Website: https://velpact.com
• General e-mail: [contact address]
• Data Protection e-mail (DPO): [dedicated address, if any]
• Registered office address: [full address]