Privacy Policy
This policy explains who processes your personal data when you use bycreators.es, for what purpose and on what legal basis, who it is shared with, how long it is kept and how you can exercise your rights.
Last updated: 3 August 2026
1. Data controller
The controller of the data collected through this website is:
- Owner: ZERO1 MEDIA SL (trading as «byCreators»)
- Tax ID (NIF/CIF): ESB70826946
- Address: C/ Valencia 74, 4-4, 08015 Barcelona, España
- Contact and privacy email address: hola@bycreators.es
- Website: https://bycreators.es
A single controller for all our services
ZERO1 MEDIA SL owns several brands and digital services, among them byCreators and the Huuk platform. When you write to us, fill in a form or leave us your email address on this site, ZERO1 MEDIA SL may use that data across any of its services and platforms in order to handle your request, tell you about its products and provide the service that best fits what you are looking for.
This is not a transfer to a third party: the controller is always the same, ZERO1 MEDIA SL. You can object to this use at any time by writing to hola@bycreators.es, as explained in section 7.
We are not required to appoint a Data Protection Officer (DPO). Any question relating to data protection can be addressed to hola@bycreators.es.
This policy is governed by Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD) and Spanish Law 34/2002 on Information Society Services and Electronic Commerce (LSSI-CE).
2. The data we process and where it comes from
We process only the data you give us yourself, plus the technical data generated by your browsing when you consent to non-essential cookies.
- Identification and contact data: first name, surname, email address, telephone number, brand or company, website, social media profiles.
- Project data: type of service, indicative budget, deadlines, free-text message and any information you choose to include in the form.
- Creator data (UGC Creators): public social media profile, type of content, city, and where applicable the billing details needed to pay for collaborations.
- Browsing data: IP address, device and browser type, pages viewed, source of the visit, interactions, and cookie and advertising pixel identifiers.
- Communications: the content of the emails and messages you exchange with us.
We neither request nor wish to receive special categories of data (health, beliefs, ethnic origin, sexual orientation, etc.). Please do not include them in the free-text fields of the form.
Minors
This site is not aimed at children under 14 and we do not knowingly collect data from minors. To work with us as a creator you must be over 18. If we detect a minor's data, we will delete it.
3. Purposes and legal bases
Each processing operation has a specific purpose and a legal basis that legitimises it (art. 6 GDPR):
| Purpose | Legal basis | Retention |
|---|---|---|
| Handling the requests sent through the brand and creator contact forms and preparing quotations. | Pre-contractual measures taken at the request of the data subject (art. 6.1.b GDPR). | 24 months from the last contact, unless a contractual relationship begins. |
| Managing the contractual relationship with clients and creators: production, deliveries, invoicing and payments. | Performance of a contract (art. 6.1.b) and compliance with legal tax and accounting obligations (art. 6.1.c). | For the duration of the relationship and, afterwards, 6 years under commercial law and 4-5 years under tax law. |
| Sending commercial communications, news and blog content by email. | Consent (art. 6.1.a) or, for existing clients and similar services, legitimate interest (art. 21.2 LSSI). | Until you withdraw your consent or unsubscribe. |
| Measuring use of the site, understanding which content works and improving the website (analytics). | Consent given through the cookie notice (art. 6.1.a GDPR and art. 22.2 LSSI). | According to the retention period of each cookie set out in the Cookie Policy (maximum 24 months). |
| Advertising and remarketing on Meta, TikTok, Google and other platforms, and conversion measurement. | Consent given through the cookie notice (art. 6.1.a GDPR and art. 22.2 LSSI). | According to the retention period of each pixel set out in the Cookie Policy (maximum 24 months). |
| Using the data provided on this site across the other services and platforms of ZERO1 MEDIA SL, including Huuk, in order to handle the request and offer the most suitable service. | Legitimate interest in the internal administration of the group of undertakings (art. 6.1.f GDPR and recital 48), or consent where commercial communications are involved. | The same periods indicated for the original purpose. |
| Keeping the site secure, preventing spam and fraud and maintaining technical logs. | Legitimate interest in protecting our systems and our users (art. 6.1.f). | Up to 12 months. |
| Sharing the content we produce on our website, portfolio and social media, including the creator's image. | Explicit consent and, where it exists, the assignment of image rights signed in the collaboration agreement. | Until consent is withdrawn or the agreed licence ends. |
Purpose
Handling the requests sent through the brand and creator contact forms and preparing quotations.
Legal basis
Pre-contractual measures taken at the request of the data subject (art. 6.1.b GDPR).
Retention
24 months from the last contact, unless a contractual relationship begins.
Purpose
Managing the contractual relationship with clients and creators: production, deliveries, invoicing and payments.
Legal basis
Performance of a contract (art. 6.1.b) and compliance with legal tax and accounting obligations (art. 6.1.c).
Retention
For the duration of the relationship and, afterwards, 6 years under commercial law and 4-5 years under tax law.
Purpose
Sending commercial communications, news and blog content by email.
Legal basis
Consent (art. 6.1.a) or, for existing clients and similar services, legitimate interest (art. 21.2 LSSI).
Retention
Until you withdraw your consent or unsubscribe.
Purpose
Measuring use of the site, understanding which content works and improving the website (analytics).
Legal basis
Consent given through the cookie notice (art. 6.1.a GDPR and art. 22.2 LSSI).
Retention
According to the retention period of each cookie set out in the Cookie Policy (maximum 24 months).
Purpose
Advertising and remarketing on Meta, TikTok, Google and other platforms, and conversion measurement.
Legal basis
Consent given through the cookie notice (art. 6.1.a GDPR and art. 22.2 LSSI).
Retention
According to the retention period of each pixel set out in the Cookie Policy (maximum 24 months).
Purpose
Using the data provided on this site across the other services and platforms of ZERO1 MEDIA SL, including Huuk, in order to handle the request and offer the most suitable service.
Legal basis
Legitimate interest in the internal administration of the group of undertakings (art. 6.1.f GDPR and recital 48), or consent where commercial communications are involved.
Retention
The same periods indicated for the original purpose.
Purpose
Keeping the site secure, preventing spam and fraud and maintaining technical logs.
Legal basis
Legitimate interest in protecting our systems and our users (art. 6.1.f).
Retention
Up to 12 months.
Purpose
Sharing the content we produce on our website, portfolio and social media, including the creator's image.
Legal basis
Explicit consent and, where it exists, the assignment of image rights signed in the collaboration agreement.
Retention
Until consent is withdrawn or the agreed licence ends.
Where processing is based on your consent, you can withdraw it at any time without affecting the lawfulness of the processing carried out before the withdrawal.
Automated decisions
We do not take automated decisions with legal effects, nor do we carry out profiling that significantly affects you. The advertising audiences we create on third-party platforms are statistical segments, not individual decisions.
4. Recipients and data processors
We do not sell your data. We share it only with providers who supply services to us and who act as data processors, under a contract signed in accordance with art. 28 GDPR, or as independent controllers where the law establishes this:
| Provider | Service | Location / transfers |
|---|---|---|
| Lovable Labs Incorporated | Development and hosting platform for the website and its backend. | EU / USA under Standard Contractual Clauses. |
| Supabase Inc. (site database) | Database storing form messages, articles and the users of the administration panel. | EU (European infrastructure) / USA under Standard Contractual Clauses. |
| SiteGround Spain S.L. | Domain registration and management, DNS and corporate email. | European Union. |
| Web3Forms | Email delivery of the messages sent from the forms on the website. | USA under Standard Contractual Clauses. |
| Google Ireland Ltd. (Google Analytics 4, Google Search Console, Google Tag Manager, Google Ads, YouTube) | Usage analytics, search performance tracking, tag management, advertising, conversion measurement and playback of embedded videos. | EU / USA under Standard Contractual Clauses and the EU-US Data Privacy Framework. |
| Meta Platforms Ireland Ltd. (Facebook and Instagram Ads, Meta pixel) | Advertising, remarketing, custom audiences and conversion measurement. | EU / USA under Standard Contractual Clauses. Joint controllership limited to measurement. |
| TikTok Technology Ltd. (TikTok Ads, TikTok pixel) | Advertising, remarketing and conversion measurement. | EU / USA / Singapore under Standard Contractual Clauses. |
| LinkedIn Ireland Unlimited Company | B2B advertising and conversion tag, when active. | EU / USA under Standard Contractual Clauses. |
| Email marketing and CRM tools | Sending newsletters and managing the commercial relationship. | European Union or transfer with appropriate safeguards. |
| Tax and accounting advisers, banks and public authorities | Invoicing, payments and compliance with legal obligations. | European Union. |
Provider
Lovable Labs Incorporated
Service
Development and hosting platform for the website and its backend.
Location / transfers
EU / USA under Standard Contractual Clauses.
Provider
Supabase Inc. (site database)
Service
Database storing form messages, articles and the users of the administration panel.
Location / transfers
EU (European infrastructure) / USA under Standard Contractual Clauses.
Provider
SiteGround Spain S.L.
Service
Domain registration and management, DNS and corporate email.
Location / transfers
European Union.
Provider
Web3Forms
Service
Email delivery of the messages sent from the forms on the website.
Location / transfers
USA under Standard Contractual Clauses.
Provider
Google Ireland Ltd. (Google Analytics 4, Google Search Console, Google Tag Manager, Google Ads, YouTube)
Service
Usage analytics, search performance tracking, tag management, advertising, conversion measurement and playback of embedded videos.
Location / transfers
EU / USA under Standard Contractual Clauses and the EU-US Data Privacy Framework.
Provider
Meta Platforms Ireland Ltd. (Facebook and Instagram Ads, Meta pixel)
Service
Advertising, remarketing, custom audiences and conversion measurement.
Location / transfers
EU / USA under Standard Contractual Clauses. Joint controllership limited to measurement.
Provider
TikTok Technology Ltd. (TikTok Ads, TikTok pixel)
Service
Advertising, remarketing and conversion measurement.
Location / transfers
EU / USA / Singapore under Standard Contractual Clauses.
Provider
LinkedIn Ireland Unlimited Company
Service
B2B advertising and conversion tag, when active.
Location / transfers
EU / USA under Standard Contractual Clauses.
Provider
Email marketing and CRM tools
Service
Sending newsletters and managing the commercial relationship.
Location / transfers
European Union or transfer with appropriate safeguards.
Provider
Tax and accounting advisers, banks and public authorities
Service
Invoicing, payments and compliance with legal obligations.
Location / transfers
European Union.
Analytics and advertising services are only activated if you give your consent in the cookie notice. You can find the details in the Cookie Policy.
5. International transfers
Some of our providers are established outside the European Economic Area or may access the data from third countries. In those cases the transfer relies on one of these safeguards under Chapter V of the GDPR:
- An adequacy decision of the European Commission, including the EU-US Data Privacy Framework for certified entities.
- Standard Contractual Clauses approved by the European Commission, supplemented by additional technical measures such as encryption in transit and at rest.
You can request a copy of the safeguards applied by writing to hola@bycreators.es.
6. Retention periods
We keep each piece of data for the period indicated in the table in section 3. Once the purpose has been fulfilled, the data is blocked and made available solely to judges and courts, the Public Prosecutor's Office or the competent authorities for the limitation period of any liabilities, after which it is securely deleted.
7. Your rights
You can exercise the following rights at any time:
- Access: to know what data of yours we process.
- Rectification: to correct inaccurate or incomplete data.
- Erasure: to ask us to delete your data when it is no longer needed.
- Objection: to object to processing based on our legitimate interest, including direct marketing.
- Restriction: to ask us to suspend processing while a claim is verified.
- Portability: to receive your data in a structured, commonly used format, or to have us transmit it to another controller.
- Withdrawal of consent: at any time, with effect for the future.
To exercise them, write to hola@bycreators.es stating the right you wish to exercise. We may ask you to prove your identity. We will reply within a maximum of one month, extendable to two months for complex requests.
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan 6, 28001 Madrid, www.aepd.es).
8. Information security
We apply technical and organisational measures appropriate to the risk: HTTPS encryption on all communications, access control to the administration panel through Google authentication restricted to authorised accounts, row-level security policies in the database, backups and access logging. In the event of a security breach posing a high risk to your rights, we will inform you and notify the AEPD within 72 hours.
9. Social media and embedded content
We are present on Instagram, TikTok and LinkedIn. If you interact with our profiles, your data is also processed in accordance with each platform's privacy policy, over which we have no control. Pages on this site may include embedded videos or posts from those platforms and from YouTube: when they load, the provider may set its own cookies. They only load if you have accepted the corresponding cookies.
10. Changes to this policy
We may update this policy when our services, our tools or the applicable rules change. We will always publish the date of the last update and, if the change is substantial and affects processing based on your consent, we will inform you and ask for it again.