Translation view of the German original. The document identifier and confirmation record continue to refer to the original version.
1. Data controller and privacy contact
The controller responsible for contentmarkt is Axel Springer Deutschland GmbH, Axel-Springer-Straße 65, 10888 Berlin, telephone +49 30 2591 0.
For general product enquiries, contact hallo@contentmarkt.net. Please address privacy requests and requests concerning your rights as a data subject to datenschutz@axelspringer.de; further details are provided in section 15.
You can contact the data protection officer of Axel Springer Deutschland GmbH at Axel Springer Deutschland GmbH, Datenschutz, Axel-Springer-Straße 65, 10888 Berlin, or by email at datenschutz@axelspringer.de.
2. Scope of this privacy policy
This privacy policy applies to contentmarkt's public website, reach measurement, registration and platform functions, campaigns, social media connections, submissions, review and billing processes, and support and deletion requests. contentmarkt does not operate Instagram, TikTok, YouTube or other third-party platforms; their respective privacy notices also apply to their own processing.
3. Website, hosting and server logs
When you access the website, we process technical access data, particularly your IP address, the date and time of access, the URL accessed, referrer, browser and device information, error and security events, and server log data. The purpose is to provide a secure, stable and efficient website, analyse errors and protect against abuse. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure operation of the website.
The public website is provided through Vercel. contentmarkt uses Amazon Web Services (AWS) for backend, API, storage, queue, database and analysis processes, where possible in the EU Frankfurt region (eu-central-1). Vercel and AWS are engaged as processors or service providers under appropriate data protection agreements.
4. Waiting list and contact
We no longer offer a waiting list; new entries are no longer possible. For previous entries, we hold the email address, selected role (creator or brand), registration source and entry time. We retain them only to respond to the original enquiry. The legal basis was Article 6(1)(b) GDPR (a pre-contractual measure at your request). You can remove yourself at any time by emailing datenschutz@axelspringer.de to request removal.
If you contact us by email or through support, legal or deletion contacts, we process your contact details, the content of your enquiry, communication metadata and our handling notes. Depending on the matter, the legal basis is Article 6(1)(b), (c) or (f) GDPR.
5. Registration and user account
When you use the registration and account functions, we process basic and account data such as your name, email address, role, Cognito user identifier, email verification status, account status, registration and usage times, and, for brands and creators, information about business activity and necessary company, tax and invoicing details. Authentication is provided through AWS Cognito; contentmarkt does not store a local password hash. The purpose is to create and administer the user account, check B2B use, authenticate users, prevent abuse and perform the platform contract. The legal basis is Article 6(1)(b) GDPR; security and abuse prevention is additionally based on Article 6(1)(f) GDPR.
For agency access, we also process the agency's name and contact details and information about people acting on its behalf. When agency terms and an individual partnership agreement are confirmed separately, we store the complete confirmed text, document version and verification value, its association with the signed-in account, and the confirmation time for each document. For the partnership agreement, we additionally store the declaring person's name, the agreed terms, and the start and end of the cooperation. The purpose is to establish and carry out the cooperation and provide evidence of the declarations. The legal basis is Article 6(1)(b) GDPR where the person concerned is themselves a contracting party, and Article 6(1)(f) GDPR otherwise. Our legitimate interest is reliable contract administration and proof of the person acting. Statutory retention requirements are fulfilled on the basis of Article 6(1)(c) GDPR.
6. Campaigns, submissions and content review
For campaigns, we process brand information, campaign briefs, approved source material, budgets, remuneration per 1,000 views, campaign periods, target platforms, eligible creators, format and content requirements, hashtags and mentions, advertising disclosure requirements, briefing rules and campaign snapshots. For creator submissions, we process the creator ID, social media handle, platform, post URL, caption, video upload or storage path, submission time, review status, review decisions, reasons and event logs.
The brand responsible for a campaign receives the creator submission and social media measurement data necessary to carry out and measure its campaign. This may include the creator handle, platform and post URL, submitted content and metadata, submission and review status, and campaign performance data. Performance data includes views and, where provided by the respective platform, likes, comments, shares and saves.
To review submissions, we may process technical media information, transcripts, OCR text from video frames, individual frame references, detected hashtags, mentions, disclosure labels, format data, rule violations, review confidence and reviewer notes. The purpose is campaign review, rights and disclosure checks, payout preparation, dispute documentation and abuse prevention. The legal basis is Article 6(1)(b) GDPR, with Article 6(1)(f) GDPR additionally applying to integrity and fraud checks.
6a. Campaign evaluation and comment classification
During and after a campaign, brands receive an evaluation of campaign performance. This includes, in particular, the number of participating creators, published posts, views, campaign costs and, where provided by the respective platform, likes, comments, shares and saves. The legal basis is Article 6(1)(b) GDPR.
Where provided for a campaign, we also classify publicly visible comments under published posts into categories, such as positive, neutral or questioning, and negative. We retrieve the text through EnsembleData. We do not include usernames, platform identifiers or other author data in this evaluation. Classification and summarisation are performed by a language model operated through Amazon Web Services within the EU, as described in section 8. Comment text is passed to the model only transiently and then discarded; it is neither stored in the database nor included in logs or error messages.
We store the number of comments evaluated, counts for each category, and short anonymised, summarised observations about the advertised product. The brand receives only these aggregated results in campaign evaluations and completion reports. Names, usernames, information about individual commenters, raw comments and sample quotations are neither stored nor shared with the brand. The legal basis is Article 6(1)(b) GDPR for carrying out and evaluating the campaign; for commenters who are not contentmarkt users, processing is based on Article 6(1)(f) GDPR. Our legitimate interest is to summarise the public response to a campaign without retaining individual statements.
6b. Campaign results reported by brands
Brands can report results generated by a campaign, such as purchases, app installations or registrations. Reporting takes place through a server-to-server interface; it does not pass through your device, and we use neither a cookie nor a tracking pixel for this purpose.
Each event contains only an identifier assigned by the brand, the event type, its time, an amount and currency where applicable, and, if available, the random identifier from the tracking link described in section 11. Names, addresses, email addresses, telephone numbers, customer numbers, IP addresses, device identifiers and information about order contents are explicitly excluded. The interface rejects reports containing additional fields instead of silently removing those fields. We therefore do not learn who made a purchase or download.
We do not store the identifier assigned by the brand itself, but only a verification value calculated from it that allows us to recognise a report delivered twice. The random identifier from the tracking link identifies the creator whose link was used, not the person accessing it or making a purchase.
We aggregate these reports by campaign and creator and show the brand how many results were generated by the campaign and what proportion could be attributed to a creator. A large proportion remains unattributed; this is normal on social networks and does not indicate more extensive evaluation.
For brands and creators, the legal basis is Article 6(1)(b) GDPR for carrying out and evaluating the campaign. For the brand's customers who are not contentmarkt users, processing is based on Article 6(1)(f) GDPR; our legitimate interest is to measure overall campaign success without knowing the individual person. We act as a separate controller for this processing; the brand is responsible for collecting data in its own system, and its privacy policy applies to that collection.
6c. Creator-to-creator referral code
When contentmarkt itself runs a campaign in which creators recruit other creators, you can voluntarily enter the code that brought you here when setting up your account. This is information you enter, rather than observation by us: we do not set a cookie or read a referrer address for this purpose. The information recorded about your journey through contentmarkt under section 11a, including your registration source, remains separate and has no effect on this attribution.
We store the entered code, the time it was entered and, if valid, its association with the creator and campaign to which it belongs. The code is a random character sequence assigned to the referring creator; it is not derived from their name or profile data. You can enter the code only once and cannot subsequently change it.
If you later connect a social media account and your code is valid, we record that a creator was acquired through it for the campaign. The referring creator learns the count, not who you are: your name, email address and profile are not shown to them. Conversely, the code you entered does not reveal any data about the referring creator to you.
Entering the code is optional and declining has no disadvantage. If you do not enter a code, you can still use contentmarkt in full; entering a code also creates no remuneration entitlement for you, because attribution applies solely to the referring creator's campaign. The legal basis is Article 6(1)(b) GDPR for carrying out the campaign and Article 6(1)(f) GDPR for the link to the referring account; our legitimate interest is to settle an advertised campaign in a traceable way. We delete this information with your account.
6d. Products for a follow-up video
Brands may voluntarily offer products that creators can keep. Active campaign participants can request a package when an accepted video reaches the specified number of views after review or the brand manually approves eligibility. We process the eligibility reason, package status, and the times of eligibility approval, the request and shipping. Your normal campaign participation remains unchanged if you do not request products.
If you request products, we process your name, delivery address (street, building number, optional address line, postcode, city and country), size or preference information, and the time of your explicit consent. Your delivery address is stored separately from invoicing details; we use an existing invoicing address only if you select it. The responsible brand can see this information together with your social media handle in its account so that it can ship the products. The request email to the brand contains neither your delivery address nor your size. An optional shipping note from the brand is shown only in the account; notification emails do not contain that note.
The legal basis for storing and sharing delivery details is your consent under Article 6(1)(a) GDPR, which you give by selecting the separate checkbox when requesting products. You can withdraw it at any time in the product card with effect for the future: before shipping, you withdraw the request; after shipping, you delete your delivery details while the package remains in transit. contentmarkt then immediately clears your name and address, size or preference information, and the shipping note, and no longer displays them to the brand. The lawfulness of processing before withdrawal is unaffected. Copies already stored by the brand and processing by its shipping provider are governed by their own privacy policies; we cannot automatically delete those copies.
6e. Association and cooperation with agencies
Agencies may also maintain their own private talent list before a talent has a Creator account or accepts an invitation. The Agency enters a name and, optionally, profile information and an email address. We store these details provided by the Agency, the associated Agency, the internal active or archived status, and the times of creation and changes in order to provide internal talent management within the relevant Agency access. These details are not displayed publicly and are not transferred to a Creator profile. They are separate from the Creator-confirmed connections and authorized platform data described below. Saving or editing triggers neither an invitation nor account creation nor authorization to register for campaigns. An invitation and its link to an internal entry take place separately; matching email addresses alone do not connect accounts or records. The Agency can edit the details it entered. Section 15 applies to requests for correction and deletion.
An agency may provide a creator's email address and public social media profile for an invitation expected by that creator. We process this information, the inviting agency and the invitation status to provide a personal invitation link and prevent incorrect associations. In this case, the information comes from the agency named in the invitation. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is reliable delivery of an expected invitation. You can object to this contact through the privacy contact in section 15. An invitation does not give the agency access to a creator account.
Creators confirm their association with the agency displayed to them themselves in their own account. We store the account identifiers involved, the confirmed association, confirmation time, selected permissions, and subsequent changes or the end of representation. An invitation or agency entry alone does not replace this confirmation. Processing for the connection requested by the creator is based on Article 6(1)(b) GDPR. Necessary records of the association and changes to it are processed on the basis of Article 6(1)(f) GDPR. Our legitimate interest is the traceable administration of confirmed and ended connections.
Creators separately and voluntarily grant access to personal platform data. They can confirm the agency association without granting that access. While consent is active, only the agency displayed receives the authorised information about names and social media profiles, campaign participation, submitted posts and their review status, views, earnings and payout status, and payout readiness. Bank details, tax identifiers, your address and login credentials are not shared with the agency for this support. The purpose is the support requested by the creator on contentmarkt. This sharing is based on separate consent under Article 6(1)(a) GDPR. Agency terms and the partnership agreement do not replace that consent.
To document the decision, we record the accounts involved, the person acting, the time, the permissions selected, the version of the notice displayed together with its content and verification value, and subsequent changes, withdrawals and termination of the connection. This documents permissions granted and terminated under Article 7(1) GDPR. For the necessary retention of evidence, we rely on Article 6(1)(c) GDPR and, where necessary for legal claims, Article 6(1)(f) GDPR. Our legitimate interest is establishing whether access was permitted at a particular time. Retention periods are described in section 12.
You can withdraw permission to share data at any time, with effect for the future, in the Agency section of your profile, or end the connection. You can continue using your other Creator features without granting permission. Following withdrawal or the end of representation, contentmarkt stops providing the agency with the personal details concerned. Withdrawal does not affect the lawfulness of sharing based on consent before its withdrawal. We cannot automatically delete copies held by the agency. Its own privacy notice applies to its processing.
As long as a confirmed connection exists, even without permission to access data the Agency sees only that an account is connected, the time of the connection, and the current permissions. Names, social-media handles and personal performance data from the Creator account are not displayed. Information entered by the Agency in the private talent list remains separate. We use this limited connection information to manage the confirmed support relationship on the basis of Article 6(1)(f) GDPR. Our legitimate interest is in maintaining an accurate connection status without substituting for permission to access details that has not been granted.
Access to data is separate from an agency's contractual financial participation. To calculate and verify that participation, we process the necessary account assignment, confirmation time, applicable contractual terms and platform fees from Creator payouts, together with the necessary settlement records. Without active permission to share data, this does not give the agency access to personal Creator details. Financial totals can nevertheless allow conclusions about individual Creators, especially in small groups. We therefore do not treat connection information and such totals as anonymous simply because they lack a name. The legal basis for this settlement and the necessary information provided to the entitled agency is Article 6(1)(f) GDPR. Our legitimate interest is correctly fulfilling and verifying agreed entitlements. We process records subject to statutory retention under Article 6(1)(c) GDPR.
A participation entitlement already established may continue after the collaboration or representation ends, where agreed. It does not provide continued access to personal Creator details. Where the agreement ties the duration of participation to the Creator's registration, future participation ends when that Creator account is closed. Settlement records already created are handled separately. A new registration does not restore an earlier assignment or permission to share data.
6f. Optional iPhone notifications
If you enable notifications in the contentmarkt app and grant the iPhone system permission, the app registers the Apple device token, an app installation identifier, and technical information about the app, project and delivery environment with the Expo Push Service. We store the resulting Expo push token together with its association with your contentmarkt account, the platform, a random identifier for this device registration, the revision of the device settings and, where applicable, the app version. The purpose is to deliver the notifications you request about the status of your applications, clips and billing. The necessary processing is based on Article 6(1)(b) GDPR.
The app provides one combined option to enable status notifications, notices about new campaigns, and reminders to create and submit clips. The app explains these purposes before activation. By making this optional selection, you consent to campaign notifications for this device. An earlier iPhone system permission or device registration alone is not treated as campaign consent. Without a deliberate activation of campaign notifications, these notices remain disabled; previously given explicit campaign consent remains valid. While campaign notifications are enabled, we store the campaign consent identifier and the start of the current device registration with campaign permission. After signing in again, this time identifies the current delivery permission, not a newly given consent. When you disable notifications, we remove this information from the device token. The legal basis for sending campaign notices is Article 6(1)(a) GDPR; the necessary proof of consent is based on Article 6(1)(c) GDPR together with Article 7(1) GDPR. You can use the app without notifications and without campaign notifications.
The app stores your explicitly confirmed notification selection for this account on this iPhone. Signing out ends delivery for this account; the local selection is retained. If you sign in to the same account again on this iPhone and iPhone notifications are still permitted, the app registers them again using the saved selection without asking for renewed consent. Disabling notifications in the app also withdraws the locally saved campaign permission. This selection is not transferred to a different account.
For delivery, we send the Expo push token, title and text, and technical campaign or clip identifiers to 650 Industries, Inc. (Expo). Expo forwards the notification to your iPhone through the Apple Push Notification service. Notifications contain general notices; euro amounts, rejection reasons and personal campaign or clip details are not sent as visible notification text. You can view the details after opening the app and signing in. General notices may appear on the lock screen. You can also control their display in your iPhone settings.
You can disable all contentmarkt notifications for this device at any time using the combined option in the app and thereby also withdraw your campaign consent. When all notifications are successfully disabled or you sign out, we remove the raw device token and its active device and marketing selection entry from our delivery register. To block delayed registration requests after deregistration, we separately store a cryptographic verification value of the withdrawn device registration (or, for older app versions, the push token), its account association and the withdrawal time until account deletion. This blocking record contains no raw device token, no raw registration identifier and no marketing consent; it cannot authorise sending and remains associated with your account. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to reliably enforce your decision to deregister. If you explicitly enable notifications again, a new registration identifier is created. When the account is deleted, we remove all device tokens associated with it, including previously deactivated tokens, and the blocking record. Tokens reported as invalid are deactivated and are no longer used for delivery. Withdrawing the iPhone system permission alone does not constitute an immediate request to delete data from our database.
Stopping delivery or deleting an entry from our register does not recall messages already passed to delivery services and does not cause verified immediate deletion of a token at Expo or Apple. According to Expo, it processes message content only until it is forwarded to the relevant delivery service. Expo stores the tokens needed for assignment and delivery separately; its public provider information does not specify a fixed individual deletion period. Please send questions and deletion requests to us via the privacy contact in section 15. Processing may take place in the United States. For Expo's service-related processing, the applicable Expo terms provide for its role as processor and EU standard contractual clauses, Module 2. Section 10 applies to other recipients and transfer safeguards; section 12 applies to necessary records.
7. Connected social media accounts
When Creators connect an Instagram or TikTok account, we process the data supplied through the relevant login or API procedure to the extent necessary for ownership validation, campaign checks, view and insights verification, settlement and fraud prevention. This may include access tokens, platform user IDs, usernames, account types, profile information, media metadata, media IDs, video or reel links, captions, publication times, views and interactions such as likes, comments and shares. For Instagram, we keep the platform login access token exclusively in your own encrypted browser session and transmit it only temporarily for verification or real-time retrieval; it is not permanently stored on ContentMarkt's servers. For TikTok, we also store access and refresh tokens encrypted on our servers while the profile is connected. The sole purpose is to retrieve view counts for your submitted videos directly from TikTok without requiring you to be logged in; your remuneration is therefore based on the platform's figures. We delete these tokens when you disconnect the profile or delete your account. On the server, we store in particular the verified campaign account connection with its public handle and platform identifier, the OAuth provenance needed for assignment and deletion, and campaign-related submission and measurement data, each assigned to your contentmarkt account. A data deletion request confirmed by Meta deletes the corresponding Instagram OAuth account connection; account deletion and other confirmed deletion requests remain available in addition. YouTube may be an eligible submission or publishing platform, but contentmarkt currently does not offer YouTube account connections.
We do not ask for social media passwords. Connected Instagram and TikTok accounts can be revoked in the relevant platform's settings; you can also request deletion of data stored by contentmarkt via /data-deletion or by email. The legal basis is Article 6(1)(b) GDPR where the connection is necessary for platform use, campaign checks and settlement; we base integrity, security and fraud checks on Article 6(1)(f) GDPR.
7a. Optional public Creator profile
Creators can separately and voluntarily publish a public Creator profile. Its purpose is to provide a shareable public presentation of expressly selected social media accounts. The feature is not required for OAuth connections or campaign participation; choosing not to use it affects neither. Only the selected display name and the expressly selected platforms, social media handles and links to the relevant provider profiles are visible. Internal account or binding IDs, OAuth subjects, access or refresh tokens and other internal data are not published there. Connecting a social media account through OAuth alone does not publish a Creator profile. The legal basis for publication is separate, voluntary opt-in under Article 6(1)(a) GDPR; it can be withdrawn at any time with effect for the future.
A published profile page is accessible worldwide. A seemingly random URL does not protect access; even a technical instruction asking search engines not to index the page cannot reliably prevent discovery or third-party copies. Recipients include the worldwide public and the hosting and infrastructure providers listed in section 3. Following withdrawal, or once no selected active social media profile remains, the profile page is immediately unavailable on contentmarkt and returns 404; this does not automatically remove copies already made by third parties. Profile configuration, the slug and the opt-in record are retained until account closure in accordance with section 12.
8. Automated analysis, anti-fraud and human review
contentmarkt can check submissions technically and against rules, for example using format data, hashtags, mentions, advertising disclosures, visible products, tone, transcripts, OCR, metadata and signals of duplication or fraud. Matters that cannot be expressed as a fixed rule, such as whether a video's content matches the campaign brief, may additionally be assessed by a language model. We operate this model through Amazon Web Services within the EU; the assessment data listed above, such as transcripts, OCR text and individual frames, are processed for this purpose.
Audio transcription and text recognition in individual video frames run using free software on our own systems and are not transmitted to another provider. Only the results of these steps are sent to the language model mentioned above, to the extent necessary for the individual assessment.
The clip and data derived from it are not used to train, test or improve AI systems. Any further use of AI requires a separate written agreement.
The checking logic helps apply campaign rules transparently, identify clear violations, escalate uncertain cases and prevent manipulation. Automated or rule-based results are initially provisional. Before an adverse measure, in particular rejection, a payout hold or a recovery claim, we inform the Creator of the main reasons and the escalation process. If a case is escalated, a natural person reviews the decision and communicates the outcome with reasons.
9. Payouts, tax and compliance obligations
For payouts to Creators and settlement with brands, we process contractual, invoice, payment, transaction, campaign and payout data. In the local contentmarkt system, we store in particular settlement and payment references, Stripe customer, checkout, invoice, connected-account and transfer IDs, status data, and campaign, settlement and payout snapshots. The legal basis is Article 6(1)(b) GDPR for contracts and payouts, and Article 6(1)(c) GDPR for statutory retention, tax, commercial and reporting obligations, in particular the tax rules applicable to platform operators.
Stripe Connect may be used as a payment service provider for payment processing and identity or account checks. Creators enter identity, address, tax and bank details for Connect onboarding directly in Stripe's hosted onboarding flow; Stripe processes and hosts those data for onboarding, verification and bank payouts. contentmarkt does not store the KYC and bank details entered there as raw data locally, but only the Stripe IDs and status and requirement snapshots needed for payout processing. Data subject to statutory reporting may be transmitted to the competent authorities, in particular tax authorities and Germany's Federal Central Tax Office.
10. Recipients, processors and transfers to third countries
Depending on the feature, recipients of personal data may include hosting and infrastructure providers, payment service providers, social media platforms, support, security, analytics and communication providers, legal and tax advisers, and authorities. Within contentmarkt and the responsible organisation, access is limited to people who need the data for operations, support, review, settlement, legal matters or security.
These currently include: Amazon Web Services for the backend, API, database, storage, queues, security and infrastructure processes, and the language model mentioned in section 8; Vercel for delivery of the website and web interface and for audience measurement under section 11; Stripe for payouts and identity and account checks; Meta or Instagram and TikTok in connection with connected accounts and the media and measurement data retrieved through them; and YouTube where permitted as a publishing platform for a campaign. Data may also be sent to legal and tax advisers, authorities and courts where required by law or necessary to enforce or defend legal claims.
Where service providers or third-party platforms process data outside the EU or EEA, this takes place only on the basis of appropriate safeguards. Where a European Commission adequacy decision exists, we base the transfer on that decision; for appropriately certified US providers, this includes in particular the EU-US Data Privacy Framework. Otherwise, we use EU standard contractual clauses and, where necessary, supplementary technical or organisational measures. You can request information about the safeguards used in individual cases from the Data Protection Officer.
If you request merchandise for a follow-up video, the brand responsible for your campaign receives your name, delivery address and size or preference information for shipping with your separate consent. Further information is provided in section 6d.
The sole recipient of Creator data released for representation is the agency confirmed by and displayed to the Creator. The scope and duration depend on the separate current permission. Without permission to access details, the agency receives only the limited connection information described in section 6e and the totals necessary for its own settlement. An agency's confirmation of a partner agreement alone does not grant access to Creator data. The agency is independently responsible for its own representation and processing and provides its own privacy notice.
650 Industries, Inc. (Expo) for registration and delivery of optional iPhone notifications, and Apple for forwarding and delivering them through the Apple Push Notification service; the scope is described in section 6f.
11. Cookies, local storage and analytics
Where technically necessary cookies or comparable storage and retrieval operations are used for login, security, form functionality, session management or load balancing, they are used only to the extent strictly necessary for the requested service. The legal basis for access to terminal equipment is section 25(2), no. 2 TDDDG; Article 6(1)(b) or (f) GDPR applies to the subsequent processing of personal data.
We use Vercel Web Analytics to measure the audience of our public website, but only with your consent. Measurement is off by default; it starts only when you agree in the consent window and remains off when you select “Necessary only”. We collect aggregate page-view information such as the page visited, the source of the visit, and country, browser and device type. We also measure completed registrations by account area (Creator or brand) and clicks to the appointment calendar. A calendar click does not mean a confirmed booking. Before transmission, we completely remove the address's query string and fragment; account pages, administration pages and unapproved page paths are replaced with general placeholders. We do not transmit names, email addresses, account or campaign identifiers for this purpose. The legal basis is your consent under Article 6(1)(a) GDPR and, where your device is accessed, section 25(1) TDDDG. You can change your decision at any time with effect for the future using “Privacy settings” in the footer. We do not embed third-party marketing or advertising trackers.
With your voluntary selection in the consent window, we record at most one website visit day per signed-in account and UTC day. Consent is requested separately in the app, where we similarly record app visit days. These data are used to analyse recurring use per account and overall. We do not store sequences of pages or screens for this purpose. Only authorised administrators can see the account assignment. Visit days are deleted within 90 days; on withdrawal, we immediately delete visit days for the relevant interface. Without consent, this recording does not take place.
After your consent, we use the session storage of the relevant browser tab (contentmarkt_acquisition_v1) to attribute the visit's source and landing page. It contains only a source category, an approved public page path and the start of the measurement window. Attribution lasts for at most 30 minutes and ends when the tab closes. For a registration that has just been completed, we also set the contentmarkt_registration_completed cookie for at most five minutes. It contains only the account area and time. A matching short-lived marker in the return address assigns the confirmation to the correct browser tab and is removed from the address before the event is reported. The cookie is consumed in the process. When consent is declined or withdrawn, we remove this attribution and the registration cookie in the current tab.
We record your decision itself in a separate cookie so that we do not ask you again on every visit. It is called contentmarkt_consent, is set by contentmarkt itself, contains only your selection with its timestamp and version number, and expires after 180 days.
If a brand sets up a tracking link for a campaign, each participating Creator receives a separate address in the form contentmarkt.net/r/ with a random identifier. When someone opens this address, we immediately redirect them to the brand's destination page and increment a counter. The count contains only this identifier, the visit date and the number of visits. We do not set a cookie for this purpose or store the visitor's IP address, browser identifier or referrer address in it. Requests additionally generate the technical server logs described in section 3; these are not combined with the count and are regularly deleted after 30 days. The browser identifier is assessed only at the moment of the request to exclude automated visits from the count and is then discarded. The random identifier is not derived from names, account or profile data and does not by itself reveal the identity of the visitor. No access to your terminal equipment within the meaning of section 25 TDDDG takes place. The legal basis for redirection and audience counting is Article 6(1)(f) GDPR; our legitimate interest is measuring campaign performance. What happens on the brand's destination page after redirection is the brand's responsibility and is governed by its privacy policy. We do not observe subsequent activity there. If the brand reports campaign results to us, section 6b applies.
11a. Product journey records
For Creator accounts, we record completed registration and successfully saved submissions against the account. We store the account identifier, event type, the time of the action and recording, the interface used and the source category. For a submission, we additionally record the campaign and submission identifiers, platform and submission type (social media link or upload). A submission counts as successful only once it is saved; the first such submission serves as our measure of Creator activation. Applications and failed attempts do not count for this purpose.
For registration, we also store three short source fields: channel, campaign and creative, together with the attribution time. The information comes from the designated parameters of the registration address when signing up directly by email; only approved codes are accepted. For registration through Google or the hosted signup page, and where no usable information is available, we store “unknown”. This attribution does not assign a promotional-code reward under section 6c. We do not store the full address, referrer addresses, ad-platform click identifiers, device identifiers or the contents of your posts for this purpose. We do not use additional cookies or browser session storage for these fields. The consent-dependent website audience measurement described in section 11 remains separate.
The purpose is to understand how Creators reach us and whether they subsequently submit successfully, so that we can improve registration and product workflows. These source fields and event records are retained until account deletion and deleted with the account. Separate campaign, review and settlement records remain subject to section 12. The legal basis for this product measurement is Article 6(1)(f) GDPR; our legitimate interest is evaluating and improving these workflows.
Separately, we maintain a short-lived journey record: for at most 30 days, under a pseudonymous identifier, we record the day on which someone reached a particular page or step in contentmarkt — registering, seeing their account start or connection page, connecting a social media account, opening a campaign, opening the submission form and submitting a clip. Without an account, we record only the app offer shown on the homepage to visitors arriving from one of our emails: whether it was displayed and whether someone went from there to the App Store or the app. We also record when one of these steps fails. We do not record a reason; however, one step names the platform because it counts precisely the connection-page state in which TikTok login failed and the bio-code route therefore became available. The purpose is to identify where contentmarkt workflows are abandoned and improve them.
The record contains no more than the day, the step, the surface through which it was reached (website, app or interface), and this identifier: no campaign, submission, amount or post content. A step name may indicate which channel you tried to connect; it contains no further platform information. When we display your own TikTok posts for selection in the submission form, we retrieve them from TikTok at the moment of display and store nothing from them — no titles, addresses, post identifiers, view counts or even their number.
Each step also generates a log entry with the same identifier. For an account step, it additionally contains the request's response status; for an app-offer step, it instead contains the name of the email wave through which you arrived. These entries serve the same purpose as the record and, like the technical logs described in section 3, are regularly deleted after 30 days.
The identifier replaces your name. If you have an account, it is calculated from your account identifier; we can associate it using our account list, while it is meaningless to third parties without that list. If you do not have an account, we derive it from the short name under which we contacted you, or, without such a name, from the date together with information your browser sends with every request anyway (IP address, browser identifier); in the latter case it changes daily. The identifier based on a short name, by contrast, remains the same across days, and we can associate it using our mailing list. We set no cookie for this purpose and store no identifier on your device; whether we display the app offer at all is decided by a small browser script using the browser identifier, and nothing is stored on your device in the process. We delete this record within 30 days. When you close your account, we immediately delete entries carrying your account identifier; entries under an identifier without an account are not removed upon account closure, but within 30 days.
What remains is plain daily counts: how many distinct people reached a particular step on a given day. These daily counts are retained.
The legal basis is Article 6(1)(f) GDPR; our legitimate interest is identifying where workflows in our product are abandoned and improving them.
12. Retention and deletion
We retain personal data only as long as necessary for the relevant purposes. We retain waitlist data until the pilot phase starts, until removal from the list, or until transfer to an active user account. For production operations, subject to statutory retention obligations, outstanding claims and documented security or fraud cases, the following standard periods apply: following account closure, account data are generally deleted or anonymised in active systems within 30 days; where contentmarkt stores raw video files, these are generally deleted 90 days after final settlement; campaign, review, measurement and dispute records are generally retained for three years after final settlement or resolution of the dispute. We maintain campaign results reported by brands under section 6b as records that cannot be changed retrospectively, so that settlement remains traceable. We delete them three years after final campaign settlement. We delete journey-record markers under section 11a within 30 days and, where they carry your account identifier, when your account is closed; the resulting daily counts are no longer personal data and are retained.
We retain invoices and documents subject to commercial and tax retention obligations for the period required by law. Technical access and error logs are regularly deleted or anonymised after 30 days; security and fraud logs are regularly deleted after 90 days unless a specific investigation or legal obligation requires longer retention. Deletion from active systems does not immediately cover backups; affected data are removed during the normal overwrite cycle, generally within 90 days. A deletion request does not trigger automatic deletion: we check identity, statutory retention obligations, settlement, fraud prevention and dispute documentation, then arrange the deletion or anonymisation legally possible.
You can delete your account yourself without writing to us: in both the app and the website, use “Delete account” in your account area. Access, the login profile, connected social media links, participation and submissions are removed immediately. Records subject to retention under this section, in particular invoices and tax-relevant documents, remain unaffected.
We delete a product package's delivery address, size or preference information, and shipping note within 60 days after the package is marked as shipped. If a request has not been marked as shipped after 60 days, we close it and delete this information as well. The information is cleared immediately upon withdrawal of consent or account deletion. Package status and the times of eligibility approval, consent, request and shipping remain as records of the operation until the account or campaign is deleted. These periods apply to contentmarkt; the brand's own copies are governed by its privacy policy.
Internal talent entries are stored for talent management within the Agency access. Archiving hides an entry from the active list but does not delete it; restoring makes it visible there again. The entry is retained until the Agency account is deleted and is deleted with that account. Archiving or restoring does not change an existing Creator connection or its permissions. Deleting a Creator account does not delete talent information independently entered by the Agency itself. Requests for correction and deletion can be made through section 15.
We process agency account data to establish access and for its duration. The general criteria in this section apply upon account closure. We need invitation information for delivery and verification of the invitation. Once an invitation is accepted, expired or revoked, and no specifically justified evidence or retention obligation exists, information no longer needed is deleted or anonymised. Access for representation ends when permission is withdrawn or the connection ends.
We retain the full texts and records of an agency agreement, the separate acceptances and the necessary information about the person acting for as long as the agreement or a participation entitlement arising from it must be fulfilled and settled. The end of collaboration after twelve months alone does not end this purpose if previously confirmed Creator participation entitlements continue. After the last such entitlement ends and is finally settled, we assess each document for any remaining statutory retention obligation or specifically necessary evidence for legal claims. The same applies to assignment and data-sharing permission records after the relevant processing ends. Documents required by retention obligations or a documented legal case continue to be processed only for those purposes and remain unavailable for personal representation. When all relevant purposes and obligations have ended, we delete them or irreversibly remove their personal character.
Statutory periods depend on the type of document, for example the rules for commercial and business correspondence or accounting records. For necessary evidence relating to legal claims, we consider when the claims arose, the applicable limitation period and any ongoing dispute. Account closure or merely removing an account identifier does not anonymise a contract text containing names and party information. Where such information is still needed, it remains stored under the criteria above. Backups are governed by the general rules in this section.
We retain raw device tokens registered for receipt until the device is successfully deregistered or the account is deleted. We stop using tokens reported as invalid by delivery services; they are removed from our register no later than account deletion. The campaign-consent identifier and the start of the current device registration with campaign permission are associated with the device token; turning notifications off removes those fields, and removing the token also removes the association. The local notification choice is retained on logout; its campaign permission is withdrawn when notifications are turned off in the app. The separate revocation register described in section 6f contains only the verification value of the revoked device registration (the push token in older app versions), the account reference and revocation time, and is retained until account deletion. We do not maintain a separate permanent marketing-consent history. The other retention and deletion rules in this section remain applicable.
13. Required data and consequences of not providing it
Certain data are required for individual features. Without an email address, we cannot provide account functionality; without required account, campaign, social account or payment data, we cannot perform campaigns, verification, payouts or statutory reporting, or can do so only to a limited extent.
14. Minors
contentmarkt is not intended for children. Creators must be at least 18 years old and have full legal capacity. The platform is intended exclusively for people acting in their business or self-employed professional capacity; consumer use is not provided for. If we learn that an account was created by a minor contrary to these requirements, we may suspend the account and delete data in accordance with legal requirements.
15. Your privacy rights
Subject to the statutory conditions, you have in particular the rights of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent with effect for the future. To exercise your rights, please contact datenschutz@axelspringer.de and use the subject line “contentmarkt – Betroffenenrechte”. You also have the right to complain to a data protection supervisory authority.
Specifically, under the GDPR these are the rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), objection to processing based on Article 6(1)(e) or (f) GDPR (Article 21), and rights relating to automated decisions (Article 22). The competent authority for contentmarkt is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, mailbox@datenschutz-berlin.de. You may also contact the supervisory authority for your habitual residence or place of work.
Right to object. Where we process personal data under Article 6(1)(f) GDPR, you may object to that processing at any time on grounds relating to your particular situation. We will then stop processing the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to enforce or defend legal claims.
15a. Data security
We take appropriate technical and organisational measures to protect personal data against loss, alteration, unauthorised access and unlawful disclosure. These include in particular encrypted transmission through TLS, access restrictions based on necessity, authentication through AWS Cognito without a local password hash, encrypted storage of the TikTok tokens mentioned in section 7 using a key outside the database, logging of administrative access, technical separation of internal and publicly visible data, measures to detect manipulation and abusive use, and regular deletion of data no longer needed under section 12.
16. Changes to this privacy policy
We update this privacy policy when contentmarkt, the services used, API integrations, analysis methods or legal requirements change. The current version is available at /datenschutz available.