Privacy - Information on the processing of personal data through the website and platform
This information on the processing of personal data ('Information') aims to describe the purposes and methods by which Inflead S.r.l., as the Data Controller ('Company' or 'Controller'), collects and processes the personal data of the user ('User/s') who interacts with the website www.inflead.com ('Website') and, upon registration, with the various services offered by it through the Company's influencer insights platform ('Platform').
The information contained in this Information is provided in accordance with articles 13 and 14 of the EU Regulation of 27 April 2016 no. 679 ('Regulation'), as well as the provisions and guidelines issued by the Data Protection Authority and the competent European authorities.
The information about the processing of data is provided only for the Website and for the processing carried out by the Company and does not extend to processing carried out by third parties through other websites that the User may consult via links. The Company assumes no responsibility for these additional processing, and the User should refer to the individual information on the processing of personal data of third-party websites.
1. Data Controller, place of processing and Data Protection Officer (so-called RDP or DPO)
The Data Controller is Inflead S.r.l., with a registered office at Via Tolmezzo 8, Trieste, Italy.
The data is mainly processed at the Controller's headquarters, by technical staff of the Company appointed and in charge, within the territory of the European Union and, in relation to services entrusted or offered by third parties, also outside the Italian State and/or outside the European Union. In case of data transfer to countries that do not present standards of protection equal to the Italian one, the Company undertakes to adopt the necessary measures provided by the Regulation to ensure adequate guarantees in relation to the transfer. Inflead S.r.l. has appointed a Data Protection Officer (so-called RDP or DPO), who can be contacted for clarifications and questions relating to the processing of personal data at the address: dpo@inflead.com.
2. Methods of data processing
The Company processes the User's data by adopting appropriate security measures aimed at preventing unauthorized access, as well as unauthorized disclosure, modification, or destruction of data.
The processing is carried out using both manual and computer and/or electronic tools, with organizational methods and with logic strictly related and limited to the purposes indicated.
3. Purpose and legal basis of the processing
The Company, through the Website and the Platform (for registered Users), will process the User's data as indicated in the following table:
| Interested parties | Categories of data | Purpose | Source | Legal basis | Cancellation terms |
|---|---|---|---|---|---|
| Users, even unregistered, who browse the Website | Navigation data, such as IP address, URL, method used to submit the request to the server | Allow Users to navigate the company's website | Data collected directly from the User | Need to execute a contract in which the interested party is a part | Data will be retained for a maximum of 12 months from the date of accessing the website |
| Users who intend to register on the Platform | Identification and contact data, such as name, surname, gender, date of birth, email, telephone number, address, country, VAT | Registration and creation of the Platform account | Data collected directly from the User | Need to execute a contract in which the interested party is a part | Data will be retained for 10 years from the last access to the account or from the account's deletion, whichever comes later |
| Registered Users | Identification and contact data, such as name, surname, age, sex, nationality, email, address, telephone number | Provision of services requested by the registered User | Data collected directly from the User | Need to execute a contract in which the interested party is a part | Data will be retained for 10 years after the termination of the service contract with the customer |
| Users, even unregistered, who communicate with the Company | Name, surname, business email, telephone number, name of the company or agency | Provide feedback to the User's request | Data collected directly from the User | Need to implement pre-contractual measures at the request of the interested party | Data will be retained for the time necessary to process the request and not beyond 24 months from receipt of the request |
| Users consenting to marketing communications | Name, surname, business or personal email | Direct marketing activities | Data collected directly from the User | Consent given by the User | Data will be retained for a maximum of 24 months from the date of collection, unless the consent is revoked |
| Users who use the Website | Internet browsing data, such as IP address, browser and device details, pages visited, actions taken on the site, cookies | Profiled marketing activities through cookies | Data collected directly from the User | Consent given by the User | Data will be retained for a maximum of 14 months from the date of collection, unless the consent is revoked |
| Users who use the Website | Internet browsing data, such as IP address, browser and device details, pages visited, actions taken on the site, cookies | Analysis on the use of the website, evaluate performance, detect issues, fraud prevention | Data collected directly from the User | Legitimate interest of the data controller to improve functionality and ensure security | Data will be retained for a maximum of 14 months from the date of collection, unless there is an objection from the User |
| Influencers registered or not on the Platform | Username, profile description, location, public media, engagement data, social profile insights | Analysis and processing of influencer profiles | Data collected through Instagram Graph API, YouTube API, TikTok, Twitch API, and other sources | Legitimate interest in managing the Platform and its services | Data will be deleted in case of prolonged inactivity of the influencer on social networks |
| Influencers registered or not on the Platform | Username, profile description, location, public media, engagement data, social profile insights | Sharing with customers of influencer reports containing business insights | Data collected as per the previous point | Legitimate interest as indicated above | Data will be deleted in case of prolonged inactivity of the influencer on social networks |
| Influencers registered or not on the Platform | Email addresses | Communicate with influencers about business opportunities | Data provided by the User or obtained from public profiles | Legitimate interests of the Company and its customers | Data will be deleted in case of prolonged inactivity of the influencer on social networks |
The Company, through the Website and the Platform (for registered Users), will process the User's data as indicated in the following table:
Interested parties
Categories of data
Purpose
Source
Legal basis
Cancellation terms
Users, even unregistered, who browse the Website
Navigation data, such as IP address, URL, method used to submit the request to the server
Allow Users to navigate the company's website
Data collected directly from the
Need to execute a contract in which the interested party is a part
Data will be retained for a maximum of 12 months from the date of accessing the website
Users who intend to register on the Platform, whether they are companies and agencies or influencers and freelancers
Identification and contact data, such as name and surname, gender, date of birth, email or business email, telephone number, address, country, and VAT number.
Registration and creation of the Platform account
Data collected directly from the
Need to execute a contract in which the interested party is a part
Data will be retained for a period of 10 years from the last access to the account or from the account's deletion, whichever comes later
Registered Users
Identification and contact data, such as name, surname, age, sex, date of birth, nationality, address, email, telephone number.
Provision of services requested by the registeredUser
Data collected directly from the User
Need to execute a contract in which the interested party is a part
Data will be retained for a period of 10 years after the termination of the service contract with the customer.
Users, even unregistered, who intend to communicate with the Company for requests, questions, and information related to the services offered
Name and surname, business email, telephone number, name of the company or agency
Provide feedback to the interested party's request
Data collected directly from the User
Need to implement pre-contractual measures adopted at the request of the interested party
Data will be retained for the time necessary to process the specific request and, in any case, not beyond 24 months from the receipt of the same.
Users, even unregistered, who consent to the sending of marketing communications through the forms in the 'Data Lab' and 'Contacts' sections
Name and surname, business or personal email
Direct marketingactivities
Data collected directly from the User
Consent given by the User
Data will be retained for a maximum of 24 months from the date of collection, unless the consent is revoked.
Users, even unregistered, who use the Website
Internet browsing data, such as IP address, details of the browser and device used, pages visited, actions taken on the site, information contained in cookies, logs, pixels, tags.
Profiled marketing activities through cookies
Data collected directly from the User
Consent given by the User
Data will be retained for a maximum of 14 months from the date of collection, unless the consent is revoked (see also the cookie usage policy).
Users, even unregistered, who use the Website
Internet browsing data, such as IP address, details of the browser and device used, pages visited, actions taken on the site, information contained in cookies, logs, pixels, tags.
Analysis on the use of the website, evaluate the performance and effectiveness of the pages and features, as well as to identify and resolve any technical problems and fraud prevention
Data collected directly from the User
Legitimate interest of the data controller to improve the functionality of its website and to ensure its security
Data will be retained for a maximum of 14 months from the date of collection, unless there is an objection from the data subject.
Influencers registered or not on the Platform
Username, profile description, location, public media, related descriptions, generated engagement* and social profile insights**
Analysis, including profiling, and processing of information related to influencer profiles
Data collected through Instagram Graph API YouTube API TikTok Twitch API Data Sources and other Social Networks*
Some data is collected from our customers** or from the influencers themselves, if registered on the Platform
Legitimate interest in the provision and management of the Platform and the services provided by the Company. The data processed is made available by Users (including influencers) who register on the Platform or is publicly available. Their processing should not have any negative impact on their privacy. The Company applies standard industry security measures and also provides a simple way to object to inclusion within the Platform database, as indicated in art. 6.
The data will be deleted in case of prolonged inactivity of the influencer on social networks.
Influencers registered or not on the Platform
Username, profile description, location, public media, related descriptions, generated engagement* and social profile insights**
Sharing with customers, upon their request, of reports containing business insights on influencers, based on the processing of data made publicly available by the influencers themselves
Data collected as specified in the previous point
Legitimate interest as already indicated in the previous point
The data will be deleted in case of prolonged inactivity of the influencer on social networks.
Influencers registered or not on the Platform
E-mail addresses
Communicate with influencers about business opportunities arising from the Company's customers
The data is provided directly by the User or is obtained from the public profiles of influencers within the reference Social Networks
This processing is based on the legitimate interests of the Company and its customers to communicate with the influencer for commercial purposes, particularly for introducing marketing campaign opportunities with the influencers themselves. For this purpose, the Company uses the contact information that has been made available directly by the user or that is publicly indicated by the influencer, and their processing should not have any negative impact on their privacy. The Company applies standard industry security measures and provides a simple way to opt-out of inclusion within the Platform, as indicated in art. 6.
The data will be deleted in case of prolonged inactivity of the influencer on social networks.
The communication of the personal data is mandatory only when necessary for the execution of a contract with the data subject or the adoption of pre-contractual measures at the data subject's request (e.g., in the case of browsing the Site or registering on the Platform). In these cases, if the User does not provide their personal data, Inflead would not be able to fulfill its contractual obligations. In all other cases, whether the User is registered or not, they are free not to provide their personal data, to object to their processing, or to revoke the consent given.
In relation to the use of cookies, in addition to the information provided in this Privacy Policy, please refer to the specific cookie usage policy available here.
4. Communication of data to third parties
The data collected by Inflead, whether collected directly from the User or not, will not be disclosed and may be communicated, for the purposes and methods outlined in this Privacy Policy, to the following categories of subjects:
- companies, employees, consultants, or freelancers that the Company relies on for technical or organizational tasks (such as IT service providers) with whom the Company collaborates for the provision and functioning of its services or for any communication activities;
- individuals, companies, or professional firms providing assistance and consulting services to the Company, particularly but not exclusively in accounting, administrative, legal, tax, and financial matters;
- entities authorized to access data by legal provisions or orders from authorities;
- customers, with reference to the personal data of influencers collected through social networks and subsequently processed.
The subjects belonging to the categories mentioned above will use the data as independent data controllers or data processors regularly appointed by the Company in accordance with the law. These subjects may not necessarily be located in EU countries. The list of subjects to whom data is or may be communicated, as well as the indication of the privacy measures adopted to legitimize extra-EU transfers, can be requested from the Company by contacting the addresses indicated in the 'Users' Rights and Contacts' section.
Google API Services User Data Policy
The use and transfer of information received by Inflead through Google APIs will comply with Google's User Data Privacy Policy for API Services, including limited usage requirements.
5. Data retention
The data is processed for the time necessary to carry out the activities indicated in the previous paragraph 3 and will be deleted when the purposes for which they were collected and processed no longer exist. The specific deletion terms are provided in the table mentioned in the same paragraph 3.
6. User's Rights and Contacts
The User can exercise, in cases expressly provided by the law and where applicable, the rights provided by the Regulation. In particular, the User has the right to:
- obtain confirmation that their personal data is being processed and, if so, request access to the information regarding such processing (e.g., purposes, categories of data processed, recipients or categories of recipients of the data, retention period, etc.);
- request the rectification of inaccurate or incomplete data;
- request the erasure of data (e.g., if personal data is no longer necessary for the purposes for which it was collected, in case of withdrawal of consent on which the processing is based, etc.);
- request the restriction of processing (e.g., in case the User contests the accuracy of the data, if the processing is unlawful and the User opposes the erasure of personal data, if the data is necessary for the exercise or defense of legal claims by the User, even if the data controller no longer needs it, or during the verification of legitimate grounds in case of exercising the right to object);
- receive personal data concerning the User in a common and machine-readable format (e.g., PDF) and transmit it to another data controller or obtain direct transmission from one data controller to another, where technically feasible (right to data portability);
- withdraw consent in any time, without affecting the lawfulness of the processing based on the consent given before the withdrawal.
Additionally, the User has the right to object, in whole or in part, for legitimate reasons, to the processing of personal data concerning them, based on the legitimate interest of the Data Controller.
The aforementioned rights can be exercised directly by sending a communication to the following email address: dpo@inflead.com.
Finally, if the data subject believes that the processing of the provided data violates the legislation on the protection of personal data, they have the right to lodge a complaint with the Data Protection Authority (www.garanteprivacy.it).
*We receive publicly available data from Social Network platforms or third-party providers through API connections, which we then store and process in our Platform as established in this Privacy Policy. This allows all our customers who use the features of our service to identify and analyze influencers and content creators who may be of interest for their future campaigns. Customers can also view past publication activity, its engagement, and past or current campaigns.
** Please note that our customers may also enter certain personal data into our systems (e.g. in relation to specific influencers and content creators they work with, or because influencers or creators have directly consented to giving them greater access to Authenticated Data - see the next paragraph***).
*** Authentication of data by social network platforms: through the Account Connections page in the Inflead profile creation flow, you can choose to join and allow Inflead to connect to one or more of your social network accounts so that Inflead can access additional data from applicable social network platforms (e.g., channel audience and additional metrics such as reach, impressions, views, and other referred to as 'Authenticated Data'). You may also be directly invited by a particular brand or client to provide them with access to Authenticated Data, in which case: (i) such authorization only pertains to their use of the data; and (ii) the data will only be visible in the client section of the Inflead Platform, and Inflead will not share such data with any other client. You can revoke access to your Authenticated Data through the social network settings panels and contact us for any support (see section 6). You can also revoke accessibility of your Authenticated Data with Inflead's clients directly in the 'Connections' section of the Platform.
Last updated: 23/10/2023