Privacy policy
Draft text. A lawyer will review it and the missing company details will be added before launch.
This page explains what personal data we process when you visit the SecretlyBlue website or send us an application, what we use it for, how long we keep it and what your rights are.
Who processes your data
The controller is Secretly Blue Ltd, a company registered in England and Wales under company number [to be added], with its registered office at Suite 4.02, 18 Kestrel Yard, London EC2A 3PQ, United Kingdom.
We process data under the UK GDPR and the Data Protection Act 2018 and, for people in the European Union, also under the EU GDPR. The article references below apply to both.
Send questions about your data and requests to exercise your rights to [to be added].
What we collect
From the application:
- whether you are applying as a creator or as an agency
- your name or nickname
- your email address or Telegram username
- a link to your profile or your agency’s website
- your monthly income range or the number of accounts
- the language and address of the page you applied from
From our further contact: what you write to us by email or on Telegram and notes from the intro call.
Technical data: your IP address when you submit the form, so we can limit misuse, and the usual web server logs (IP address, time, page visited, browser type) kept by our hosting provider.
We don’t need photos, ID documents or account logins in the application, so please don’t send them.
What we use it for
To reply to your application, assess whether we can work together, arrange an intro call and confirm that your application arrived. The legal basis is taking steps at your request before entering into a contract, Article 6(1)(b).
To protect the form from spam and misuse and keep the website secure. The legal basis is our legitimate interest, Article 6(1)(f).
If we start working together, we process your data to perform the contract. The details will be in the contract.
We don’t use your data for marketing or for automated decisions or profiling, and we don’t sell it.
How long we keep it
- Applications and the messages about them: up to 12 months from submission if we don’t start working together. Then we delete them from email and Telegram.
- If we start working together: for the term of the contract and then as long as the law requires (for example accounting and tax rules) or until the period for legal claims runs out.
- The IP address used to protect the form is held only in the server’s memory. We don’t store it and don’t use it for longer than 10 minutes.
- Web server logs are deleted automatically by our hosting provider according to its settings.
Who we share it with
Only the people on our team who handle applications can see them. Beyond that, your data is processed by the services our website and communication run on:
- Hostcreators (Slovakia): website hosting and the mailbox applications arrive in
- Telegram: if you message us on Telegram or if an application also reaches us there
We pass data to authorities only when the law requires it. We don’t share it with anyone else.
Transfers outside the European Union
We are based in the United Kingdom, so we work with application data from there. The European Commission has decided that the UK provides an adequate level of protection, so your data is protected there to a standard comparable with the EU.
Telegram may process data in other countries under its own privacy policy.
Your rights
You have the right to:
- know what data we hold about you and get a copy
- have inaccurate data corrected
- ask for your data to be deleted or its processing restricted
- receive it in a machine-readable format and move it elsewhere
- object to processing based on legitimate interest
Just write to [to be added]. We’ll handle your request free of charge within one month. We may ask you to confirm that the request comes from you, so we don’t hand your data to someone else.
You can complain to a data protection authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in Slovakia, the Office for Personal Data Protection (dataprotection.gov.sk); in other EU countries, the authority where you live.
Security
The form is sent over an encrypted connection (HTTPS) and applications reach our mailbox encrypted too. Only the people who handle them have access.
Cookies
This website uses no analytics or advertising cookies and loads no third-party content. Fonts and images are served from our own server.
Age
The website and our services are only for people over 18. If we find that someone younger sent us an application, we delete it.
Changes to this policy
When we change this policy, we’ll publish the new version on this page and update the date it applies from.