Privacy policy

2. What data we process

We process personal data only to the extent necessary to provide our service and to process your order. In particular, this includes:

• Order and contract data: the email address you provide, the selected services, order quantity, order and transaction numbers, and the order status.

• Target URLs and order details: the public profile or post links you enter during the ordering process (e.g. to Instagram, TikTok, YouTube) and any further information required for delivery. No passwords are required for delivery; please never share any login credentials with us.

• Payment data: the data required to process the payment. This is processed directly by our payment service provider Stripe; full card details are not stored on our systems.

• Communication data: the content and metadata of your support requests and the associated email communication.

• Usage and server log data: technical access data such as IP address, date and time of access, requested resource, volume of data transferred, referrer, and browser and operating system information.

3. Purposes and legal bases of processing

We process your data on the basis of the following legal bases under the GDPR:

• To perform the contract and to carry out pre-contractual measures – in particular to process, deliver and confirm your order and to issue invoices and provide support (Art. 6(1)(b) GDPR).

• To comply with legal obligations, such as retention obligations under commercial and tax law (Art. 6(1)(c) GDPR).

• To safeguard our legitimate interests, in particular to ensure the secure and stable operation of the website, to prevent abuse and fraud, and to assert legal claims (Art. 6(1)(f) GDPR).

• On the basis of your consent, where you have granted it, for example for non-essential cookies (Art. 6(1)(a) GDPR). You may withdraw any consent given at any time with effect for the future.

4. Hosting and provision of the website (AWS)

Our website is operated on Amazon Web Services (AWS). When the pages are accessed, technically necessary data is processed in server log files to ensure delivery of the website, its stability and security, and to defend against attacks. The legal basis is our legitimate interest in a secure and functional service (Art. 6(1)(f) GDPR). A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

5. Payment processing (Stripe)

Payments are processed via the payment service provider Stripe (Stripe Payments Europe, Ltd. and affiliated companies). To process the payment and issue invoices, the required data – in particular name, email address and payment and billing details – is transmitted to Stripe and processed there by Stripe under its own responsibility. The legal basis is performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in secure, fraud-free payment processing (Art. 6(1)(f) GDPR). For details, please refer to Stripe's privacy policy.

6. Order fulfilment via SMM dispatch provider

To deliver the ordered social media marketing services, we use a specialised provider (wholesale/SMM provider). Only the information required to fulfil your order is transmitted to this provider, in particular the public target URLs you provide as well as the service and quantity ordered. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). Since the URLs entered relate to public profiles or posts, the sharing of login credentials is neither required nor intended.

7. Email delivery (Resend / Amazon SES)

To confirm orders, send invoices and status notifications, and handle support communication, we send emails via an email delivery provider (Resend or Amazon SES, depending on configuration). In doing so, we process your email address and the associated transaction and message data. The legal basis is performance of the contract and our legitimate interest in reliable communication (Art. 6(1)(b) and (f) GDPR). A data processing agreement pursuant to Art. 28 GDPR is in place with the provider.

8. Protection against abuse (Cloudflare Turnstile)

To protect our forms and ordering processes against automated abuse (bots, spam), we use Cloudflare Turnstile, a service provided by Cloudflare, Inc. In this process, technical information (including IP address and device/browser data) is transmitted to Cloudflare and analysed in order to distinguish human from automated access. The legal basis is our legitimate interest in the security and abuse-free operation of our service (Art. 6(1)(f) GDPR).

9. IP reputation check for abuse prevention (IPQualityScore)

To protect our paid analysis and search functions (retrieval of public profile and post data) against automated abuse, we check the reputation of your IP address via the IPQualityScore service (IPQualityScore LLC) when you use these functions. Your IP address is transmitted to IPQualityScore and evaluated to determine whether the access originates from anonymising networks (e.g. proxies, VPNs, the TOR network) or from known bot or abuse infrastructure. We cache the result of this check per IP address in order to avoid repeated lookups and thus unnecessary costs. The legal basis is our legitimate interest in the security, abuse and fraud prevention, and the economic viability of our service (Art. 6(1)(f) GDPR). IPQualityScore may also process data in third countries (in particular the USA); the statements under 'Transfers to third countries' apply.

10. Web analytics and session recording (Mouseflow)

With your consent, we use Mouseflow, a web analytics service provided by Mouseflow ApS (Denmark). Mouseflow creates anonymised recordings of individual sessions (including mouse and scroll movements, clicks and page views) and aggregated heatmaps so that we can understand how our website is used and improve its usability. Entries in form fields are suppressed and not recorded. The legal basis is solely your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future via the cookie banner settings. Mouseflow may also process data in third countries; the statements under 'Transfers to third countries' apply.

11. Cookies and consent

By default, we only use technically necessary (essential) cookies or comparable technologies that are required for the operation of the website, the shopping cart and the ordering process (Sec. 25(2) TDDDG). Non-essential cookies or analytics/marketing technologies are only set after your explicit consent (Sec. 25(1) TDDDG, Art. 6(1)(a) GDPR). You may withdraw your consent at any time with effect for the future via the cookie banner settings or your browser.

12. Recipients and processors

Your data is only transmitted to third parties where this is necessary to perform the contract, where we are legally obliged to do so, or where you have consented. Processors or recipients include in particular: the hosting provider (AWS), the payment service provider (Stripe), the email delivery provider (Resend or Amazon SES), the bot-protection service (Cloudflare Turnstile), the IP reputation service (IPQualityScore), the web analytics service (Mouseflow), and the SMM dispatch provider for fulfilling the order. We conclude agreements with processors pursuant to Art. 28 GDPR.

13. Transfers to third countries

The controller (B A Media Group FZE LLC) is based in the United Arab Emirates, a country outside the EU/EEA (third country). In addition, some of the service providers used may process data in third countries, in particular the USA. Any such transfer only takes place in compliance with the requirements of Art. 44 et seq. GDPR, in particular on the basis of an adequacy decision by the EU Commission, appropriate safeguards (e.g. EU standard contractual clauses), or your explicit consent. We will inform you of the safeguards in place upon request.

14. Retention period

We store personal data only for as long as necessary for the purposes stated. Order and contract data is retained for the duration of the business relationship and, beyond that, within the scope of statutory retention obligations (in particular under commercial and tax law, generally up to 10 years). Target URLs and order details are deleted as soon as they are no longer required for delivery, for any top-ups (refill), or for the establishment, exercise or defence of legal claims. Server log data is stored only for a short period and then deleted or anonymised.

15. Your rights as a data subject

Under the GDPR you have the following rights:

• Right of access to the data stored about you (Art. 15 GDPR);

• Right to rectification of inaccurate data (Art. 16 GDPR);

• Right to erasure (Art. 17 GDPR) and to restriction of processing (Art. 18 GDPR);

• Right to data portability (Art. 20 GDPR);

• Right to object to processing based on a legitimate interest (Art. 21 GDPR);

• Right to withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR).

To exercise your rights, an informal message to the contact details above is sufficient.

16. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data infringes the GDPR (Art. 77 GDPR). You may contact the supervisory authority of your habitual residence, your place of work, or the place of the alleged infringement.

17. Currency and changes

This privacy policy is currently valid. As our service evolves or due to changes in legal or regulatory requirements, it may become necessary to amend this privacy policy. The version published on this page applies in each case.