Privacy Policy

1. WHO WE ARE

Illyria Talent Agency is operated by Ibrahimi Mario Persoana Fizica Autorizata, trading as Illyria Talent Agency.

Business name: Illyria Talent Agency
Legal entity: Ibrahimi Mario Persoana Fizica Autorizata
Registered address: Strada Constantin Marin, Nr. 2, Camera Nr. 1, Bl. Z1, Scara 1, Etaj 4, Ap. 20, Sectorul 5, Bucuresti, Romania
Contact email: [email protected]
Website: https://illyria.agency

For the purposes of Regulation (EU) 2016/679 ("GDPR"), Illyria Talent Agency acts as the Data Controller for the personal data described in this Privacy Policy.

Illyria Talent Agency has not appointed a Data Protection Officer as it is not currently required to do so under GDPR. Privacy questions, data protection requests, and consent withdrawal requests can be sent to [email protected].

The canonical location of this Privacy Policy is: https://illyria.agency/privacy

2. PURPOSE OF THIS PRIVACY POLICY

This Privacy Policy explains how Illyria Talent Agency collects, uses, stores, shares, protects, and deletes personal data. It applies to:

• visitors to illyria.agency
• creator applicants
• creators represented by Illyria Talent Agency
• brand contacts and prospective brand partners
• signed brand partners
• people who complete Illyria Talent Agency forms
• people who sign documents through DocuSeal
• people who communicate with us by email, social media, or other business channels

This Privacy Policy should be read together with any applicable agreement, campaign brief, consent form, or signed document issued by Illyria Talent Agency, including the Creator Representation Agreement, Brand Partnership Agreement, Campaign Brief, and Creator Marketing Consent Form.

3. OUR WEBSITE, SYSTEMS, AND INFRASTRUCTURE

Illyria Talent Agency uses the following systems to operate its business:

• Website: illyria.agency, hosted on Cloudflare Pages
• Website delivery: Cloudflare CDN, edge network, caching, security, and performance infrastructure
• Automation infrastructure: Hetzner CAX11 VPS located in Nuremberg, Germany
• Workflow automation: n8n, self-hosted on the Hetzner VPS
• Electronic signatures: DocuSeal, self-hosted at sign.illyria.agency on the Hetzner VPS
• Forms: Tally.so for creator intake and brand intake forms
• Email: Google Workspace, including [email protected]
• Legacy or operational email: [email protected]
• Records and pipeline management: Google Sheets and Google Workspace documents

4. PERSONAL DATA WE COLLECT

The personal data we collect depends on your relationship with Illyria Talent Agency.

4.1 Website visitors

When you visit illyria.agency, technical data may be processed to deliver and protect the website. This may include IP address, browser type, device information, operating system, approximate location, pages visited, request timestamps, security logs, bot detection data, and caching and performance data.

Our website is hosted on Cloudflare Pages and delivered through Cloudflare's CDN. Cloudflare may process technical data to deliver the website, protect against malicious traffic, prevent abuse, and maintain security. Illyria Talent Agency does not intentionally use non-essential marketing cookies, advertising pixels, or behavioural tracking technologies.

4.2 Creator applicants

When a creator applies through our Tally creator intake form, we may collect: full name, email address, country or location, social media platform handles and profile links, follower count, engagement rate, average views, content niche, audience country and language, audience demographics where provided, collaboration preferences, past brand work, and other information submitted through the form.

Purpose: To review creator applications, assess potential representation, evaluate brand fit, and decide whether to proceed with onboarding.
Lawful basis: Steps before entering into a contract — Article 6(1)(b) GDPR.

4.3 Brand contacts and brand applicants

When a brand or business representative contacts us or completes a brand intake form, we may collect: company name, contact name, job title, business email address, campaign interests, target markets, campaign goals, preferred creator profile, campaign budget information, and other information submitted through the form.

Purpose: To review brand enquiries, assess campaign fit, communicate with brand contacts, prepare proposals, and decide whether to proceed with a campaign.
Lawful basis: Steps before entering into a contract — Article 6(1)(b) GDPR.

4.4 Signed creators

When a creator signs a Creator Representation Agreement or works with Illyria Talent Agency, we may collect and process: full legal name, email address, residential address, social media handles and platform links, creator profile information, audience analytics, follower counts, engagement data, reach and impressions, media kit information, portfolio materials, campaign communication and approval records, signed agreement data, DocuSeal signature data and timestamps, invoicing details, payment routing details, and identity or KYC information where required.

Purpose: To represent creators, pitch creators to brands, manage campaign opportunities, process payments, comply with legal obligations, and enforce contractual rights.
Lawful basis: Article 6(1)(b) GDPR — performance of contract. Article 6(1)(c) GDPR — legal obligation where accounting, tax, or compliance duties apply. Article 6(1)(f) GDPR — legitimate interests for fraud prevention, record-keeping, and legal protection.

4.5 Brand partners

When a brand enters into a Brand Partnership Agreement or works with Illyria Talent Agency, we may collect and process: company name, company registration details, registered address, representative name, job title, business email address, campaign data, payment and invoicing information, signature data, approval records, campaign communications, and dispute or claim correspondence where applicable.

Purpose: To prepare and manage brand campaigns, execute agreements, coordinate creator deliverables, process invoices, enforce payment terms, and maintain records.
Lawful basis: Article 6(1)(b) GDPR — performance of contract. Article 6(1)(f) GDPR — legitimate interests. Article 6(1)(c) GDPR — legal obligation where applicable.

4.6 Campaign and contract data

We may process information contained in Creator Representation Agreements, Brand Partnership Agreements, Campaign Briefs, Creator Marketing Consent Forms, DocuSeal signature records, email confirmations, campaign approvals, usage rights records, payment records, and campaign communication history, including deliverables, fees, deadlines, usage scope, territory, exclusivity, approval process, kill fees, and payment terms.

4.7 Optional creator marketing consent data

If a creator separately chooses to sign the Creator Marketing Consent Form, we may process: full name or creator name, social media handle, profile image, follower count, engagement information, professional niche, selected content samples, and high-level audience information — only for the specific public-facing marketing option or options selected.

Lawful basis: Consent — Article 6(1)(a) GDPR. Marketing consent is optional, separate, and independent from the Creator Representation Agreement.

4.8 Public professional information

We may review limited publicly available professional information such as public creator profiles, public social media accounts, public brand websites, and publicly visible business contact information for creator scouting, brand outreach, campaign pitching, or business development.

Lawful basis: Legitimate interests — Article 6(1)(f) GDPR.

5. SPECIAL CATEGORY DATA

Illyria Talent Agency does not intentionally request or collect special category data, such as health data, religious beliefs, political opinions, trade union membership, genetic data, biometric data, or data concerning sexual orientation. Creators, applicants, brands, and website visitors should not submit unnecessary sensitive personal data through forms, emails, or communications.

6. HOW WE COLLECT PERSONAL DATA

We collect personal data when you visit illyria.agency, complete a creator or brand intake form, sign documents through DocuSeal, email us, communicate with us through social media or business platforms, provide creator analytics or portfolio materials, provide brand campaign details, enter into a contract or campaign brief, provide invoicing or payment information, or give or withdraw marketing consent.

We may also collect limited public professional information from publicly available sources such as social media profiles, creator platforms, brand websites, media kits, or public business pages.

7. WHY WE PROCESS PERSONAL DATA

We process personal data to review applications and enquiries, manage creator representation, pitch creators to brands, manage brand campaigns, process optional public marketing consent, process payments and invoices, maintain accounting records, protect our legal and commercial interests, and operate and secure our website and systems.

Where we rely on legitimate interests, those interests may include: operating a creator representation business, maintaining accurate business records, managing creator and brand pipelines, verifying creator profile information, pitching creators to suitable brand partners, preventing fraud and circumvention, protecting website and system security, managing disputes, keeping evidence of approvals and signatures, enforcing contracts, and protecting Illyria Talent Agency's legal and commercial rights.

8. OPTIONAL CREATOR MARKETING CONSENT

Creator marketing consent is collected separately through the Creator Marketing Consent Form. It is independent from the Creator Representation Agreement. Selecting, declining, or withdrawing consent options does not affect the validity of the Creator Representation Agreement or the representation services provided.

Consent options may include: Agency website talent roster, Agency social media, and press, media, or business development publicity. Each option is independent.

Creators may withdraw consent at any time by emailing [email protected]. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. After withdrawal, Illyria Talent Agency will stop the relevant consent-based use within fourteen (14) calendar days where reasonably possible.

Where content has already been published, indexed, cached, archived, printed, screenshotted, shared, or redistributed by third parties outside Illyria Talent Agency's control, complete removal may not be technically or practically possible. Illyria Talent Agency will stop its own further consent-based use and remove content from its own controlled channels where reasonably possible.

9. WHO WE SHARE PERSONAL DATA WITH

We may share personal data with the following where necessary and lawful:

• Brand partners and prospective brand partners — creator profile, portfolio, audience, and campaign-relevant data for pitching, negotiating, and administering campaign opportunities
• Creators and creator representatives — campaign information, briefs, approval information, and payment-related information where necessary to perform contracts and administer campaigns
• Cloudflare Inc. — website hosting, CDN, edge network, caching, security, and performance services
• Google LLC — Google Workspace, Gmail, Google Sheets, document storage, and business email
• Tally.so — creator intake forms and brand intake forms (Belgium)
• Hetzner Online GmbH — VPS hosting infrastructure in Nuremberg, Germany
• n8n — self-hosted on the Hetzner VPS for workflow automation
• DocuSeal — self-hosted at sign.illyria.agency on the Hetzner VPS for electronic signatures and contract workflows
• Banks, payment providers, accountants, tax advisers, legal advisers, and compliance providers — where necessary for business operations
• Public authorities, courts, and regulators — where required by law, court order, or regulatory obligation

10. INTERNATIONAL DATA TRANSFERS

Illyria Talent Agency is based in Romania. Key infrastructure providers including Tally.so (Belgium), Hetzner Online GmbH (Germany), and our self-hosted n8n and DocuSeal instances are based within the European Union.

Some service providers such as Cloudflare Inc. and Google LLC are based in the United States or may process data through international infrastructure. Where personal data is transferred outside the European Economic Area, we rely on appropriate safeguards required by GDPR, including the EU-US Data Privacy Framework adequacy decision where the recipient is certified under that framework, Standard Contractual Clauses, data processing agreements, and appropriate technical and organizational security measures.

11. HOW LONG WE KEEP PERSONAL DATA

• Website visitor logs: retained according to Cloudflare's standard retention practices and our security needs
• Creator applicant data where rejected: deleted within thirty (30) days of the rejection notice, unless required for disputes or compliance
• Creator applicant data where no final decision has been made: retained only as long as reasonably necessary
• Creator agreement and representation data: duration of agreement + up to five (5) years after termination
• Brand contract data: duration of agreement + up to five (5) years after completion or expiry
• Campaign Briefs and campaign records: duration of relevant agreement + up to five (5) years after campaign completion
• Payment, invoicing, tax, and accounting records: up to ten (10) years where required by Romanian law
• Marketing consent data: for as long as consent remains active, plus minimum records necessary to document consent history and suppression status
• Email communications: as long as reasonably necessary for the business purpose, legal compliance, or dispute management

12. DATA SECURITY

We use reasonable technical and organizational measures to protect personal data, including access controls, password protection, two-factor authentication where available, secure business email and document storage, data minimization in forms and spreadsheets, VPS security measures, Cloudflare security and network protection services, and self-hosted workflow and signature tools on EU-based hosting infrastructure.

No system is completely secure. However, we take reasonable steps to reduce the risk of unauthorized access, loss, misuse, or disclosure. Where required by law, we will notify affected individuals and/or competent authorities of personal data breaches.

13. YOUR GDPR RIGHTS

Subject to applicable law, you have the right to:

• request access to your personal data (Article 15 GDPR)
• request rectification of inaccurate or incomplete personal data (Article 16 GDPR)
• request erasure of your personal data (Article 17 GDPR)
• request restriction of processing (Article 18 GDPR)
• request data portability (Article 20 GDPR)
• object to processing based on legitimate interests (Article 21 GDPR)
• withdraw consent at any time where processing is based on consent
• lodge a complaint with a supervisory authority

To exercise your rights, contact us at [email protected]. We normally respond within one (1) month as required by GDPR.

Where processing is based on legitimate interests, you may object to that processing. If you object, we will stop the processing unless we have compelling legitimate grounds to continue, or the processing is necessary for the establishment, exercise, or defence of legal claims.

Deletion may be limited where retention is necessary for legal obligations, accounting and tax compliance, contract performance, fraud prevention, dispute management, enforcement of contractual rights, or legal claims.

14. WHETHER YOU MUST PROVIDE PERSONAL DATA

Some personal data is necessary for us to review applications, enter into contracts, administer campaigns, process payments, comply with legal obligations, and protect legal rights.

If you do not provide required personal data, we may be unable to:

• review your creator or brand application
• enter into a contract with you
• represent you as a creator
• manage a brand campaign
• prepare or sign agreements
• process payments
• comply with accounting, tax, or legal obligations

Optional marketing consent is not required. Refusing or withdrawing marketing consent does not affect creator representation services.

15. AUTOMATED DECISION-MAKING

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.

16. COOKIES AND WEBSITE TECHNOLOGIES

Our website is hosted on Cloudflare Pages and may use Cloudflare's technical cookies or similar technologies for security, routing, caching, performance, and abuse prevention. We do not intentionally use non-essential marketing cookies, analytics cookies, advertising pixels, or behavioral tracking technologies. If we introduce any such technologies in the future, we will update this Privacy Policy and implement a consent mechanism where required.

17. CHILDREN

Illyria Talent Agency does not knowingly collect personal data from children. Creators entering into agreements with Illyria Talent Agency must be at least eighteen (18) years old.

18. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our business, legal obligations, service providers, or data processing practices. The latest version will always be available at https://illyria.agency/privacy.

19. COMPLAINTS

You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing:

You may also lodge a complaint with the supervisory authority in your country of residence, workplace, or the place of the alleged infringement.

20. CONTACT

For privacy questions, data protection requests, or consent withdrawal, contact:

Illyria Talent Agency
Ibrahimi Mario Persoana Fizica Autorizata
Strada Constantin Marin, Nr. 2, Camera Nr. 1, Bl. Z1, Scara 1, Etaj 4, Ap. 20, Sectorul 5, Bucuresti, Romania
[email protected]
https://illyria.agency/privacy