privacy
policy

Privacy Policy

Social Heaven Studios UG (haftungsbeschränkt)

1. Scope

This privacy policy explains how Social Heaven Studios UG (haftungsbeschränkt) processes personal data. It applies to the use of our website, to communication with us and to our business relationships with content creators, clients, business partners and applicants.

2. Controller and contact

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Social Heaven Studios UG (haftungsbeschränkt)
Bonner Straße 12
51379 Leverkusen
Germany

Register court: Amtsgericht Köln, HRB 129427
Represented by the Managing Director Li-Stella Ender

For all questions regarding data protection you can reach us at: datenschutz@social-heaven.com

We have not appointed a data protection officer. We are currently not required to do so under section 38 BDSG (German Federal Data Protection Act), because as a rule fewer than 20 people are permanently engaged in the automated processing of personal data. Responsibility for data protection lies with the management. Please address enquiries to the address given above.

3. Principles and legal bases

We process personal data only where this is necessary for the purposes stated and where a legal basis exists. The following may apply:

• Art. 6(1)(a) GDPR: consent, in particular for the use of images.
• Art. 6(1)(b) GDPR: performance of a contract or pre-contractual measures, for example in creator and client contracts.
• Art. 6(1)(c) GDPR: compliance with legal obligations, for example retention under commercial and tax law.
• Art. 6(1)(f) GDPR: legitimate interests, for example the secure provision of the website, business development and communication.

For applications, section 26 BDSG applies in addition. For the publication of images, sections 22 et seq. KunstUrhG (German Act on the Protection of Copyright in Works of Art and Photography) apply alongside the GDPR.

4. Processing when you use our website

4.1 Hosting

Our website is operated by Webflow, Inc., 398 11th Street, San Francisco, CA 94103, USA. When the site is accessed, Webflow processes technical data transmitted by your browser on our behalf. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in reliable and secure provision.

4.2 Server log files

Each time the site is accessed, the following data is logged automatically: the page accessed, date and time, volume of data transferred, notification of successful retrieval, browser type and version, operating system, referrer URL and a shortened IP address. This processing serves operational security and the prevention of attacks. The legal basis is Art. 6(1)(f) GDPR. The logs are deleted after 30 days at the latest.

4.3 Cookies

We use only technically necessary cookies that are required for the operation and security of the website. The legal basis is section 25(2) TDDDG (German Telecommunications Digital Services Data Protection Act) in conjunction with Art. 6(1)(f) GDPR. Your usage behaviour is not analysed. We do not use cookies for analytics or advertising purposes and we do not integrate any tracking services.

4.4 Appointment booking

To arrange appointments (in particular initial consultations) we use the booking tool VibeBook provided by trafficdesign GmbH, Hohenstaufenring 29-37, 50674 Köln, Germany, contactable at datenschutz@trafficdesign.de. VibeBook is part of our internal VibeCRM platform and is operated on servers within the European Union. We process your name, email address, preferred appointment and any voluntary information about your enquiry (for example a telephone number or free text). To carry out the appointment we send confirmation, reminder and, where applicable, cancellation or rescheduling messages. The legal basis is Art. 6(1)(b) GDPR for pre-contractual measures, otherwise Art. 6(1)(f) GDPR (legitimate interest in efficient appointment management).

5. Contacting us and prospect management

If you contact us by email, by telephone or via a booking tool, we process the information you provide in order to handle your enquiry. To manage enquiries and business development we use the CRM system Pipedrive provided by Pipedrive OÜ, Mustamäe tee 3a, 10615 Tallinn, Estonia. There we store your name, company, position, contact details and the history of our communication.

The legal basis is Art. 6(1)(b) GDPR where the enquiry is directed at a contract, otherwise Art. 6(1)(f) GDPR, our legitimate interest in handling enquiries and maintaining business contacts. We delete the data once it is no longer necessary for the purpose and no retention obligation prevents deletion.

6. Content creators and contractors

We produce user generated content for our clients and work with self-employed content creators to do so. Processing their data is central to our activity.

6.1 Categories of data

• Master data: name, address, date of birth where required
• Contact data: email address, telephone number
• Profile data: social media profiles and handles, profile pictures, portfolio and reference material, reach and audience figures
• Contract data: quotes, contracts, briefings, approvals, consents and model releases, usage rights granted
• Billing data: fees, invoices, bank details, tax number or VAT identification number
• Content data: image, audio and video recordings of the creators, including their voice and their likeness

6.2 Purposes

• Selecting and approaching suitable creators
• Initiating, concluding and performing the contract
• Producing, reviewing and approving the content
• Acquiring and documenting the usage rights in the content
• Handing over the finished content and the usage rights granted to our clients and their agencies
• Remuneration, invoicing and accounting
• Building and maintaining a creator pool for future enquiries

6.3 Legal bases

• Art. 6(1)(b) GDPR for initiating, concluding and performing the contract, including remuneration
• Art. 6(1)(a) GDPR and section 22 KunstUrhG for recording, using and passing on images and voice recordings to the agreed extent
• Art. 6(1)(c) GDPR for compliance with commercial and tax law obligations
• Art. 6(1)(f) GDPR for approaching potential creators and maintaining the creator pool

6.4 Origin of the data

We collect the data directly from the creators. In addition, for outreach we use publicly accessible profiles on social media platforms and, where agreed, information from creator agencies and comparable intermediaries.

6.5 Recipients

We hand over the content produced and the associated usage rights to the commissioning client and, where applicable, to their agencies. The content is then distributed by them on advertising platforms. We inform the creators about the extent of this use before production; it forms part of the consent and of the contract. To edit, review and approve the content we use the service providers listed in section 9. They process the material exclusively on our behalf. We pass billing data on to our tax advisors and our bank.

6.6 Retention period

We retain contract documents and records of the usage rights granted for the duration of those rights and beyond that until the statutory limitation periods expire. We retain invoices and accounting records for ten years in accordance with section 257 HGB (German Commercial Code) and section 147 AO (German Fiscal Code). We delete profile and contact data in the creator pool upon objection or when it is no longer needed.

6.7 Withdrawal

Consent that has been given, in particular for the use of images, can be withdrawn at any time with effect for the future. Content that has already been handed over to clients and licensed contractually can only be recalled after a withdrawal within the scope of our contractual options. We point out this limitation before production.

7. Clients and business partners

To initiate and carry out our assignments we process data of the contact persons on the client, agency and service provider side: name, position, business contact details, communication history as well as contract and billing data. The legal basis is Art. 6(1)(b) GDPR, in relation to contact persons of legal entities Art. 6(1)(f) GDPR, and Art. 6(1)(c) GDPR for retention. Retention is governed by the statutory periods.

8. Applications

Applications reach us by email and via the recruiting platform join.com provided by JOIN Solutions GmbH, Schönhauser Allee 36, 10435 Berlin, Germany. We process the information and documents you submit exclusively for the purpose of conducting the application procedure. The legal basis is section 26(1) BDSG in conjunction with Art. 6(1)(b) GDPR. Once the procedure has been completed we delete the documents after six months at the latest, unless you have consented to longer storage for future positions.

9. Service providers used

We use carefully selected service providers with whom we have concluded data processing agreements under Art. 28 GDPR where required:

In addition, we pass data on to our tax advisors, our bank and to public authorities where we are legally obliged to do so.

10. Transfers to third countries

Some of the service providers named have their registered office outside the European Union or process data there, in particular in the United States, in Australia and in Singapore. A transfer only takes place where an adequacy decision of the European Commission is in place, in particular for providers certified under the EU-US Data Privacy Framework, or where appropriate safeguards under Art. 46 GDPR exist, in particular the European Commission's standard contractual clauses supplemented by additional protective measures. We will inform you about the specific safeguards on request at the address given in section 2.

11. Retention periods at a glance

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR).

Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of your data based on Art. 6(1)(f) GDPR (Art. 21 GDPR).

Withdrawal of consent: You can withdraw consent you have given at any time with effect for the future. The lawfulness of processing carried out up to the withdrawal remains unaffected.

Right to lodge a complaint: You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2 bis 4, 40213 Düsseldorf, Germany.

A message to the address given in section 2 is sufficient to exercise your rights.

13. Data security

We take technical and organisational measures in accordance with Art. 32 GDPR to protect personal data against loss, alteration and unauthorised access. These include encrypted transmission, access restrictions based on the principle of least privilege, the granting and withdrawal of access by the management, an obligation of confidentiality for our employees and regular data protection awareness training.

14. Changes to this policy

We adapt this privacy policy when our processing or the legal requirements change. The version published on this page at any given time applies.

This is a translation of the German original. In case of discrepancies, the German version prevails.

Last updated: 20 July 2026