Translation view of the German original. The document identifier and confirmation record continue to refer to the original version.
This privacy policy applies to the mobile contentmarkt app. contentmarkt is a platform for social media creators where you can find brand campaigns, participate in campaigns, submit published posts, connect your social media accounts for verification, and track the review, remuneration and payout of your campaigns.
1. Data controller
The controller responsible for processing personal data in the contentmarkt app is Axel Springer Deutschland GmbH, Axel-Springer-Straße 65, 10888 Berlin, Germany, telephone +49 30 2591 0.
2. Data protection officer
You can contact the data protection officer at Axel Springer Deutschland GmbH, Datenschutz, Axel-Springer-Straße 65, 10888 Berlin, with the subject contentmarkt, or by email at datenschutz@axelspringer.de.
3. Relationship with the App Store
The Apple App Store or another app store processes personal data under its own responsibility in connection with downloading, installing and updating the app. This may include the store account, device and installation information, download and update data, store usage data, and diagnostic and security data.
We do not have full control over this processing. The privacy notices of the respective app store provider also apply.
4. Technical app and device data
When you use the contentmarkt app, we process technically necessary data, particularly your IP address, app version, operating system and version, device type, language and time zone, access times, functions accessed, response status, error and diagnostic data, and technical security logs.
We process this data to provide the app, identify technical errors, prevent attacks and ensure the security and stability of the service. The legal basis is Article 6(1)(f) GDPR.
Technical access and error logs are generally deleted or anonymised within 30 days at the latest.
5. Access to information on your device
The app may store or read technically necessary information on your device, particularly login and session tokens, account authentication information, social media login or authorisation information, app configuration, and security and permission information. These operations are necessary to provide the app functions you request.
At present, contentmarkt does not use an advertising ID or tracking across apps.
6. Registration and user account
You need a user account to use the contentmarkt app. We process, in particular, your first and last name, email address, AWS Cognito user identifier, email verification status, account status, registration and usage times, information about your business activity, and necessary company, tax and invoicing information.
Authentication is provided through AWS Cognito. contentmarkt does not store a local password hash. We process this data to provide your account, authenticate you, check the requirements for B2B use and perform the platform contract. The legal basis is Article 6(1)(b) GDPR.
7. Campaigns and participation
In the app, you can view available campaigns and participate in them. We process, in particular, your creator ID, selected campaigns, campaign terms and snapshots, participation and submission status, social media platform, handle, post URL, caption and post information, publication time, views and other campaign performance data, review status, remuneration that is available or still under review, and payout status.
The legal basis is Article 6(1)(b) GDPR.
7a. Products for a follow-up video
Brands may voluntarily offer products that creators can keep. Active campaign participants can request a package when an accepted video reaches the specified number of views after review or the brand manually approves eligibility. We process the eligibility reason, package status, and the times of eligibility approval, the request and shipping. Your normal campaign participation remains unchanged if you do not request products.
If you request products, we process your name, delivery address (street, building number, optional address line, postcode, city and country), size or preference information, and the time of your explicit consent. Your delivery address is stored separately from invoicing details; we use an existing invoicing address only if you select it. The responsible brand can see this information together with your social media handle in its account so that it can ship the products. The request email to the brand contains neither your delivery address nor your size. An optional shipping note from the brand is shown only in the account; notification emails do not contain that note.
The legal basis for storing and sharing delivery details is your consent under Article 6(1)(a) GDPR, which you give by selecting the separate checkbox when requesting products. You can withdraw it at any time in the product card with effect for the future: before shipping, you withdraw the request; after shipping, you delete your delivery details while the package remains in transit. contentmarkt then immediately clears your name and address, size or preference information, and the shipping note, and no longer displays them to the brand. The lawfulness of processing before withdrawal is unaffected. Copies already stored by the brand and processing by its shipping provider are governed by their own privacy policies; we cannot automatically delete those copies.
7b. Optional iPhone notifications
If you enable notifications in the contentmarkt app and grant the iPhone system permission, the app registers the Apple device token, an app installation identifier, and technical information about the app, project and delivery environment with the Expo Push Service. We store the resulting Expo push token together with its association with your contentmarkt account, the platform, a random identifier for this device registration, the revision of the device settings and, where applicable, the app version. The purpose is to deliver the notifications you request about the status of your applications, clips and billing. The necessary processing is based on Article 6(1)(b) GDPR.
The app provides one combined option to enable status notifications, notices about new campaigns, and reminders to create and submit clips. The app explains these purposes before activation. By making this optional selection, you consent to campaign notifications for this device. An earlier iPhone system permission or device registration alone is not treated as campaign consent. Without a deliberate activation of campaign notifications, these notices remain disabled; previously given explicit campaign consent remains valid. While campaign notifications are enabled, we store the campaign consent identifier and the start of the current device registration with campaign permission. After signing in again, this time identifies the current delivery permission, not a newly given consent. When you disable notifications, we remove this information from the device token. The legal basis for sending campaign notices is Article 6(1)(a) GDPR; the necessary proof of consent is based on Article 6(1)(c) GDPR together with Article 7(1) GDPR. You can use the app without notifications and without campaign notifications.
The app stores your explicitly confirmed notification selection for this account on this iPhone. Signing out ends delivery for this account; the local selection is retained. If you sign in to the same account again on this iPhone and iPhone notifications are still permitted, the app registers them again using the saved selection without asking for renewed consent. Disabling notifications in the app also withdraws the locally saved campaign permission. This selection is not transferred to a different account.
For delivery, we send the Expo push token, title and text, and technical campaign or clip identifiers to 650 Industries, Inc. (Expo). Expo forwards the notification to your iPhone through the Apple Push Notification service. Notifications contain general notices; euro amounts, rejection reasons and personal campaign or clip details are not sent as visible notification text. You can view the details after opening the app and signing in. General notices may appear on the lock screen. You can also control their display in your iPhone settings.
You can disable all contentmarkt notifications for this device at any time using the combined option in the app and thereby also withdraw your campaign consent. When all notifications are successfully disabled or you sign out, we remove the raw device token and its active device and marketing selection entry from our delivery register. To block delayed registration requests after deregistration, we separately store a cryptographic verification value of the withdrawn device registration (or, for older app versions, the push token), its account association and the withdrawal time until account deletion. This blocking record contains no raw device token, no raw registration identifier and no marketing consent; it cannot authorise sending and remains associated with your account. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to reliably enforce your decision to deregister. If you explicitly enable notifications again, a new registration identifier is created. When the account is deleted, we remove all device tokens associated with it, including previously deactivated tokens, and the blocking record. Tokens reported as invalid are deactivated and are no longer used for delivery. Withdrawing the iPhone system permission alone does not constitute an immediate request to delete data from our database.
Ending delivery or deleting data from our register does not recall notifications already passed to the delivery services and does not establish a verified, immediate deletion of a token at Expo or Apple. According to Expo, it processes notification content only until forwarding it to the respective delivery service. Expo stores the tokens needed for association and delivery separately; its public information does not specify a fixed individual deletion period. Please send related questions and deletion requests to us through the privacy contact in section 20. Processing may take place in the United States. For service-related processing, the applicable Expo terms provide for its role as processor and EU standard contractual clauses, Module 2. Sections 16 and 17 apply to further recipients and transfer safeguards; section 18 applies to necessary records.
8. Connecting Instagram and TikTok accounts
You can connect Instagram and TikTok accounts to contentmarkt using the respective platform's official login or API procedures. The data processed may include the platform user ID, username and handle, account type, public profile information, media IDs and metadata, links to videos or reels, captions, publication times, views, interactions such as likes, comments and shares, and the access information necessary for the connection.
For Instagram, we retain the access token exclusively in your own encrypted session; it is not permanently stored on contentmarkt servers. For TikTok, we additionally store access and refresh tokens encrypted on our servers for as long as the profile remains connected. The sole purpose is to retrieve view counts for your submitted videos directly from TikTok without requiring you to be signed in. We delete these tokens when you disconnect the profile or delete your account.
We use this data to verify account ownership, review campaigns, measure campaign performance, handle billing and prevent fraud. The legal basis is Article 6(1)(b) GDPR. Security, integrity and fraud checks are additionally based on Article 6(1)(f) GDPR.
We do not request passwords for your Instagram or TikTok accounts. You can disconnect the account at any time in the app and also revoke access in the respective platform's settings. YouTube may be an eligible publishing platform for individual campaigns. contentmarkt currently does not provide an OAuth connection for YouTube accounts.
9. Public creator profile
You can voluntarily enable a public creator profile. Your display name, selected platforms, social media handles and links to your public social media profiles may then become publicly visible. Internal account IDs, OAuth information, access tokens and refresh tokens are not published.
The legal basis for publication is your consent under Article 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future. Publicly published information may be collected and copied by search engines or third parties and redistributed outside contentmarkt.
10. Submission and review of posts
When you submit a published post for a campaign, we may process the following in particular: creator and campaign associations, platform and social media handle, post URL, caption, published content and metadata, video or media files or storage references where applicable, submission time, technical media information, transcripts, OCR text, frame references, hashtags and mentions, advertising and disclosure labels, format data, detected rule violations, review confidence, review status and reviewer notes.
We use free software on our own systems to transcribe audio and recognise text in individual video frames. Where a language model evaluates softer questions, such as whether a video's content fits the brief, we operate it through Amazon Web Services within the EU; only the results of the preceding steps are sent there.
We use this data to check compliance with campaign terms, prepare payouts and document disputes. The legal basis is Article 6(1)(b) GDPR. The clip and data derived from it are not used to train, test or improve AI systems.
11. Review of views and abuse prevention
The views relevant to a campaign are checked when calculating remuneration. The data processed may include the views and interactions reported by the platform, the association between platform, creator and media, proof of account ownership, the measurement binding recorded for each media item together with evidence and time, and review status and confidence.
The purpose is to determine which views qualify for remuneration under the respective campaign terms and to detect manipulated submissions. The legal basis is Article 6(1)(b) GDPR. Fraud and abuse prevention is additionally based on Article 6(1)(f) GDPR.
Automated or rule-based results are initially provisional. Before a final rejection, payout hold, reduction or recovery is based on such a result, you receive an understandable explanation and an opportunity to escalate the matter. In an escalation, a human reviews the decision.
11a. Journey recording in the app
For creator accounts, our API records completed registration and successfully saved submissions against the account. We store the account identifier, event type, operation and recording times, the API executing the operation, and the acquisition category. A submission additionally includes the campaign and submission identifiers, platform and submission type (social media link or upload). We use the first successfully saved submission as the measure of creator activation. Applications and failed attempts do not count towards this measure.
Registration also includes three short acquisition fields for channel, campaign and creative, together with the time of attribution. The app does not send acquisition information for this purpose; for registration through the app or a hosted login, we therefore store “unknown”. If your account was previously created through direct email registration on the website, it may carry the acquisition attribution recorded there; the acquisition category is also recorded for later submissions through the app. Section 11a describes this website attribution in the website privacy policy. For this product measurement, we do not store the content of your posts, full addresses, referrer addresses, advertising-platform click identifiers or device identifiers, and we do not place any additional identifier on your device.
The purpose is to identify how creators find us and whether they subsequently submit successfully, so that we can improve registration and product workflows. This acquisition information and the event records are retained until the account is deleted and are deleted with it. Separate campaign, review and billing records remain subject to section 18. The legal basis for this product measurement is Article 6(1)(f) GDPR; our legitimate interest is to assess and improve these workflows.
Separately, we maintain the following short-lived journey records:
The app informs us when you view one of three screens: the campaign overview after signing in, the page for connecting a channel, and the submission form. The same record is created when a step takes place through our API. For no more than 30 days, we record the day on which a particular step was reached, the interface used (app, website or API), and a pseudonymous identifier. The purpose is to identify where workflows in contentmarkt stop and improve them.
This record contains nothing more: no campaign or submission, no amount and no content from your posts. A step's name may reveal which channel you tried to connect; no further platform information is recorded. The identifier replaces your name and is calculated from your account identifier; we can associate it using our account list, but without that list it has no meaning to third parties. We do not store an identifier on your device for this purpose.
We delete these records within 30 days at the latest. If you close your account, we immediately delete the entries carrying your identifier. Only daily totals remain: how many different people reached a particular step on a day. These daily totals are retained. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is to identify where workflows in our product stop and improve them.
12. Remuneration and payout
In the app, you can view, in particular, confirmed remuneration, remuneration still under review, campaign billing, payout eligibility and payout status. To process these operations, we use creator and campaign IDs, views, agreed remuneration, billing data, the Stripe connected account ID, status information, and transfer and payment references.
Payouts are currently processed through Stripe Connect. You enter bank, identity, address and KYC data directly in the onboarding flow provided by Stripe. contentmarkt does not store this data in raw form. The legal basis is Article 6(1)(b) GDPR. Processing required by tax and commercial law is based on Article 6(1)(c) GDPR.
13. Tax obligations and DAC7/PStTG
As the operator of a digital platform, contentmarkt may be legally required to collect and verify certain creator information and report it to the competent tax authorities, particularly the German Federal Central Tax Office. We will separately inform you which information is involved and when it will be collected before collection begins. The legal basis is Article 6(1)(c) GDPR.
14. Moderation, security and abuse prevention
We process account, campaign, usage, review and log data where necessary to detect fake and duplicate accounts, prevent automated use, detect manipulated submissions, defend against technical attacks and unauthorised access, investigate campaign term violations, handle complaints and disputes, and protect the rights of our users, brands and contentmarkt.
The legal basis is Article 6(1)(f) GDPR. Where legal obligations apply, Article 6(1)(c) GDPR also applies.
15. Data deletion and disconnection of social media accounts
You can disconnect a connected Instagram or TikTok account at any time. Disconnection prevents future API requests, but does not automatically constitute a deletion request for data already stored by contentmarkt.
You can delete your account yourself in the app. You can also request deletion of your data through the data protection officer. When handling a deletion request, we check your identity, existing statutory retention requirements, outstanding billing, necessary fraud and security records, and ongoing disputes. We then delete or anonymise the data to the extent legally permitted.
16. Recipients of personal data
The brand responsible for a campaign may receive the creator and performance data necessary to carry out, review and evaluate the campaign.
We use Amazon Web Services as a technical service provider for the backend, database, storage, infrastructure, and the language model described in section 10. In connection with connected accounts, published content and payments, data may be sent to Meta or Instagram, TikTok, YouTube where applicable, and Stripe.
Data may also be sent to legal and tax advisers, authorities, courts or other bodies where legally required or necessary to establish or defend legal claims.
If you request products for a follow-up video, the brand responsible for your campaign receives your name, delivery address and size or preference information for shipping with your separate consent. Further information is provided in section 7a.
650 Industries, Inc. (Expo) for registration and delivery of optional iPhone notifications, and Apple for forwarding and delivering them through the Apple Push Notification service; the scope is described in section 7b.
17. Processing outside the European Economic Area
Some providers may process personal data outside the European Economic Area, particularly in the United States. Where the European Commission has issued an adequacy decision, we rely on that decision for the transfer; for appropriately certified US providers, this is particularly the EU-US Data Privacy Framework. Otherwise, we use appropriate safeguards under Article 46 GDPR, particularly standard contractual clauses and, where necessary, supplementary protective measures. You can request information about the specific safeguards used from the data protection officer.
18. Retention periods and account deletion
We retain personal data only for as long as necessary for its purpose. The following periods generally apply: account data is generally deleted or anonymised in active systems within 30 days of account closure. Raw video files, where stored, are generally deleted 90 days after final settlement. Campaign, review, measurement and dispute records are generally retained for three years after final settlement or conclusion of the dispute. Technical access and error logs are generally deleted after no more than 30 days. Commercial and tax records are retained for the applicable statutory period.
Backups are removed during the regular overwrite cycle, generally within 90 days at the latest. Longer retention applies only where required by legal obligations, security or fraud cases, or legal disputes.
We delete a product package's delivery address, size or preference information, and shipping note within 60 days after the package is marked as shipped. If a request has not been marked as shipped after 60 days, we close it and delete this information as well. The information is cleared immediately upon withdrawal of consent or account deletion. Package status and the times of eligibility approval, consent, request and shipping remain as records of the operation until the account or campaign is deleted. These periods apply to contentmarkt; the brand's own copies are governed by its privacy policy.
Raw device tokens registered to receive notifications are retained until this device is successfully deregistered or the account is deleted. Tokens reported as invalid by delivery services are no longer used and are removed from our register no later than account deletion. The campaign consent identifier and the start of the current device registration with campaign permission are associated with the device token; we remove this information when notifications are disabled, and remove the association when the token is removed. The local notification selection is retained on sign-out; its campaign permission is withdrawn when notifications are disabled in the app. The separate blocking record described in section 7b contains only the verification value of the withdrawn device registration (or, for older app versions, the push token), its account association and the withdrawal time, and is retained until account deletion. We do not maintain a separate permanent history of marketing consent. The other retention and deletion rules in this section remain applicable.
19. Minors
contentmarkt is intended exclusively for people who are at least 18 years old, have full legal capacity and act as businesses or in the course of their independent professional activity. If we learn that a minor has created an account contrary to these requirements, we may suspend the account and delete the associated personal data in accordance with legal requirements.
20. Your privacy rights
Subject to the statutory requirements, you have the right to access your data, have inaccurate data rectified, request deletion of your data, restrict processing, obtain portability of data you provided, object to processing based on legitimate interests, withdraw consent with effect for the future, and lodge a complaint with a data protection supervisory authority.
To exercise your rights, contact datenschutz@axelspringer.de with the subject: contentmarkt.
21. Competent supervisory authority
For Axel Springer Deutschland GmbH, the competent authority is in particular the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, mailbox@datenschutz-berlin.de, which is the competent authority. You may also contact the data protection supervisory authority for your habitual residence or workplace.
22. Data security
We take appropriate technical and organisational measures to protect personal data. These include, in particular, encrypted data transmission, access restrictions, secure authentication, limits and protection for social media authorisations, logging of administrative access, technical separation of internal and publicly visible data, measures to detect manipulation and abuse, and regular deletion of data that is no longer needed.
23. Changes to this privacy policy
We may update this privacy policy if the app, the service providers used or legal requirements change. We notify you appropriately about material changes, for example in the app. The currently published version applies.