Version 1.15 · effective from October 18, 2026 · older versions · Česky
This version is no longer in effect. The current one is version 1.16.
This is an English translation. If it differs from the Czech version, the Czech version prevails.
What this means in practice
We describe what data we have about you, what we use it for and how long we keep it. We never pass your address or phone number to brands; your email only if you share it yourself. We store diet, allergies and skin type only with separate consent, and we delete them when you withdraw it.
Contents
1.1 The controller of personal data is Fomigo Solutions s.r.o. · Company ID (IČO) 300 03 407 · Příčná 1892/4, 110 00 Prague 1 · registered with the Municipal Court in Prague, Section C, File 455688 (“Fomigo” or “we”).
1.2 In matters of personal data protection, contact us by email at contact@fomigo.com or by post at our registered office address. We have not appointed a data protection officer, because the scope of our processing does not yet require one. If that changes, we will name them here.
1.3 This Policy explains what data we process, why, for how long, who we pass it to and what rights you have. It supplements the Fomigo Terms of Service and covers processing in the application on fomigo.com and on its domain versions fomigo.cz, fomigo.sk, fomigo.pl and fomigo.de.
| Data | Source | Note |
|---|---|---|
| Account: email, name, nickname; sign-in is provided by Google Identity Platform (password or sign-in with Google/Microsoft) | from you at registration | the password is stored not by us but by Identity Platform |
| Social media account (handle) and verification status | from you; verification by connecting the account (OAuth) | Article 9 |
| Profile and statistics of the connected channel (YouTube, Instagram, TikTok): account identifier, name and handle, profile photo and bio, numbers of followers, views, posts and likes; for YouTube and Instagram also the audience breakdown by age and gender, for Instagram also by country, and for your Campaign videos on YouTube the breakdown of their viewers by age, gender and country — including data that the network does not show publicly | from the social network's API, to the extent you approve when connecting | Article 9 |
| Delivery address (street and house number, town, postcode, country) or the Zásilkovna/Packeta pickup point you chose on the map, phone number, date of the last address confirmation | from you | the live address is protected by database encryption and access control, not by application-level encryption — see Article 11; Zásilkovna/Packeta receives them for delivery (Article 8.3) |
| Preferences: “want” and “don't want” categories, clothing and shoe size, children (age bands only), pets, the types of collaboration you are interested in | from you | no reason for declining a category is stored, because it could reveal health, religion or other sensitive circumstances |
| Date of birth | from you, optionally in your “About me” profile | Article 14 |
| Diet, allergies (including free text) and skin type | from you, only with separate explicit consent | special category of personal data (Article 9 GDPR) — see Article 5 |
| Shipments: status, delivery history, value of the products as stated by the Client | from the operation of the Platform | |
| Campaign Outputs: a post, reel, video or story with a Campaign mark, or one whose link you reported — the link, text, time of publication, stored preview and figures, including those the network does not show publicly (views, reach, likes, comments, shares, saves, and replies for a story) | from the connected channel, to the extent you approve when connecting; from the publicly available content of your accounts in the Modash export; the link from you | Articles 4, 8.4, 9.1 and 10 |
| Reputation group (A–D) and the underlying events (delivered, published, promise kept/not kept) | calculated from the above, once a week | Article 12 |
| Consents and their versions, time given and withdrawn; record of sharing your email with a specific brand | from the operation of the Platform | Article 7 |
| Communication with support, notifications we have sent you | from the operation of the Platform | |
| Technical data: IP address, device and browser type, sign-in records | automatically |
| Data | Source |
|---|---|
| Handle and publicly available social media profile data (content category, audience, contact email given in the public profile), a snapshot of public channel statistics | from a list export from the Modash tool |
| Handle and contact email | from a brand's own contact list given to us (in that case the brand is the source — Article 6.2) |
| Code/Invitation Link: when it was created and which offer it belongs to | from the operation of the Platform |
| A one-way fingerprint of the email and channel identifiers, if you objected or asked for erasure | from the operation of the Platform — see Article 6.4 |
| Data | Source |
|---|---|
| Name, work email, phone number, role and the company you represent | from you or from a colleague who invited you |
| Company identification and billing details (name, registered office, company ID (IČO), VAT ID (DIČ), billing email) | from you; supplemented from the public ARES register |
| Briefs, orders, Campaign settings, acceptance of terms and consent to tips by email (version, time) | from the operation of the Platform |
| Technical data about use of the portal | automatically |
Your name and email were given to us by the Client, or entered by our salesperson according to whom the Client designated. From you, we have your position, your declaration on the Order, the times of the steps, your IP address and browser data. You confirm the Order through the link sent to your email; together with the Order, we keep the accepted text of the Proposal with your name, position and declaration, and when we sent you the link. We send the email with the Proposal Link from noreply@fomigo.com; a copy of it stays in the sent mail of the Fomigo mailbox we send from (Google Workspace, Article 8.2). The Client also receives a confirmation of every Order.
Technical data needed to display the public pages of the application on any of its domains (IP address, requested page, browser). We choose the language of the pages based on the domain (fomigo.cz Czech, fomigo.sk Slovak, fomigo.pl Polish, fomigo.de German), the languages set in your browser, the page you came from and the country that our hosting provider (Google Cloud) determines from your IP address. We store none of this for the purpose of choosing the language. We measure page views with product analytics and where you arrive from in Google Analytics, both without cookies (Article 4). The application uses no cookies other than strictly necessary ones: the session cookie after sign-in, short-lived step cookies during registration, channel connection and when creating an account from a Proposal Link, and the language cookie (Article 13). A visitor who does not start registering or sign in receives at most the language cookie, and only if they choose a language themselves or arrive at fomigo.com from a page whose domain determines the language (for example .cz).
| Purpose | Who it concerns | Legal basis |
|---|---|---|
| Running the account, sign-in, security, communication about the account | Creator, Client user | performance of a contract (Article 6(1)(b) GDPR) |
| Selecting Creators for Campaigns based on profile, preferences and reputation group; delivering the Package; email and messages in the Portal about the shipment, without confirmation of each Package in advance | Creator | performance of a contract — consent to being sent Packages is part of the terms accepted at registration (Terms of Service, Article 17) |
| Annual address confirmation | Creator | performance of a contract; the principle of data accuracy |
| Date of birth as an additional confirmation that the Creator is at least 18 | Creator who entered the date | legitimate interest — only persons aged 18 and over may use the Platform (Article 6(1)(f) GDPR); the data is optional and you can delete it from your profile at any time |
| Finding Campaign Outputs and their figures in the connected channel from delivery of the Package for the monitoring window (60 days) and 7 days after it, including reading the text in a story's picture (Article 9.1), additionally in publicly available content through Modash (Article 8.4), and reporting to the Client | Creator | performance of a contract (description of the service) and our legitimate interest in verifying what came of the Campaign — this is not consent: a withdrawable consent would remove, in the middle of the monitoring window, the basis for the reporting that is owed to the Client |
| Processing the delivery address and its encrypted snapshot on the shipment | Creator | performance of a contract — this is not consent: a withdrawal in the middle of transport would remove the basis for an address the carrier already has |
| Calculating the reputation group, matching and the check before the first Package | Creator | performance of a contract and legitimate interest in the quality of the database and in protecting Clients |
| One-time sharing of your email with a named brand (Articles 7.1–7.6) | Creator | consent — the consent is the act of ticking the box or clicking the button in the request itself; it can be withdrawn until the sharing takes place |
| Sharing your contact with a brand interested in a type of collaboration you chose (Article 7.7) | Creator who gave the standing consent | consent (Article 6(1)(a) GDPR) — optional, until withdrawn; you can withdraw it in your “About me” profile |
| Consent to the health fields (diet, allergies, skin type) | Creator | explicit consent (Article 9(2)(a) GDPR) — see Article 5 |
| Identifying and approaching a Creator who is not yet with us, with a specific Package offer; after an objection or erasure, a fingerprint so that we do not approach them again | Creator before registration | legitimate interest — see Article 6 |
| Approaching contacts from a brand's own list | Creator before registration | legitimate interest; the source of the data is the brand, which is their controller and is responsible for informing them |
| Handling Client registration, preparing the Proposal, concluding and performing the Order, invoicing | Client user | performance of a contract or negotiations on it, where the Client is a self-employed natural person; for employees and representatives of the Client, legitimate interest (Article 6(1)(f) GDPR); compliance with legal obligations (accounting, tax) |
| Concluding an Order via a Proposal Link and keeping evidence of it | person confirming an Order on behalf of the Client | legitimate interest — concluding the contract with the Client and being able to prove and defend it (Article 6(1)(f) GDPR); you can object to the processing under Article 21 GDPR (see Article 16) |
| Operational and legal notices (selection for a Campaign, offers and shipments, account verification, change of terms) | all users | performance of a contract; cannot be switched off |
| Tips by email | Client user who asked for them at registration | consent (Article 6(1)(a) GDPR; Section 7 of Act No. 480/2004 Coll.) — optional, until withdrawn; you can unsubscribe via the link in every email or at contact@fomigo.com, and unsubscribing withdraws the consent |
| Tips by email | Creator who turned them on in the Portal (Profile → Account → Tips by e-mail); they are not requested at registration | consent (Article 6(1)(a) GDPR; Section 7 of Act No. 480/2004 Coll.) — optional, until withdrawn; you can turn them off in the same place, via the link in every email or at contact@fomigo.com, and unsubscribing withdraws the consent |
| Measuring how the Platform is used and finding errors (product analytics) | all users and app visitors | legitimate interest in keeping the Platform working and improving it (Article 6(1)(f) GDPR) |
| Measuring which marketing channels and campaigns bring visitors, registrations and briefs | all users and app visitors | legitimate interest in knowing which promotion of the Platform works (Article 6(1)(f) GDPR); you can object to the processing under Article 21 GDPR (see Article 16) |
| Handling data subject requests, defending legal claims | everyone | compliance with legal obligations; legitimate interest |
We do not automatically process any special categories of personal data other than the fields under Article 5 (diet, allergies, skin type). Preferences for declined categories do not contain a reason.
Product analytics receives only events from the application's server, with no cookie and no script in the browser: a pseudonymous identifier (for a signed-in account, the sign-in identifier; for a visitor, a fingerprint that changes every day and from which neither the IP address nor the browser can be worked out), the code of the event or step, the page without identifiers in its address, the domain you came from, the type of browser, operating system and device, and a technical record of an application error. Never your name, email, phone number, address, handle or any text you wrote.
Marketing channel measurement likewise receives only events from the application's server, with no cookie and no script in the browser; our measurement server in the EU (server-side Google Tag Manager) passes them to Google Analytics. Google Analytics receives only the page without identifiers in its address, the domain of the Platform, the domain you came from, the campaign parameters of the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content and the ad click identifier), the type of device, a pseudonymous identifier that changes every day (also for a signed-in account), the event code (for example a completed registration or a sent brief) and the IP address without its last part, from which at most the country can be determined. Never your name, email, phone number, address, handle or any text you wrote.
5.1 The optional fields for diet, allergies (including free text) and skin type in the “About me” profile may reveal a health condition and are a special category of personal data under Article 9 GDPR. They are shown and saved only with your explicit and optional consent, given with a box that is not pre-ticked, separate from your consent to the Terms, with a link to this Policy (Article 9(2)(a) GDPR). Without consent, the fields are inactive and nothing is saved. You still receive offers.
5.2 The data is used solely so that we select and pack Packages that cannot harm you. The Client never sees it. Our internal team sees it only when packing a shipment.
5.3 You can withdraw consent at any time in your Profile with a single tap on the “Health data” switch in the Account section, as easily as you gave it. Withdrawal immediately deletes the diet, allergies (including free text) and skin type fields. Nothing already under way ends because of it; only the basis for future selection and packing changes.
5.4 Children in the household are recorded only as age bands, never by name or date of birth. We never collect information on glasses, eyeglass prescriptions, skin tone or hair type.
6.1 Modash import. If we identified your channel from publicly available data using the Modash tool, we process the categories of data under Article 3.2 on the basis of legitimate interest: offering a Package to the people concerned.
6.2 A brand's list. If we received your contact details from a Client who knows you (its own list under the Terms of Service, Article 10.2), the source of the data is that brand. As controller, the brand is responsible for obtaining the data lawfully and for informing you in advance.
6.3 What we use the data for. We use the data under Article 3.2 only to approach you with a specific Package offer and invite you to register. This Article describes where we got the data and what we do with it.
6.4 Right to object. You can object to this processing at any time under Article 21 GDPR by email to contact@fomigo.com. From that moment on, no invitation or message is sent to you, and we do not select you for Campaigns. We anonymise your data without undue delay. We keep only a one-way fingerprint (hash) of the email and the channel identifiers, from which the original value cannot be read. It serves only to prevent a further Modash import or a brand's list from inviting you again; it does not prevent you from registering with us yourself later.
6.5 Person confirming an Order. We have the name and email of the person to whom we send a Proposal Link from the Client; they receive the information about the processing in the email with the link.
7.1 After the Campaign ends and the report is sent, the Client may ask once per Campaign for the contacts of the selected Creators. You give consent either with an optional checkbox that is not pre-ticked, on the selection notification or on the feedback for that Campaign, or with a button in a specific brand's request. The text is always the same: “I agree to share my contact with {Brand}”.
7.2 The legal basis is your consent (Article 6(1)(a) GDPR), always for a specific named brand and a specific Campaign.
7.3 What is shared: name, channel handle and contact email. Your address and phone number never leave the Platform, under any circumstances.
7.4 The one-time consent is used up by a single sharing. What has been shared cannot be taken back. Because the consent is one-time and nothing continues to run from it after the sharing, there is nothing to “withdraw” as a standing setting. Every further request, even from the same brand for another Campaign, asks you again.
7.5 After the sharing, the brand becomes an independent controller of your contact, not our processor, and is responsible for its further processing. The business (B2B) terms oblige the brand to use the contact only to approach you about follow-up collaboration.
7.6 Declining or silence has no consequences for you. Our internal team sees each Creator's answer; the Client sees only the number of Creators who agreed, and the contacts of those who agreed. It will not find out who declined or did not respond.
7.7 Standing consent. In your “About me” profile, under the types of collaboration you are interested in, you can also give a standing consent to share your contact with brands. It is optional, never pre-ticked, and nothing depends on it. The legal basis is your consent (Article 6(1)(a) GDPR); it allows us to share the data under Article 7.3 with a brand interested in one of the types of collaboration you chose. You withdraw it in the same place: by unticking the consent or by removing all types of collaboration. Withdrawal applies to further sharing; a contact the brand has already received cannot be taken back. Article 7.5 applies to a brand that receives your contact.
The Client that sends you a Package does not receive your address or phone number — ever. It receives your email only if you have given it yourself under Article 7. At that point, the Client is the independent controller of your email and is responsible for its further processing.
The Client does not receive the profile, statistics or audience of your connected channel (Article 9) individually. In the Proposal, it sees only aggregate figures for the Creators selected for the Campaign: how many there are on each network and in each size group, what share have a verified channel, the median number of followers, the countries Packages are sent to, and the share of Creators in reputation groups A and B. By name, it sees only the handles of Creators whom it has itself given us as its existing collaborators. In the Campaign report, it sees the Creator's handle and their Campaign Outputs: the link, the preview and the figures that we retrieve for the Output from the connected channel (Article 9.1), or public metrics from the Modash export (Article 8.4). The Client does not see any other content of the channel. It sees the audience of the Creators who published an Output for the Campaign (the age, gender and country of followers on Instagram and of the viewers of Campaign videos on YouTube, Articles 9.2 and 9.3) in the report only as an aggregate of at least five Creators, never for an individual Creator.
To run the Platform, we use suppliers who process data on our instructions and on the basis of a data processing agreement (Article 28 GDPR):
Modash is a third-party tool that we use in two ways: as a data source when identifying new Creators (list export, Article 6.1), and as an additional tool next to the connected channel (Article 9.1), whose regular Campaign monitoring export evaluates the publicly available content of Creators' accounts for the purposes of the report. Modash processes only publicly available social media data. For Output monitoring, Modash is our processor and processes data on our instructions on the basis of a data processing agreement (Article 28 GDPR). For identifying new Creators, it is a provider of publicly available data from which we make the selection (Article 6.1).
You connect a YouTube, Instagram or TikTok channel yourself in the Portal, through that network's sign-in (OAuth). The connection is read-only: we will never publish, change or delete anything on your account. We use the retrieved data to verify that the channel belongs to you, to show you and our team its size and audience, to select Creators for Campaigns, to compile aggregate figures for Clients and to find your Campaign Outputs and their figures for the Client's report (Article 8.1). We do not sell data from connected accounts, do not use it for advertising and do not pass it to anyone other than the processors under Article 8.2 and the Client to the extent of Article 8.1. We store it in the database with the connected channel (Article 11.1), together with the original response from the network's API, from which we remove access tokens and email addresses. The access tokens themselves are also encrypted (Article 11.3).
Campaign Outputs. From delivery of the Package, for the monitoring window (60 days) and 7 more days after it ends, we read the posts, reels, videos and stories you publish from the connected channel and look in them for a Campaign mark: the brand's account, a hashtag or a keyword. In a post, reel or video we look for it in the text; in an Instagram story also in its picture, whose text is read by Google Cloud Vision (Article 8.2). We store an Output with a mark, and an Output whose link you send us, with its link, text, time of publication, preview and figures (views, reach, likes, comments, shares, saves, and replies for a story), which we refresh for as long as the monitoring lasts; for a story, we retrieve them for the last time shortly before it disappears after 24 hours. We do not store a post or story without a mark. For a story without a mark, we keep only its identifier for 48 hours so that we do not read it again; we keep neither its picture nor its figures.
Connecting a YouTube channel uses YouTube API Services. By using this feature, you agree to the YouTube Terms of Service and acknowledge the Google Privacy Policy, under which Google handles your data.
We request only two permissions:
Fomigo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We check the validity of the authorisation for a connected YouTube channel at least once every 30 days. If we find that you have revoked access yourself at Google, we proceed as with a disconnection (Article 9.5).
You can connect an Instagram professional account (Creator or Business). We request the instagram_business_basic permission — account identifier, username, name, account type, profile photo, bio and profile website, number of followers and posts and, during a Campaign, your posts, reels and stories with their text, link, time of publication, picture or video thumbnail and numbers of likes and comments — and the instagram_business_manage_insights permission — the age, gender and country breakdown of followers (Instagram provides it only for accounts with at least 100 followers) and, during a Campaign, their views, reach, shares, saves and, for stories, replies (Article 9.1). We do not publish, comment or send messages. On the consent screen, Instagram shows us under the name “Fomigo-IG”.
We request the user.info.basic, user.info.profile and user.info.stats permissions: account identifier, display name and username, profile photo, bio, profile link, whether the account is verified, and the numbers of followers, likes and videos; and the video.list permission: during a Campaign, the list of your videos with their description, link, time of publication, cover image and numbers of views, likes, comments and shares (Article 9.1). We do not share anything to TikTok.
After the channel is disconnected in any of these ways, or after you request deletion of your data, we delete the access tokens and the data retrieved from the channel within 7 days. Only the channel's identification remains — the handle and the account identifier on the network — so that the Campaign history stays with the correct channel and so that we recognise the channel if you connect it again. It is deleted when the account is closed (Article 10). The exception is Outputs that we found for a Campaign before the disconnection: they stay with the Campaign as part of its report, including a locked final report (Article 10). Disconnection ends the monitoring of further Outputs.
| Data | Period | Reason |
|---|---|---|
| Creator account and profile | for as long as the account exists; after it is closed, we anonymise within 30 days | enough time to complete shipments under way and handle support, and not much more |
| Deactivated account (Creator or Client user), if you did not ask for it to be closed | 36 months from deactivation, after which we irreversibly anonymise the data that identifies you; reactivating the account restarts the period | during this time the account can be restored and we can prove what you consented to; company and Campaign data remain without a link to you |
| Date of birth | until you delete it from your profile, at the latest until the account is closed — then we delete it within 30 days | it serves only to confirm age and has no purpose without the account |
| Delivery address and phone number (the live value in the profile) | deleted with the account, within 30 days of its closure | they are the most sensitive data in the profile and have no reason to outlive the account |
| Encrypted address snapshot on an individual shipment | 12 months from delivery, then deleted | covers complaints and returns (Terms of Service, Article 11); it serves no purpose for longer |
| Data retrieved from a connected channel (YouTube, Instagram, TikTok) | until disconnection or a deletion request — then 7 days (Article 9.5); Campaign Outputs stay after disconnection (row below) | |
| Campaign Outputs (Articles 8.4 and 9.1) | like other Campaign records: for the duration of the contract with the Client (row “Client data and contractual documentation”); disconnecting the channel does not change this, it only ends the monitoring of further Outputs (Article 9.5) | they are part of the Campaign report, including a locked final report |
| Identifier of a story without a Campaign mark | 48 hours | so that the same story is not read again; we keep neither the picture nor the figures of such a story |
| Validity of the authorisation for a connected YouTube channel | checked at least once every 30 days (Article 9.2) | |
| Data about a Creator before registration (identification, approach, code) | 12 months from the last contact if they do not register; on objection or on request (Article 6.4), anonymised without undue delay, and only the fingerprint under the row below remains | without a time limit, the Modash import would keep unregistered contacts forever |
| Fingerprint after an objection or erasure | a one-way fingerprint (hash) of the email and channel identifiers with no readable value, for as long as we identify Creators by import (Article 6.4) | without the fingerprint, the next import would invite you again |
| Records of consents and their versions | for as long as the account exists + 3 years; for a person without an account, the record follows the row on evidence of an Order | the limitation period for asserting claims — we must be able to prove what was agreed to and when |
| Health fields (diet, allergies, skin type) | until consent is withdrawn — then deleted immediately (Article 5.3) | |
| Consent to share a contact, and the record of the sharing | the one-time consent is used up by a single sharing (Article 7.4), the standing one applies until withdrawn (Article 7.7); we keep the record of the sharing for 3 years from the sharing | the same limitation period as for other consents — it is proof that the contact was shared, and with whom |
| Reputation group and the underlying events | for as long as the account exists, recalculated once a week; deleted with the account | it is calculated from the data of an active account and loses its purpose once the account is closed; it is therefore deleted together with it |
| Client data and contractual documentation | for the duration of the contract; accounting and tax documents for 10 years from the end of the year in which the document was created | the period under the Accounting Act and the Tax Procedure Code |
| Evidence of the conclusion of an Order (accepted text, fingerprints, name, position, declaration, the email address the Proposal Link was sent to) | 10 years from the end of the year in which the Order was made | defence of claims within the objective limitation period, and accounting archiving |
| Technical data about the steps of an Order (IP address, browser, copies of the link emails in the sending mailbox) | 4 years from the end of the Campaign; during a dispute, until it ends | the limitation period and a reserve for claims raised at its end |
| Contacts in the Ecomail lists | for as long as the account exists; we delete them when the account is deleted or anonymised | Ecomail keeps the contact only for us (Article 8.2) |
| Product analytics events | 12 months | enough to compare periods and trace errors |
| Events in Google Analytics | individual events 2 months; aggregated reports for as long as we run the measurement in Google Analytics | enough to evaluate campaigns; aggregated reports no longer identify anyone |
| Technical records (access logs) | 30 days | enough to trace an incident; not operational analytics |
In this version of the Platform, reading of a Creator's delivery address by an internal user is not audited. Access to the address is controlled by roles (Article 11.4), so the table has no separately logged record of each read.
11.1 The database runs on Google Cloud SQL in the europe-west3 region, with encryption of data at rest and controlled access at the infrastructure level. The live delivery address and phone number in the Creator's profile are protected in this way — by database encryption and access rules, not by application-level encryption.
11.2 In addition, an encrypted address snapshot is created at the moment the Package is accepted and is stored, encrypted at the application level, on the shipment concerned. This is so that it survives unchanged even a later key rotation or a change in the access rules for the live profile.
11.3 The access authorisations (tokens) for connected channels are encrypted, with a key version for future rotation.
11.4 Internal users' access is controlled by roles. Sign-in is provided by Google Identity Platform. Communication is encrypted (HTTPS).
11.5 Suppliers process data on the basis of a data processing agreement and only for the purpose concerned (Article 8.2).
12.1 To select Creators for Campaigns, we use automated evaluation of profiles (categories, preferences, channel verification, reputation group, address availability). The reputation group A–D is calculated once a week from how often you published after a Package was delivered and whether you kept what you promised, compared with comparable Creators on the same network. You see your group in your profile, together with one sentence about what raises it — never the formula, the percentile or other people's figures.
12.2 The Client never sees your group and cannot filter by it. A decision that would have legal effects for you or similarly significantly affect you is not made automatically without the possibility of human intervention: you can contact our support at contact@fomigo.com about your classification or a selection and ask for a human review.
12.3 Creators are selected for Campaigns by our team; automatic filters only make the selection easier for the team. It is therefore not a decision based solely on automated processing under Article 22 GDPR.
13.1 The application uses only strictly necessary cookies, on fomigo.com as well as on fomigo.cz, fomigo.sk, fomigo.pl and fomigo.de. Each domain sets its own cookies, and one domain cannot read another domain's cookies. The main one is the session cookie, which is set when you sign in (httpOnly, valid for at most 14 days). Without it, the Platform would not know that you are signed in, and you could not move between screens of the Portal.
13.2 Alongside it, we use short-lived step cookies, which hold an unfinished step until you complete it:
Step cookies expire once the step is completed or their validity ends.
13.3 Language cookie. When you choose a language in the switcher, or when you arrive at fomigo.com from a page whose domain determines the language (for example .cz), the application stores a cookie with your language choice (only the language code, for example “cs” or “en”, valid for 1 year), so that further pages are shown to you in the same language. It contains nothing else and is not passed to anyone. It applies only on the domain where it was created. On fomigo.cz, fomigo.sk, fomigo.pl and fomigo.de the domain itself sets the language, so the cookie is created there only when you choose a language in the switcher.
13.4 All these cookies are strictly necessary for the service you have requested (sign-in, registration, secure completion of OAuth, display in the language you chose). Under Section 89(3) of Act No. 127/2005 Coll., on Electronic Communications, we do not require consent for them. The Platform uses no other cookie, whether analytical or marketing; product analytics and marketing channel measurement (Article 4) run on the server only.
13.5 Because these are only strictly necessary cookies, you will find no cookie banner or cookie settings on any domain of the Platform. There is nothing to consent to.
14.1 The Platform is intended only for persons over 18. A Creator confirms their age in the first step of registration, together with their agreement to the Terms of Service (Terms of Service, Article 15.1), and may optionally enter their date of birth in their “About me” profile; a date of birth according to which they are not yet 18 cannot be saved. We do not knowingly process the data of persons under 18. If we find that an account belongs to a person under 18, we will close it and delete their data.
14.2 We do not send alcoholic beverages, tobacco or nicotine products through the Platform (Terms of Service, Article 8.4).
14.3 Data on children in a Creator's household are recorded only as age bands, never by name or date of birth (Article 5.4).
15.1 We run the database and the main processing in the European Union (Google Cloud, europe-west3 region). Within Google's global infrastructure (Cloud, Workspace, Identity Platform), limited processing may take place outside the EEA. Such transfers are covered by standard contractual clauses, which form part of the Google Cloud and Google Workspace data processing terms. Google Analytics also processes data in the United States; the transfer to Google LLC relies on the European Commission's adequacy decision for the EU–US Data Privacy Framework, under which Google LLC is certified (Article 45 GDPR). Ecomail and the product analytics tool process data on servers in the EU.
15.2 Carriers and other independent controllers under Article 8.3 process data within the European Union. We deliver Packages only in Czechia and Slovakia (Terms of Service, Article 11.3).
16.1 You have the right of access to your data and to a copy of it, the right to rectification, to erasure, to restriction of processing, to portability of the data you have provided to us, and the right to object to processing based on legitimate interest. Send an objection to marketing channel measurement (Article 4) by email to contact@fomigo.com; we record it and exclude your account's events from the measurement.
16.2 You can withdraw consent (health fields, sharing your contact with a brand, tips by email) at any time. Withdrawal does not affect processing before the withdrawal. A Creator can switch off the health fields and tips by email in the Portal (Profile → Account). For a shared contact, withdrawal stops further sharing in the future, but a contact already shared cannot be taken back from the brand (Articles 7.4 and 7.7).
16.3 We handle requests sent to contact@fomigo.com within one month. In complex cases, we extend this period by at most two further months and let you know. You can close a Creator account and have its data deleted in the Portal (Profile → Account → Deactivate account → Delete account; Terms of Service, Article 25) or through our support at contact@fomigo.com. Our support handles requests for a copy of your data.
16.4 You have the right to lodge a complaint with the supervisory authority: the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 727/27, 170 00 Prague 7, www.uoou.gov.cz, email posta@uoou.gov.cz.
17.1 We may change this Policy when the service or the law changes. You will always find the current version and its effective date on this page; previous versions remain available in the document overview. We inform you of material changes by email or in the Portal.
Fomigo Solutions s.r.o. · Company ID (IČO) 300 03 407 · Příčná 1892/4, 110 00 Prague 1 · registered with the Municipal Court in Prague, Section C, File 455688 · contact@fomigo.com.