Privacy policy
Effective 14 September 2026 · last updated 14 September 2026
1. Who processes your data
The UGC Club is operated by:
HELIORA d.o.o.
Cesta na Brdo 85, 1000 Ljubljana, Slovenia
Email: hello@ugc-club.si
For anything concerning your personal data, including deletion, write to the address above. We reply within one month at the latest, usually within a few days.
2. Creator data
If you apply to the creator network, we collect:
| What | Why | Legal basis |
|---|---|---|
| Name, email, phone, city, age bracket | So we can contact you and match you with suitable jobs | Consent |
| Profile links (Instagram, TikTok, portfolio) | Assessing your work | Consent |
| Sample video (file or link) | Deciding whether you fit the network | Consent |
| Niches, languages, gear, capacity, expected rate, invoicing method | Matching to jobs and agreeing terms | Consent |
| Shipping address (entered in the portal) | Delivering the products you film | Performance of a contract |
| Submitted videos, job statuses, payment amounts and dates | Running the collaboration and paying you | Contract, legal obligation (accounting) |
| IP address at time of submission | Protecting the form from abuse | Legitimate interest |
We only accept adults into the network. If children appear in your videos, you flag this in the application; their participation is your responsibility as their parent or guardian.
3. Brand data
If you apply as a brand, we collect your company name, contact person, email, phone, website and social profiles, along with details about your product, audience, content needs and budget range. We use these to prepare an offer and run the collaboration. The legal basis is consent or performance of a contract. Business contact details are not personal data as such, but where they identify an individual we treat them with the same care as everything else.
4. Who we share it with
We do not sell data and never share it for marketing. We share only what is necessary:
- The brand that hires you: as a rule only your name and the delivered video. We do not pass on your email, phone or profiles — communication runs through us.
- Your shipping address goes to the brand only when the brand ships the product directly. If we forward the shipment, the address stays with us. Which of the two applies is stated in the job brief before you accept it.
- Our hosting provider (Neoserv d.o.o., Slovenia), where the site and database run. They act as a processor on our instructions.
- Accounting and tax authorities — data on issued and received invoices, to the extent required by law.
We do not transfer data outside the European Economic Area.
5. How long we keep it
| Data | Retention |
|---|---|
| Application and sample video of a creator we do not accept | 6 months from the decision, then deleted |
| Data of an accepted creator | For the duration of the collaboration and 12 months after the last job |
| Application of a brand we do not work with | 12 months |
| Invoice and settlement data | As required by law, generally 10 years |
| Delivered videos purchased by a brand | For as long as the rights agreed for that job remain valid |
The six-month period for declined applications exists so we can come back to you if a better-matching brand appears. If you'd rather we didn't, tell us and we delete immediately.
6. Automated match suggestions
To work faster we use an internal tool that takes the data from your application (niche, language, rate, capacity, rating of past work) and calculates how well you fit a given brand, producing a ranked list of suggestions.
This is not automated decision-making. The tool rejects nobody and selects nobody — it only proposes an order. Every decision about acceptance into the network and about assigning a job is made by a person. Each calculation lists its reasons, so on request we can explain why you were or were not suggested.
7. Your rights
Under the GDPR you have the right to:
- know what data we hold about you and receive a copy
- have inaccurate data corrected
- have your data erased (the "right to be forgotten")
- restrict processing
- receive your data in a machine-readable format or have it transferred elsewhere
- object to processing based on legitimate interest
- withdraw consent at any time — withdrawal does not affect processing before it
One email to hello@ugc-club.si is enough. You do not need to justify a deletion request.
If you believe we are handling your data incorrectly, you may complain to the supervisory authority: Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si.
8. Security
- The site runs exclusively over an encrypted connection (HTTPS).
- Passwords are stored only as cryptographic hashes — not even we can read them.
- Sample videos and delivered footage are stored outside the publicly accessible part of the server and can only be played after logging in.
- Database access is limited to a small number of people, and credentials are stored separately from the code.
- Every status change is logged, so it is always clear who changed what and when.
9. Cookies
This site has no analytics, advertising pixels or trackers. We use a single strictly necessary cookie that keeps you logged in to the admin or the creator portal — without it, logging in does not work. No consent is required for it, which is why there is no cookie banner. If that ever changes, a banner will be added before we start measuring anything.
Fonts are loaded from Google Fonts, which means your browser connects to Google's servers and reveals your IP address to them.
10. Changes
We may update this policy if the way we work changes. The date of the last change is always at the top of this page. For significant changes we notify active creators and brands by email.