Privacy.

1. At a glance

This website is deliberately data-frugal. We do not make money from your data, so we do not collect any.

• No analytics or tracking tool, no audience measurement, no ad networks.
• No fonts, maps, videos or social media widgets loaded from third-party servers.
• Enquiries sent via our contact page are stored so we can answer them, and deleted automatically after six months.
• Applications sent via our careers page are stored for the application process and, after a rejection, deleted automatically after six months.
• No advertising or analytics cookies, and therefore no consent banner.

What does occur: the technical connection data every web server needs in order to deliver a page, and whatever you actively send us when you write to us. Both are described in detail below.

2. Controller

Controller

heyhey. Management GmbH

Rosensteinstraße 19

70191 Stuttgart

Germany

Email

hey@weareheyhey.com

Data protection

privacy@weareheyhey.com

Phone

+49 159 04748902

Imprint

Full provider identification

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

3. Hosting

This website is operated for us by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. When you open a page, Vercel processes the resulting technical connection data as our processor (see section 4).

The legal basis is Art. 6(1)(f) GDPR: we have a legitimate interest in providing this website reliably and securely.

This involves a transfer to the USA. Vercel Inc. is certified under the EU-U.S. Data Privacy Framework; in addition, the European Commission's standard contractual clauses apply. For details see Vercel's privacy policy.

4. Server log files

Each page request automatically transmits data that your browser sends and that is technically necessary to deliver the page:

• browser type and version
• operating system
• referrer URL (the previously visited page)
• requested address and amount of data transferred
• date and time of the request
• IP address

The legal basis is Art. 6(1)(f) GDPR. We do not merge this data with other sources, do not build usage profiles from it and do not evaluate it for marketing purposes.

5. Cookies and storage on your device

This website sets no advertising or analytics cookies and embeds no third-party cookies. A consent banner is therefore not required. Only the following is stored:

lang

Cookie set by this website, lifetime 12 months.

Remembers the display language you selected (German or English).

ct-theme

Entry in your browser's local storage, no expiry.

Remembers whether you chose the light or the dark appearance.

hh-kontakt

Entry in your browser's session storage, deleted at the latest when you close the tab.

Keeps the progress of an enquiry you started on the contact page, so nothing is lost when you go back or reload. It never leaves your device; the details of a sent enquiry are removed from it immediately.

hh-shortlist

Entry in your browser's local storage, no expiry.

Remembers the creators you added to your request list in the creator overview; the contact page uses them as a preselection. It does not leave your device unless you send an enquiry.

ct-theme-hint

Entry in your browser's session storage, deleted when you close the tab.

Remembers that the hint next to the light/dark switch has already been shown.

ct-intro

Entry in your browser's session storage, deleted when you close the tab.

Remembers that the logo animation has already played on your first visit to the home page.

These entries are strictly necessary to provide the service you explicitly requested — without them you would have to make your choice again on every page, fill in an enquiry you started again after a reload, or see the hint and the animation again on every page change (Section 25(2) no. 2 TDDDG). None of the entries contains an identifier, and none is evaluated. For the subsequent processing we rely on Art. 6(1)(f) GDPR. You can delete them at any time in your browser settings; the website will keep working, it simply will not remember your choice.

6. Getting in touch

Enquiries via this website

On our contact page you can apply as a creator, request creators as a brand, or write to us about something else. We process your details to handle your enquiry, to reply to you and — for an application or a collaboration request — to prepare a possible collaboration.

We store what you enter in the respective flow:

• Contact details: name and email address, optionally your phone number, and for brands (and optionally for other enquiries) your company name.
• Your answers: for an application, platforms and profile names, topics, the approximate size of your largest channel and what you would like from us; for a brand enquiry, goals, selected creators, requested services and, if given, budget and timeframe; for other enquiries, the topic.
• Free text you choose to write.
• The time of your consent and the page from which you sent the enquiry.

The legal basis is Art. 6(1)(b) GDPR where your enquiry aims at a contract with us — such as an application for representation or a collaboration request. In all other cases it is Art. 6(1)(f) GDPR: our legitimate interest in answering enquiries addressed to us.

Your enquiry is stored in our database and forwarded to our team inbox hey@weareheyhey.com. If you contact a single creator through a pitch deck, it goes directly to that creator's email inbox instead. We send a confirmation to the email address you provide. By ticking the box before sending, you confirm that we may store your details for this purpose.

So that nobody can use this form to flood other people's email addresses with confirmations, we check when you send it whether the enquiry comes from a human. We use Vercel BotID for this: the page loads a check script from Vercel via our own domain, which records technical characteristics of your browser and transmits them with the enquiry to Vercel for evaluation. You do not have to solve a captcha. Vercel acts as our processor (section 3). The check is strictly necessary for sending the enquiry (Section 25(2) no. 2 TDDDG); the legal basis for the processing is Art. 6(1)(f) GDPR, our legitimate interest in protecting the form against misuse.

We keep the enquiry for six months and then delete it automatically. If it leads to a collaboration, the periods of the resulting contract and the statutory retention periods apply to the details required for it.

Applications via the careers page

On our careers page you can apply for an advertised position or send us an unsolicited application. We process your details and documents to carry out the application process: to review your application, to get in touch with you and to decide on hiring.

We store what you send us:

• Contact details: surname and email address, optionally first name and phone number.
• Your message, if you write one.
• Your documents (PDF, JPG or PNG), if you upload any, with file name and size.
• The position you are applying for and the time of your consent.

The legal basis is Art. 6(1)(b) GDPR: steps taken at your request prior to entering into an employment relationship. If you voluntarily send us special categories of personal data — such as information about your health, a severe disability or your religion — we process them under Art. 9(2)(b) GDPR to the extent this is necessary for the application process. By ticking the box before sending, you consent to us processing your details and documents for this purpose and keeping them for six months after a rejection.

When you send an application, we also use Vercel BotID to check whether it comes from a human — as described above for enquiries.

We store your application in our database and your documents in our file storage. Both are operated for us by processors: Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992 (database, servers in the EU, Ireland) and Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (file storage Cloudflare R2, stored in the EU). The website itself is operated by Vercel (section 3). For providers based outside the EU, we rely on the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.

We keep your application until the process is complete. If we reject your application or you withdraw it, we delete it together with your documents automatically six months later; until then we keep it so that we can defend ourselves against claims under the German General Equal Treatment Act (AGG) (Art. 6(1)(f) GDPR). If we hire you, we transfer the necessary details and documents to your personnel file.

Your rights — including access, erasure and withdrawal of your consent — are set out in section 14.

Email

If you write to us, we process your details in order to handle your enquiry and any follow-up questions. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract or its initiation; in all other cases Art. 6(1)(f) GDPR (legitimate interest in handling incoming enquiries) or Art. 6(1)(a) GDPR if you have given consent. You may withdraw consent at any time.

We do not pass this data on without your consent. It stays with us until you ask us to delete it, withdraw your consent, or the purpose ceases to apply. Mandatory statutory retention periods — in particular under Section 257 HGB and Section 147 AO — remain unaffected.

7. Fonts

All fonts used on this website (Biennale and Poppins) are served exclusively from our own server. No connection to Google Fonts or any other font service is established, and your IP address is not transmitted to anyone for this purpose. The previous website embedded Google Fonts — that ended with the relaunch.

8. Maps, analytics, captcha

This website embeds neither a map service nor an analytics tool nor a captcha. Google Maps, Google reCAPTCHA and the analytics functions of the previous website were removed with the relaunch and not replaced.

9. Links to social networks

We embed no social media plugins, like buttons, tracking pixels or embedded posts. The references to Instagram, TikTok, YouTube, Twitch and LinkedIn are plain hyperlinks. Only when you click one does the respective provider receive data about you; from that moment their privacy policy applies, not this one.

10. Protected media kit area

11. Recipients of personal data

We disclose personal data only where this is necessary to perform a contract, where we are legally obliged to do so, where a legitimate interest under Art. 6(1)(f) GDPR exists, or where you have consented. We engage processors only on the basis of a data processing agreement. The processor involved in this website is our host (section 3); for applications via the careers page, the database and file storage providers named in section 6 are added.

12. Retention

Unless a more specific period is stated in this policy, your personal data stays with us until the purpose of processing ceases to apply. If you assert a legitimate request for erasure or withdraw your consent, we delete the data unless other legally permissible grounds for storing it exist — for instance retention periods under tax or commercial law. In that case we delete once those periods expire.

13. Legal bases at a glance

• Art. 6(1)(a) GDPR — your consent, revocable at any time with effect for the future.
• Art. 6(1)(b) GDPR — performance of a contract or pre-contractual measures.
• Art. 6(1)(c) GDPR — compliance with a legal obligation.
• Art. 6(1)(f) GDPR — our legitimate interest in the secure, functioning operation of this website and in handling enquiries.
• Section 25(2) no. 2 TDDDG — storage strictly necessary for the service you requested.

14. Your rights

You have the following rights vis-à-vis us:

• Access to the data stored about you, its origin, its recipients and the purpose of processing (Art. 15 GDPR).
• Rectification of inaccurate data (Art. 16 GDPR).
• Erasure (Art. 17 GDPR).
• Restriction of processing (Art. 18 GDPR).
• Data portability in a common, machine-readable format (Art. 20 GDPR).
• Withdrawal of a given consent with effect for the future (Art. 7(3) GDPR).

An informal message to privacy@weareheyhey.com is enough. Access is free of charge.

Right to object under Art. 21 GDPR

Where we process data on the basis of Art. 6(1)(e) or (f) GDPR, you have the right to object at any time, on grounds relating to your particular situation, to that processing; this also applies to profiling based on those provisions. If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

Where your data is processed for direct marketing purposes, you have the right to object at any time; your data will then no longer be used for that purpose.

15. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority — in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany (www.baden-wuerttemberg.datenschutz.de).

16. Encryption

This website is delivered exclusively over a TLS-encrypted connection (recognisable by the “https://” in the address bar). Transmission between your browser and our server therefore cannot be read by third parties. Please note that data transmission over the internet — for example when communicating by email — can nonetheless have security gaps; complete protection against access by third parties is not possible.

17. Changes to this policy

We update this privacy policy whenever the technology used on this website changes — for example when the protected media kit area goes live. The version published here, with the date given below, is the one that applies.