Privacy Policy

Effective date: April 2026 — Last updated: April 2026

1. Introduction

Welcome to FITS-LIST ("Platform", "Service", "we", "us", or "our"). FITS-LIST is a platform that connects social media influencers ("Influencers") with restaurants and hospitality businesses ("Partners") for promotional collaborations. We facilitate deal discovery, booking management, visit verification, content proof tracking, and payment processing between these parties.

We are committed to protecting your personal information and your right to privacy in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR" / "AVG" in Dutch), the Dutch Implementation Act for the GDPR (Uitvoeringswet AVG — "UAVG"), the Dutch Telecommunications Act (Telecommunicatiewet), and any other applicable data protection legislation.

This Privacy Policy explains what personal data we collect, how and why we process it, who we share it with, how long we retain it, and what rights you have. We encourage you to read this policy carefully. If you have any questions, you can contact us using the details provided in Section 15.

2. Data Controller

The data controller responsible for the processing of your personal data is:

• Company: FITS-LIST by FITS Group (FitsList B.V.)
• Address: Kattegat 50-K, 9723JP Groningen, The Netherlands
• Email: Info@fits-list.com
• KvK (Chamber of Commerce) number: 97928534
• VAT (BTW) number: NL868292229B01
• Country: The Netherlands

FitsList B.V. determines the purposes and means of processing your personal data and is therefore the controller within the meaning of Article 4(7) of the GDPR.

3. What Data We Collect

We collect and process various categories of personal data depending on how you interact with our Platform. Below is a detailed overview.

3.1 Account Data

When you create an account on FITS-LIST, we collect and store the following information:

• Full name
• Email address
• Password (stored as a bcrypt hash — we never store your password in plain text)
• Account role (Influencer, Partner, or Admin)
• Account creation date and last login timestamp

3.2 Influencer Profile Data

If you register as an Influencer, you may provide or we may process the following additional data:

• Social media handles (Instagram, TikTok)
• Follower counts and engagement rates
• Average story views
• Tier classification (Starter, Rising, Premium, or Elite)
• Content niche preferences (e.g., food, lifestyle, fitness)
• Phone number
• City and location (latitude/longitude when provided)
• Profile picture
• Bio and personal description

3.3 Partner (Business) Data

If you register as a Partner, we collect:

• Business name and trading name
• Business address(es) and location(s)
• Business logo and cover images
• Contact person name, email, and phone number
• Business category and description
• Subscription and billing information

3.4 Social Media Data (via ScrapeCreators API)

To verify Influencer profiles and provide accurate matching, we use the ScrapeCreators API to retrieve publicly available data from Instagram and TikTok profiles. This includes:

• Public profile picture
• Follower count and following count
• Engagement rate
• Average story views (where available)
• Username and display name
• Account verification status
• Recent post metrics (likes, comments)

This data is refreshed periodically to ensure tier classifications and profile information remain accurate. Only publicly available information is collected; we do not access private accounts or direct messages.

3.5 Deal and Booking Data

When you interact with deals on the Platform, we collect:

• Booking requests, confirmations, and cancellations
• QR code scan data (timestamps, location of scan for visit verification)
• Content proof uploads (photos, screenshots of posted content)
• Deal history and collaboration records
• Review and rating data
• Deal preferences and saved deals

3.6 Payment Data

Payment processing is handled entirely by our payment service provider, Mollie B.V. We do not store your credit card details, bank account numbers, or other direct payment credentials on our servers. We do store:

• Invoice records (amounts, dates, descriptions, invoice numbers)
• Mollie customer and payment reference IDs
• Payment status (paid, pending, failed)
• Subscription plan and billing cycle information

3.7 Communication Data

We collect data related to communications on or through the Platform:

• Support ticket content and metadata
• In-app booking messages between Influencers and Partners
• Email correspondence with our team
• Push notification delivery and interaction data

3.8 Technical Data

When you access our Platform, we automatically collect certain technical data:

• IP address
• Browser type and version
• Device type, operating system, and screen resolution
• App version (for mobile users)
• Referral source and pages visited
• Timestamps and session duration
• Error logs and crash reports

3.9 Location Data

We process location data in the following ways:

• Provided by you: City, address, or coordinates you enter in your profile or when creating deals.
• Device location: If you grant permission, we use your device's GPS coordinates for deal matching based on proximity. You can revoke this permission at any time through your device settings.
• QR scan location: When you scan a QR code for visit verification, the scan location may be recorded.

3.10 Push Notification Tokens

If you use our mobile application (built with Expo/React Native) and opt in to push notifications, we store your device push token. This token is used solely to deliver notifications such as booking confirmations, deal updates, and important account alerts. Tokens are deleted when you unregister from notifications or delete your account.

4. How We Use Your Data

We process your personal data for the following purposes:

4.1 Service Delivery and Account Management

To create and maintain your account, authenticate your identity, manage your profile settings, and provide you with access to the Platform's features.

4.2 Deal Matching

To connect Influencers with relevant deals offered by Partners. Matching is based on factors such as geographic location, influencer tier, content niche preferences, availability, and historical performance.

4.3 Tier Classification

To calculate and assign Influencer tiers (Starter, Rising, Premium, Elite) based on follower counts, engagement rates, and other social media metrics. Tiers determine which deals an Influencer is eligible for and the compensation structure.

4.4 Social Media Verification and Profile Enrichment

To verify the authenticity and accuracy of Influencer social media profiles, prevent fraud, and keep profile data up to date through periodic syncing via the ScrapeCreators API.

4.5 Payment Processing and Invoicing

To generate invoices, process subscription payments from Partners, and manage financial transactions through our payment processor Mollie. This includes sending invoice notifications and payment reminders.

4.6 Communication

To send you transactional communications including:

• Booking confirmations and updates (via email through Resend and push notifications via Expo)
• Account verification and password reset emails
• Invoice and payment notifications
• Deal status changes and reminders
• Important service announcements and policy updates

4.7 Platform Analytics and Improvement

To analyze platform usage patterns, improve our features, optimize deal matching algorithms, provide Partners with aggregated performance analytics, and enhance the overall user experience.

4.8 Legal Compliance and Fraud Prevention

To comply with applicable laws and regulations (including Dutch tax law), respond to lawful requests from public authorities, detect and prevent fraudulent or abusive behavior, enforce our Terms and Conditions, and protect the rights and safety of our users.

5. Legal Basis for Processing (Art. 6 GDPR)

We process your personal data only when we have a valid legal basis under the GDPR. The applicable legal bases are:

5.1 Performance of a Contract (Art. 6(1)(b) GDPR)

Processing is necessary for the performance of our contract with you (our Terms and Conditions). This covers:

• Creating and managing your account
• Facilitating deal bookings and collaborations
• Processing payments and generating invoices
• Providing customer support
• Sending transactional communications

5.2 Legitimate Interest (Art. 6(1)(f) GDPR)

Processing is necessary for our legitimate interests, provided these do not override your fundamental rights and freedoms. This covers:

• Improving and optimizing the Platform and our services
• Preventing fraud and ensuring platform security
• Aggregated analytics and reporting for Partners
• Social media profile verification using publicly available data
• Tier classification based on public metrics

5.3 Consent (Art. 6(1)(a) GDPR)

Where required, we process data based on your explicit consent. You may withdraw your consent at any time. This covers:

• Connecting your social media accounts for enhanced profile features
• Enabling device location services for proximity-based deal matching
• Receiving push notifications on your mobile device

5.4 Legal Obligation (Art. 6(1)(c) GDPR)

Processing is necessary to comply with legal obligations to which we are subject. This covers:

• Retaining invoice and payment data for 7 years as required by Dutch fiscal legislation (Algemene wet inzake rijksbelastingen)
• Responding to lawful requests from tax authorities (Belastingdienst) or law enforcement
• Complying with anti-money laundering regulations where applicable

6. Third-Party Services

We engage the following third-party service providers (processors) to help us operate the Platform. Each provider processes data on our behalf under a Data Processing Agreement (DPA) in accordance with Article 28 of the GDPR.

All third-party processors are contractually bound by Data Processing Agreements and are required to handle your data in accordance with the GDPR. We regularly review our processors to ensure ongoing compliance.

7. Cookies and Tracking

Our Platform uses only strictly necessary cookies and local storage, which are exempt from the consent requirement under Article 11.7a of the Dutch Telecommunications Act (Telecommunicatiewet), as they are essential for the provision of the Service.

Specifically, we use:

• JWT authentication tokens: Stored in local storage or as HTTP-only cookies to authenticate your session and keep you logged in.
• Session identifiers: To maintain your active session while using the Platform.
• User preference storage: To remember language selection and display preferences.

We do not use:

• Marketing or advertising cookies
• Third-party tracking cookies
• Analytics cookies (such as Google Analytics)
• Social media tracking pixels

Because we only use strictly necessary cookies, no cookie consent banner is required under Dutch law. We do not track you across third-party websites, and we do not build advertising profiles.

8. Data Sharing

We do not sell your personal data to third parties. We share your data only in the following limited circumstances:

• With our service providers: As listed in Section 6 above, strictly for the purposes described and governed by Data Processing Agreements.
• Between Influencers and Partners: When an Influencer books a deal with a Partner, limited profile information (name, profile picture, social media handles, tier) is shared with the Partner to facilitate the collaboration. Similarly, deal and business information is shared with the Influencer.
• Legal requirements: We may disclose your data if required to do so by law, regulation, legal process, or enforceable governmental request, including requests from Dutch tax authorities (Belastingdienst) or law enforcement.
• Business transfers: In the event of a merger, acquisition, reorganization, or sale of assets, your data may be transferred as part of that transaction. We will notify you of any such change and the choices you may have.
• Protection of rights: We may share data when we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.

9. International Data Transfers

Your data is primarily processed and stored within the European Economic Area (EEA). However, some of our third-party service providers are located in or process data in the United States or other countries outside the EEA.

For any transfer of personal data outside the EEA, we ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR. Specifically:

• EU Standard Contractual Clauses (SCCs): We have entered into Standard Contractual Clauses approved by the European Commission (Commission Implementing Decision (EU) 2021/914) with our US-based processors, including ScrapeCreators, Resend, Google, Expo / Firebase, and Vercel.
• Adequacy decisions: Where the European Commission has determined that a country provides an adequate level of data protection, transfers may be based on such adequacy decisions.
• Supplementary measures: Where necessary, we implement additional technical and organizational measures (such as encryption in transit and at rest) to ensure the transferred data remains protected.

You may request a copy of the relevant safeguards by contacting us at Info@fits-list.com.

10. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law. Below are our specific retention periods:

After the applicable retention period expires, data is permanently deleted or irreversibly anonymized. Where anonymization is applied, the anonymized data may be retained indefinitely for statistical and analytical purposes as it no longer constitutes personal data.

11. Your Rights Under the GDPR

Under the GDPR (and the Dutch UAVG), you have the following rights regarding your personal data. You may exercise these rights free of charge, unless your requests are manifestly unfounded or excessive.

• Right of access (Art. 15): You have the right to obtain confirmation as to whether or not we process your personal data, and to request a copy of that data along with information about the purposes, categories, recipients, and retention periods.
• Right to rectification (Art. 16): You have the right to have inaccurate personal data corrected and incomplete data completed. You can update most of your information directly in your account settings.
• Right to erasure (Art. 17): You have the right to request the deletion of your personal data ("right to be forgotten"). We will comply unless we are legally required to retain certain data (e.g., invoice data for 7 years under Dutch tax law).
• Right to restriction of processing (Art. 18): You have the right to request that we restrict the processing of your data in certain circumstances, for example while we verify the accuracy of your data following a rectification request.
• Right to data portability (Art. 20): You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format (e.g., JSON or CSV), and to transmit that data to another controller.
• Right to object (Art. 21): You have the right to object to processing based on our legitimate interests (Art. 6(1)(f)). We will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
• Right to withdraw consent (Art. 7(3)): Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of processing before the withdrawal. For example, you can disconnect your social media accounts, disable location services, or opt out of push notifications.
• Right not to be subject to automated decision-making (Art. 22): You have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal or similarly significant effects. Our tier classification is automated but does not produce legal effects; you may nonetheless request human review.

How to exercise your rights: Send an email to Info@fits-list.com with the subject line "GDPR Request". We may need to verify your identity before processing your request. We will respond within one month, as required by Article 12(3) of the GDPR. In complex cases, this period may be extended by two additional months, in which case we will inform you of the extension and the reasons for it.

Right to lodge a complaint: If you believe that we have not handled your personal data properly, you have the right to lodge a complaint with the Dutch Data Protection Authority (see Section 16 for details).

12. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, in accordance with Article 32 of the GDPR. These measures include:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS (Transport Layer Security) / HTTPS.
• Password hashing: User passwords are hashed using bcrypt with appropriate salt rounds. We never store passwords in plain text.
• JWT authentication: API access is secured with JSON Web Tokens (JWT) with appropriate expiration times.
• Role-based access control (RBAC): Access to data and administrative functions is restricted based on user roles (Influencer, Partner, Admin), ensuring users can only access data relevant to their role.
• File upload restrictions: Uploaded files are validated for type (whitelisted extensions only) and size limits to prevent malicious uploads.
• Infrastructure security: Our hosting providers (Supabase, Railway, Vercel) maintain enterprise-grade physical and network security, including firewalls, intrusion detection, and regular security patches.
• Regular updates: We keep our dependencies and infrastructure up to date with the latest security patches.

Despite these measures, no method of transmission over the Internet or electronic storage is completely secure. If you discover or suspect a security vulnerability or believe your account has been compromised, please contact us immediately at Info@fits-list.com.

13. Children's Privacy

FITS-LIST is not intended for use by individuals under the age of 18. We do not knowingly collect or process personal data from children under 18 years of age. If we become aware that we have inadvertently collected personal data from a person under 18, we will take prompt steps to delete such data from our systems.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at Info@fits-list.com so that we can take appropriate action.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal requirements, or the features of our Platform. When we make material changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify you by email or through a prominent notice on the Platform at least 14 days before the changes take effect
• Where changes affect processing based on consent, we will seek your renewed consent where required

We encourage you to review this Privacy Policy periodically. Your continued use of the Platform after the effective date of a revised policy constitutes your acceptance of the changes, except where additional consent is required by law.

15. Contact

If you have any questions about this Privacy Policy, want to exercise your data protection rights, or have concerns about how we handle your personal data, please contact us:

• Company: FITS-LIST by FITS Group (FitsList B.V.)
• Address: Kattegat 50-K, 9723JP Groningen, The Netherlands
• Email: Info@fits-list.com
• KvK: 97928534
• Country: The Netherlands

We aim to respond to all inquiries within 5 business days. For formal GDPR requests (access, rectification, erasure, etc.), we will respond within one month as required by law.

16. Supervisory Authority

If you are not satisfied with our response to your privacy concern, or if you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Dutch Data Protection Authority:

• Authority: Autoriteit Persoonsgegevens (Dutch Data Protection Authority)
• Address: Bezuidenhoutseweg 30, 2594 AV Den Haag, The Netherlands
• Website: https://autoriteitpersoonsgegevens.nl
• Phone: +31 (0)70 888 85 00

You may also lodge a complaint with the supervisory authority in your country of residence or place of work if this is different from the Netherlands, in accordance with Article 77 of the GDPR.