1. WHO WE ARE

This Privacy Policy applies to Cre8itApp (CRE8 IT. MEDIA), including the CRE8 IT. MEDIA website at cre8it.media, customer portal and connected social-media features. Cre8itApp is the application name used for our social-media integrations and is operated by TOFE EVENTOS, NIF/CIF B56247943, with its registered address at Paseo del Castillo 16, Ojén, Málaga, Andalucía 29610, Spain. CRE8 IT. MEDIA provides digital marketing, creative, advertising, website and social-media technology services.

For personal data processed through Cre8itApp, cre8it.media and CRE8 IT. MEDIA services, TOFE EVENTOS is the data controller unless we state otherwise. Privacy enquiries can be sent to hello@cre8it.media.

2. DATA WE COLLECT

We may collect information you provide directly, including your name, business name, email address, telephone number, website, campaign information, brand assets, uploaded files, enquiry details and information submitted through CRE8 forms or the customer portal.

When you create or use a CRE8 account, we may process account identifiers, authentication information, business-profile information, preferences and records needed to provide the service.

We may also collect technical information such as IP address, browser or device information, pages viewed, referring pages, approximate location, cookie identifiers and interaction or conversion data where permitted.

3. CONNECTED SOCIAL-MEDIA ACCOUNTS

CRE8 may allow you to connect third-party social-media accounts, including Facebook, Instagram and TikTok, using the relevant platform's official authorisation or OAuth process.

Depending on the permissions you approve, we may receive and process account or page identifiers, usernames, display names, profile images, public profile information, posts or videos, captions, media metadata, engagement or performance information, access tokens, refresh tokens, token expiry information and granted permissions.

We use connected-account data only for the CRE8 features you request, such as displaying connected accounts, importing content, analysing social performance, producing recommendations and, where separately enabled and authorised, scheduling or publishing content.

CRE8 does not ask you to provide your social-media password. Authentication is handled by the relevant social-media platform.

You can revoke CRE8's access through the relevant platform's account or application settings and, where available, through CRE8 account controls.

4. FACEBOOK & INSTAGRAM

If you connect Facebook or Instagram, CRE8 may use authorised services and APIs supplied by Meta Platforms to access information that you have specifically permitted CRE8 to access.

Depending on the permissions granted and CRE8 features being used, this may include Facebook Page information, Instagram professional-account information, account identifiers, usernames, profile information, posts, media, captions, engagement information and related performance data.

Access credentials and tokens required to maintain authorised connections are handled through CRE8's server-side infrastructure and are not intended to be exposed publicly through the CRE8 website.

Removing CRE8 from your Meta account or revoking the relevant permissions will prevent future authorised access, subject to information that CRE8 may be required to retain for legal, security or compliance purposes.

5. TIKTOK

If you connect TikTok to Cre8itApp (CRE8 IT. MEDIA), Cre8itApp may use TikTok's official Login Kit, Display API, Content Posting API or other authorised TikTok developer services, depending on which CRE8 features are available and which permissions you approve.

Depending on the permissions granted, Cre8itApp (CRE8 IT. MEDIA) may process TikTok account identifiers, display names, usernames, profile images, profile information, public videos, video metadata, captions, engagement information, access tokens, refresh tokens and related authorised account information.

Cre8itApp may use this information to display your connected TikTok account within CRE8 IT. MEDIA, import authorised content, analyse content and performance, generate marketing recommendations and, where separately enabled and expressly authorised, support content publishing or scheduling.

You may revoke Cre8itApp's TikTok access through TikTok's account or application settings. Cre8itApp and CRE8 IT. MEDIA will respect applicable TikTok developer requirements concerning authorised data, access and deletion.

6. AI SOCIAL AUDIT & AUTOMATED PROCESSING

Where you use CRE8's AI Social Audit or related tools, connected social content and performance information may be analysed using automated or artificial-intelligence systems.

This processing may be used to identify patterns and generate marketing observations, summaries, creative ideas, performance insights or recommendations.

AI-generated outputs are intended to assist business and marketing decisions. They are not guaranteed predictions of future performance and should be reviewed before being relied upon.

CRE8 does not use solely automated processing to make legal or similarly significant decisions about you.

7. HOW WE USE PERSONAL DATA

We may process personal data to provide and secure CRE8 services; create and manage accounts; respond to enquiries; fulfil requested services; maintain authorised integrations; import and analyse content; provide reports and recommendations; process transactions; prevent misuse; troubleshoot problems; improve our products and services; comply with legal obligations; and communicate with you about your account or requested services.

Where you have given the appropriate consent, we may also send CRE8 news, creative ideas, offers, VIP or membership communications and other marketing.

You can withdraw marketing consent at any time.

8. LEGAL BASES FOR PROCESSING

Under the General Data Protection Regulation (GDPR) and other applicable European data-protection law, the legal bases on which we process personal data may include performance of a contract, steps requested before entering into a contract, compliance with legal obligations, our legitimate interests in operating and improving CRE8, and your consent where consent is required.

Where processing relies on consent, you may withdraw that consent at any time without affecting processing that was lawful before consent was withdrawn.

9. SERVICE PROVIDERS & THIRD PARTIES

We may use trusted third-party service providers to host, secure and operate CRE8, process forms and email, provide databases and authentication, process payments, measure website performance, deliver communications and provide AI or technical functionality.

CRE8 currently uses or may use services including Framer for website delivery, Supabase for database and authentication infrastructure, Vercel for web functions or hosting, Resend or similar providers for transactional email, payment providers such as Stripe, and authorised APIs or developer services supplied by Meta and TikTok.

We may also use analytics, advertising and communications providers where those services are enabled and lawfully configured.

These providers process information according to applicable law, their own privacy terms and, where applicable, agreements entered into with CRE8.

CRE8 does not sell personal data.

10. SUPABASE & ACCOUNT DATA

CRE8 may use Supabase infrastructure for services including databases, authentication, user profiles, business profiles, connected-account records and other information required to operate CRE8 functionality.

Access to customer and business information is designed to be controlled through authentication, database permissions and other appropriate technical measures.

Sensitive third-party integration credentials should be processed and stored through appropriate server-side systems rather than exposed through public website code.

11. INTERNATIONAL DATA TRANSFERS

Some technology providers used by CRE8 may process or store information outside Spain or the European Economic Area.

Where required by applicable law, international transfers are made using recognised safeguards such as adequacy decisions, Standard Contractual Clauses or another lawful transfer mechanism.

12. DATA RETENTION

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, to provide CRE8 accounts or services, resolve disputes, maintain security and meet legal, regulatory, tax or accounting obligations.

Connected-platform tokens and imported social data may be deleted, expired or disconnected when an integration is removed, an account is closed, the information is no longer required, authorisation expires or applicable platform rules require deletion.

Certain records may need to be retained for legal, accounting, fraud-prevention or security purposes.

13. COOKIES, ANALYTICS & ADVERTISING

CRE8 may use essential cookies and similar technologies necessary to operate the website and customer services.

Subject to applicable consent requirements, CRE8 may also use analytics and advertising technologies to understand website use, measure conversions, improve marketing and evaluate advertising campaigns.

This may include technologies associated with providers such as Google, Meta or TikTok when those services are enabled.

Non-essential tracking technologies should only be activated in accordance with applicable consent requirements and your cookie choices.

14. MARKETING, CRE8 VIP & CRE8 CLUB

If you join a CRE8 mailing list, CRE8 VIP, CRE8 Club or another promotional or membership programme, we may process the contact details and preferences you provide to deliver relevant communications.

These communications may include creative ideas, advertising insights, CRE8 updates, member benefits, points or rewards information, events, training opportunities, offers and other CRE8 marketing.

Participation in marketing communications is optional. You can unsubscribe using the unsubscribe mechanism provided in marketing emails or by contacting CRE8.

Transactional or service communications relating to an active account, purchase, booking or service may still be sent where necessary.

15. WALLET PASSES & REWARDS

Where CRE8 Club, CRE8 VIP or related membership functionality includes an Apple Wallet or Google Wallet pass, CRE8 may process information necessary to create, personalise and update that pass.

Depending on the service, this may include a member name, business name, logo or profile image, membership identifier, tier, points balance, rewards, QR or barcode information and other membership-related information.

Wallet passes may be updated when relevant CRE8 membership information changes. Where supported and permitted, wallet services may also display notifications relating to pass updates, rewards or member benefits.

Wallet functionality may be delivered through an authorised third-party wallet-pass provider. Relevant information may therefore be shared with that provider only to the extent required to provide the requested wallet service.

16. YOUR DATA-PROTECTION RIGHTS

Depending on the circumstances and applicable law, you may have the right to request access to personal data CRE8 holds about you.

You may also have rights to correct inaccurate information, request deletion, restrict certain processing, object to certain processing, receive eligible information in a portable format and withdraw consent.

These rights are subject to applicable legal conditions and exemptions.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD) or another competent supervisory authority.

We encourage you to contact CRE8 first so that we can try to resolve your concern.

17. DELETING YOUR CRE8 DATA

You may request deletion of personal data associated with your CRE8 account by contacting hello@cre8it.media.

We may need to verify your identity before processing a deletion request in order to protect customer information from unauthorised deletion.

Following a valid deletion request, CRE8 will delete or anonymise eligible personal data unless retention is necessary to comply with a legal obligation, resolve a dispute, prevent fraud, maintain security or establish, exercise or defend legal claims.

18. DISCONNECTING SOCIAL ACCOUNTS

You may disconnect Facebook, Instagram or TikTok access by removing or revoking CRE8's permissions through the relevant platform and, where available, through CRE8 account settings.

Revoking access prevents CRE8 from making future requests using that authorisation.

Revocation does not necessarily delete information already lawfully processed or records that CRE8 is legally required to retain.

Where Meta, TikTok or another platform requires a dedicated user-data deletion process, callback or confirmation mechanism, CRE8 will process valid requests in accordance with the relevant platform requirements and applicable law.

19. SECURITY

CRE8 uses reasonable technical and organisational measures designed to protect personal data from unauthorised access, disclosure, alteration or loss.

Measures may include authenticated access, database access controls, secure server-side processing, encrypted connections and restricted handling of third-party access credentials.

No internet transmission, database or storage system can be guaranteed to be completely secure.

You are responsible for protecting your own account credentials and should contact CRE8 if you believe your account or connected services have been accessed without authorisation.

20. CHILDREN

CRE8's business, marketing and customer services are not directed to children.

We do not knowingly seek to collect personal data from children through CRE8's business customer services.

21. CHANGES TO THIS PRIVACY POLICY

CRE8 may update this Privacy Policy as our services develop, new integrations or technologies are introduced, or legal and regulatory requirements change.

The latest version will be published on this page. Where appropriate, we may also provide additional notice of material changes.

22. CONTACT

For privacy questions, requests to exercise your data-protection rights, data-access requests, deletion requests or concerns about CRE8's handling of personal data, please contact hello@cre8it.media.

Data Controller: TOFE EVENTOS, NIF/CIF B56247943, Paseo del Castillo 16, Ojén, Málaga, Andalucía 29610, Spain.