Privacy Policy

1. Controller

The controller responsible for data processing on this website (Art. 4 No. 7 GDPR) is:

[YOUR FULL NAME / LEGAL ENTITY NAME], [YOUR STREET ADDRESS, POSTAL CODE, CITY, COUNTRY]. Email: [YOUR CONTACT EMAIL].

2. Overview of processing

UGC Arbitration operates an online platform for the resolution of disputes between UGC creators and agencies or brands by way of arbitration. To provide this service, we process personal data of registered users, including account holders, claimants, respondents, and — where applicable — appointed arbitrators.

This privacy notice explains what personal data we collect, why, on what legal basis, how long we keep it, and what rights you have under the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

3. Data we process and purposes

Account data: name, email address, password (stored as a salted hash), and account role. Processed to create and administer your account (Art. 6(1)(b) GDPR).

Case data: statements of fact, evidence you upload (contracts, correspondence, screenshots), the disputed value, and any written submissions or clarifications. Processed to conduct the arbitration proceeding you or a counterparty initiated (Art. 6(1)(b) GDPR).

Payment data: filing and final fees are processed via our payment provider, Stripe. We do not store full card numbers on our own servers; Stripe processes this data as an independent controller or processor under its own privacy terms (Art. 6(1)(b) GDPR).

Communications data: emails we send you regarding case status, deadlines, and account notices are sent via our email provider, Resend (Art. 6(1)(b) and, for optional updates, Art. 6(1)(a) GDPR).

Technical and log data: IP address, browser type, access times, and similar data generated automatically when you use the platform, processed on the basis of our legitimate interest in operating a secure and functional service (Art. 6(1)(f) GDPR).

4. Legal basis for processing

Where processing is necessary to perform the arbitration agreement between the parties or to take steps prior to entering into it, we rely on Art. 6(1)(b) GDPR.

Where processing is necessary to comply with a legal obligation, such as retention requirements under German commercial or tax law, we rely on Art. 6(1)(c) GDPR.

Where processing serves our legitimate interest — for example, ensuring platform security, preventing fraud, or defending legal claims — we rely on Art. 6(1)(f) GDPR.

Where you have given consent, for example to receive optional communications, we rely on Art. 6(1)(a) GDPR. You may withdraw consent at any time with effect for the future.

5. Recipients and processors

We share personal data with service providers who process it on our behalf under Art. 28 GDPR data processing agreements, including: Supabase (database hosting and authentication), Vercel (application hosting), Stripe (payment processing), and Resend (transactional email).

Case data is disclosed only to the parties to that case and to the arbitrator assigned to it. We do not sell personal data or share it with third parties for advertising purposes.

Some of our processors may process data outside the European Economic Area (EEA). Where this occurs, we rely on appropriate safeguards under Art. 44 et seq. GDPR, such as the EU Standard Contractual Clauses.

6. Storage duration

Account data is retained for as long as your account is active, plus a reasonable period thereafter to address any follow-up queries or legal claims.

Case data, including awards, is retained for the statutory limitation and retention periods applicable under German law, generally up to ten (10) years, to preserve the enforceability and evidentiary value of arbitral awards under § 1060 ZPO.

Payment records are retained in accordance with statutory commercial and tax retention obligations (typically six to ten years under §§ 147 AO, 257 HGB).

7. Your rights

Under the GDPR, you have the right to: access your personal data (Art. 15); request rectification of inaccurate data (Art. 16); request erasure (Art. 17), subject to our retention obligations described in Section 6; request restriction of processing (Art. 18); receive your data in a portable format (Art. 20); and object to processing based on legitimate interest (Art. 21).

To exercise any of these rights, contact us at the email address given in Section 1. We will respond within the timeframes required by Art. 12 GDPR.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement. The supervisory authority for our registered location is the [NAME OF COMPETENT DATA PROTECTION AUTHORITY, e.g. Der Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)].

8. Cookies and technical data

We use only those cookies and similar technologies that are strictly necessary for the operation of the platform, such as session and authentication cookies. These do not require consent under § 25(2) TTDSG. We do not currently use analytics, tracking, or marketing cookies. [Update this section if analytics or marketing tools are added.]

9. Data security

We implement technical and organizational measures to protect personal data against unauthorized access, loss, or misuse, including encryption in transit, access controls, and row-level security on our database. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Changes to this notice

We may update this privacy notice from time to time to reflect changes in our processing activities or legal requirements. The version published on this page at the time of your use of the platform applies.