Legal
Privacy policy
Last updated: 30 October 2026
This is a translation for convenience. The Spanish version prevails.
This policy explains how we process your personal data under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. Controller
Marc Nebot i Moyano (Daoto), Barcelona, España. Contact: marc@daotoagency.com.
2. Data we process
- Brand form: name, email, company, website, market, services, number of creators, budget, timing and message.
- Creator form: name, email, city, platform, profile link, category, audience size, languages and additional information.
- Emails you send us directly.
We do not ask for special categories of data and do not process data of people under 18.
3. Purposes and legal basis
| Purpose | Legal basis |
|---|---|
| Replying to a brand's request and preparing a plan and quote. | Pre-contractual steps at your request (art. 6.1.b GDPR). |
| Reviewing a creator's profile and contacting them about suitable campaigns. | Consent (art. 6.1.a GDPR), which you can withdraw at any time. |
| Managing the contract and meeting legal obligations (e.g. tax) if we work together. | Contract and legal obligation (art. 6.1.b and 6.1.c GDPR). |
We do not make automated decisions or profiling with legal effects.
4. Retention
- Brand requests that don't lead to a contract: up to 12 months.
- Creator applications: until you withdraw consent, and at most 24 months after the last contact.
- Clients and collaborators: for the duration of the relationship and the legal limitation periods.
5. Recipients
We do not share your data with third parties unless legally required. When we propose a creator to a brand for a specific campaign, we share their profile data with that brand only after the creator agrees.
We use these processors:
- Vercel Inc. (web hosting, USA), under the EU-US Data Privacy Framework and standard contractual clauses.
- Zoho Corporation (email, data hosted in the EU).
- Web3Forms (delivering form submissions to our inbox), which may involve international transfers with the safeguards described in its privacy policy.
If you accept cookies, TikTok processes data when loading its videos as an independent controller, under its own privacy policy.
6. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw consent at any time, by emailing marc@daotoagency.com. We will reply within one month. You can also file a complaint with the Spanish Data Protection Agency (www.aepd.es).
7. Security
We apply appropriate technical and organisational measures, such as HTTPS encryption and restricted access.
8. Changes
We may update this policy. The date of the last update is shown at the top of the page.