divain. squad
This Privacy Policy explains how Divain Team SL ("divain.", "we") processes the personal data of the content creators who join divain. squad, our creator programme. It covers the data we receive when you connect a TikTok, Instagram or YouTube account, what we need it for, who we share it with, how long we keep it and how you can delete it at any time.
The data controller is Divain Team SL (trading as "divain."), registered office at Ctra. Astorga-Pi, 34, 24710 Astorga, León, Spain. Privacy contact for the creator programme: thesquad@divainparfums.com.
We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
This policy applies to the divain. squad creator portal (web and mobile app) and to the team's internal panel. It does not apply to purchases you make as a customer in our online shops, which are governed by the privacy policy published in each shop, nor to the social networks themselves (TikTok, Instagram/Meta, YouTube/Google), which act as independent controllers with their own policies.
| Category | Data | Source |
|---|---|---|
| Account data | Full name, email address, password (stored only as a salted hash, never in clear), country of residence, interface language | You, when you register |
| Social profile data | Public name of the account you choose to connect, number of followers or subscribers, aggregate engagement metrics of your public posts (see section 4) | The platform or its public profile card, after checking that the account is yours |
| Programme data | Your discount/affiliate code, the status of your membership, balance generated and redeemed, sales attributed to your code (order number, amount and date — never the customer's identity), missions accepted and content links you submit, the outcome of the review of each mission content (approved, pending correction or rejected, with the reason), warnings, representations and suspensions, redemptions, raffle entries, appeal messages, and the record of your acceptance of the Terms and the Content rules (date, time, version and language) | You and our systems |
| Content you upload | The video and photo files you attach when delivering a mission that requires them, and the screenshot of your professional dashboard if you verify your Instagram by declaring your figures, with their name, size and format. They are kept in a private space that is not published anywhere and which only our team reaches through short-lived signed links. We never make them public on your behalf. | You |
| Store credit | The amount of balance you move to store credit, the date, the shop it goes to and your customer identifier in that shop | You and our systems |
| Communications | Programme emails we send you and your replies, in-app and push notifications | You and us |
| Device data (mobile app) | Push notification token, platform (iOS/Android), notification language | Your device, if you accept notifications |
| Technical logs | Date/time and technical diagnostics of connection attempts (e.g. an API error message), so that we can fix faults | Generated automatically |
We do not process special categories of data (health, beliefs, biometrics), we do not ask for identity documents and we do not collect payment card data (redemptions are paid in programme balance, not in cash).
To join divain. squad you connect a social account that belongs to you. In every case:
Integration: TikTok Login Kit. Permissions requested: user.info.basic and
user.info.stats.
| Field read | Permission | What we use it for | Stored? |
|---|---|---|---|
display_name | user.info.basic |
Identify your TikTok profile in your portal and in the team panel | Yes |
follower_count | user.info.stats |
Compare against the programme's minimum followers | Yes (the number) |
likes_count, video_count | user.info.stats |
Calculate an average engagement percentage for the admission check | Only the resulting percentage |
We do not request or read your videos, your video list, your comments, who you follow or your profile picture. You can withdraw our access at any time from TikTok: Profile → Menu → Settings and privacy → Security and permissions → Apps and services. divain. squad is not affiliated with or sponsored by TikTok.
Integration: none. We do not ask for access to your Instagram account or to any Meta account.
To check that an Instagram account is yours we give you a single-use verification code that you place for a moment in the name of your profile. We then read the public profile card — the same one Instagram shows to search engines so that the profile appears on Google — to check that the code is there and to note your username, your follower count and your number of posts, all of which that card already shows to anyone. As soon as we verify you, you can remove the code.
If that card is not available at the time, we offer you the option of declaring your username and followers yourself and attaching a screenshot of your Instagram professional dashboard. That screenshot is kept in the private space described in section 3, is reviewed by a person on our team and is not published anywhere.
We do not store any token and we have no access to your account, so there is nothing to revoke: to undo the connection use Disconnect in your portal profile. Instagram's Terms and Privacy Policy apply to your account.
Integration: none. We do not ask for access to your Google account: we do not use Google OAuth or the YouTube Data API. To check that a channel is yours we give you a single-use verification code that you paste into your channel description; we then read your channel's public page to check that the code is there and to note the channel name, subscribers and total views that the page already shows to anyone. As soon as we verify you, you can remove the code. We do not store any token and we have no access to your account, so there is nothing to revoke: to undo the connection use Disconnect in your portal profile. YouTube's Terms of Service and Google's Privacy Policy apply to your channel.
| Purpose | Data used | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Create and manage your creator account | Account data | Performance of the programme agreement (Art. 6(1)(b)) |
| Verify that your profile meets the programme requirements | Social profile data | Your express application / performance of the agreement (Art. 6(1)(b)) |
| Operate the programme: code, attributed sales, balance, missions, redemptions and raffles | Programme data | Performance of the agreement (Art. 6(1)(b)) |
| Review and approve mission content and check that it complies with the Content rules (advertising label, references to other brands, product claims, minors and third-party rights) | Programme data and content you upload | Performance of the agreement (Art. 6(1)(b)) and legitimate interest in complying with advertising law and protecting the brand (Art. 6(1)(f)) |
| Evidence your acceptance of the Terms and the Content rules and the outcome of reviews, in order to handle complaints and defend our rights | Programme data | Legitimate interest in defending divain.'s rights (Art. 6(1)(f)) |
| Service emails and push notifications about your account, missions and rewards | Account, device and programme data | Performance of the agreement (Art. 6(1)(b)); for optional promotional messages, your consent (Art. 6(1)(a)), revocable at any time |
| Show the squad leaderboard to other creators | Only your public name (your social username, which is already public) and activity figures: posts, likes, missions and active weeks. Never your balance, your sales or your commissions, which nobody sees but you and our team. You can leave the leaderboard from your profile in the portal or by writing to thesquad@divainparfums.com | Legitimate interest in keeping the programme lively (Art. 6(1)(f)) |
| Prevent fraud and abuse of the programme (leaked codes, simulated purchases, etc.) | Programme data | Legitimate interest in protecting the programme (Art. 6(1)(f)) |
| Keep tax and accounting records where rewards have economic value | Account and programme data | Legal obligation (Art. 6(1)(c)) |
| Fix technical faults and keep the service secure | Technical logs | Legitimate interest (Art. 6(1)(f)) |
Admission to the programme is decided automatically: when you connect your network we compare your follower count and your engagement percentage against the thresholds published at registration. If your profile meets them, your account is activated and your personal code is created; if it does not, your application is rejected and you receive an email explaining which requirement was not met.
This is automated processing within the meaning of Art. 22 GDPR. It produces no legal effects on you beyond admission to a voluntary rewards programme and you always have the right to human review: both the rejection email and the portal include an appeal form where you can explain your case, and a person on our team reviews it manually and replies. You can also challenge the decision by writing to thesquad@divainparfums.com.
Where you declare your Instagram figures with a screenshot, the decision is never automated: it is always made by a person. And the review of mission content is always carried out by a person on our team against a checklist; it is not an automated decision.
We do not sell your personal data and we do not share it with data brokers, ad networks or unrelated third parties. We use the following providers (processors), acting on our instructions and under a signed processing agreement:
| Provider | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, authentication and the portal's server functions | EU (Frankfurt region) / USA |
| Vercel Inc. | Hosting and delivery of the web portal | EU / USA |
| Shopify International Ltd. | Creating your discount code, attributing orders and shipping redemptions | EU / Canada |
| Resend Inc. | Sending the programme's emails | EU / USA |
| Google Ireland Ltd. (Firebase Cloud Messaging) | Delivering push notifications in the mobile app | EU / USA |
| Anthropic PBC | Automatic translation of mission and notification texts into the programme's languages (text only; no creators' personal data is included) | USA |
We also disclose data where the law requires it or to defend our rights. The social networks (TikTok, Meta, Google) receive only the authorisation request you initiate, where there is one; as regards the data they hold about you they act as independent controllers.
Some of the above providers may process data outside the European Economic Area. In those cases the transfer relies on the European Commission's Standard Contractual Clauses or on an adequacy decision, together with supplementary technical measures (encryption in transit and at rest). You can ask us for a copy of the safeguards applied.
| Data | Retention |
|---|---|
| Account and social profile data of active creators | While you are part of the programme |
| All personal data after leaving or after a deletion request | Deleted within 30 days, unless there is a legal obligation to keep it longer and except for the records listed in this table |
| Rejected applications | 12 months (so that we can handle an appeal or a new application) and then deleted or anonymised |
| Records of rewards with economic value (tax/accounting) | Up to 6 years, under Spanish law, with restricted access |
| Records of acceptance of the Terms and the Content rules and of content reviews (date, reviewer, outcome and reason) | Up to 5 years from leaving, with restricted access, in order to evidence compliance and handle complaints |
| Content files you upload in missions | While you are part of the programme and up to 24 months from submission, which is the term of the licence set out in the Terms (clause 8). If you withdraw your authorisation for future uses, we stop using the file and delete it within 30 days, unless we have to keep it to handle a claim. You can ask us to delete a specific file at any time by writing to thesquad@divainparfums.com |
| Technical error logs | 90 days |
| Push notification tokens | Until you uninstall the app, turn notifications off or the token expires |
Data is transmitted over HTTPS/TLS and stored encrypted at rest. Access is restricted by row-level security policies, so that each creator can only read their own records; team access is limited to authorised divain. accounts and is logged. Passwords are stored only as a salted hash. Network access tokens are not stored. We keep no copies of your data outside the providers in section 7.
You can exercise free of charge and at any time your rights of access, rectification, erasure, restriction of processing, objection, portability, withdrawal of consent and the right not to be subject to decisions based solely on automated processing (see section 6).
To exercise them, write to thesquad@divainparfums.com from your registered email address, or send your request by post to Divain Team SL, Ctra. Astorga-Pi, 34, 24710 Astorga, León, Spain. We reply within one month. If you are not satisfied, you can complain to the Spanish Data Protection Agency (AEPD), www.aepd.es, or to the supervisory authority in your country.
divain. squad is only for people aged 18 or over. We do not knowingly process minors' data. If we find that an account belongs to a minor, we delete it together with its data.
The portal uses only strictly necessary storage: a session token to keep you signed in and a local preference with your language. We do not use advertising or third-party tracking cookies, and we do not build profiles for advertising purposes. The mobile app stores a notification token if you agree to receive them; you can withdraw it at any time from your device settings.
We may update this policy to reflect changes in the programme or in the law. The version in force is always published at this address with its date of entry into force, and material changes are notified by email or within the portal before they take effect.
Divain Team SL · Ctra. Astorga-Pi, 34, 24710 Astorga, León, Spain · thesquad@divainparfums.com