Privacy policy for OHMYBITZ and its forms.

1. Who this policy applies to

This policy covers two groups of people, and they are not treated the same way because they do not provide the same data.

• Anyone who writes through a form. The brand or the agency asking about a campaign, the company asking about a training program, the organizer who wants somebody on their stage, the outlet on deadline and the creator who sends in a profile to ask for representation.
• The creator the site publishes. Every profile in the roster contains personal data about an identified person. Section 13 of this policy deals with those creators alone.

If you only read the site, OHMYBITZ collects no personal data about you and builds no browsing profile. The only cookie the site writes stores the language you chose, two letters that do not identify you, and the visitor count measures how many people open each page without assigning you any identifier, as the cookie policy explains and section 3 details. The only exception is opening a page with a form, because that page also loads the anti-abuse check in section 3 as soon as it opens, even if you never send anything.

2. Data controller

The controller is OHMYBITZ MANAGEMENT LLC, with its address at 150 SE 2nd Ave STE 1403 #6495, Miami, Florida 33131, United States of America.

Contact address for everything relating to personal data, including the exercise of rights: privacy@ohmybitz.com. It is a mailbox dedicated to this subject, and it reaches the person who handles it without going through the commercial channel.

The house has no establishment, branch or staff in the European Union or in any Latin American country. It has not appointed a data protection officer, because its activity does not meet the conditions that make one mandatory.

3. What data is processed

What you type into a form. First and last name, email address, company or organization and the free text of your message, always. And depending on the form: your company website, which product is being promoted, the goal of the campaign, the format you are interested in, the date window, the reference budget range, the size of your team, the name and the type of the event, the city and the country of the venue, the expected audience, the outlet and the deadline, and, in the representation form, your channels, your stated audience, the address of your media kit and the topics and the categories you work in.

What you choose to check. Your acceptance of this policy, which is required for the form to be sent, and your consent to receive commercial communications, which is optional and sits in a separate checkbox.

The creator data the site publishes. Public name, portrait, country of residence, active channels, audience and demographic figures stated in the media kit, topics the creator works in, formats the creator accepts, credentials awarded and, if the creator takes part, the type of event that fits. Section 13 sets this out in detail.

The technical data of the submission. When a form comes in, the server keeps a minimal record that the submission happened and whether it was delivered. That record does not contain your name, your email address, your IP address or the content of your message. To stop automated submission, the caps on submissions per hour process a value derived from your IP address and not the address itself, temporarily and in a way that does not allow the address to be reconstructed.

The data from the anti-abuse check on the form. Before you send it, the form runs a Cloudflare check that confirms there is a person and not a program on the other side. For that check, Cloudflare processes your IP address, technical characteristics of your secure connection and the headers your browser sends, and returns a single-use result to the server of OHMYBITZ, valid or not valid. The check does not store anything on your device, does not create an identifier that follows you across sites and does not build a profile of you. OHMYBITZ receives none of that technical data, only the result.

The data from the visitor count. Every page loads a Cloudflare measurement that counts how many times each page is opened. With each visit the provider receives the address of the page, the address of the page you came from if there was one, the type of browser and device, the loading times and, to work out the country, your IP address, which it processes technically and does not use to identify you or to recognize you on another visit. It stores nothing on your device and assigns you no identifier. OHMYBITZ receives aggregate statistics per page, country and device, never data about a person.

The hosting provider also keeps its own access logs, which do include the IP address, for the purpose of operating and protecting the infrastructure.

OHMYBITZ does not process special categories of data. It does not ask for or want data on health, ethnic origin, religion, political opinions, trade union membership, sex life, biometric data or genetic data, and no identity document numbers or card or bank account data either. If you write any of that data in the free text field, it is removed from the record.

4. What they are used for and on what legal basis

Answering your inquiry and preparing a proposal. Legal basis: your consent, which you give by ticking the mandatory box on the form, and the performance of pre-contractual measures requested by you. It is the main purpose and without it the form has no point.

Assessing the fit with a creator on the roster. When the inquiry is about a specific person, OHMYBITZ shares with that creator what is necessary for them to confirm their availability and their interest. Legal basis: the same pre-contractual measure and the representation agreement with the creator.

Sending you commercial communications and creator profile presentations. Legal basis: your consent, given in a separate, optional box. Section 5 explains it and says how to withdraw it.

Assessing a profile that asks for representation. Legal basis: your consent and the pre-contractual measures you request by sending it.

Publishing and maintaining a creator profile. Legal basis: the performance of the representation agreement or of the commercial agreement that allows OHMYBITZ to present that creator, and the legitimate interest of both parties in that profile reaching brands and event organizers.

Protecting the forms from spam and abuse. Legal basis: the legitimate interest of OHMYBITZ in keeping its channel of contact working.

Measuring how many people visit the site and which pages they read. Legal basis: the legitimate interest of OHMYBITZ in knowing whether the site does its job, through a measurement that stores nothing on your device and does not identify you, described in section 3.

Complying with legal, accounting and tax obligations, and responding to requests from a competent authority. Legal basis: compliance with a legal obligation.

OHMYBITZ does not use your data for any purpose other than these. It does not sell them, it does not rent them, it does not pass them to a third party so that party can offer you its own products, and it does not use them in behavioral advertising.

5. The mailing list and how to leave it

On the brand form, the per-creator quote form, the mass audience form and the events form there is an optional box, left unticked. If you tick it, your name and your email address go into the campaign sending tool OHMYBITZ uses, together with four markers: that the sign-up came from the site, which of those four forms it came from, which creator you were asking about if you were asking about anyone, and the date and the version of the text you accepted, which is the proof that you gave that permission. No other data from your inquiry goes into that list.

What you will receive are creator profile presentations, roster news and commercial communications related to the activity of OHMYBITZ. Nothing more.

The box is independent of sending the form. If you do not tick it, your inquiry is sent all the same and your data are used only to reply to you. Making a reply conditional on accepting advertising would not be freely given consent, and that is why there are two boxes and not one.

You may withdraw that consent at any time, without giving reasons and at no cost, from the unsubscribe link carried by every mailing or by writing to privacy@ohmybitz.com. The unsubscribe takes effect immediately and does not affect the reply to your inquiry.

The creator representation form and the press form are outside that list and do not offer that box.

6. Who else sees your data

OHMYBITZ names its providers one by one, because a list of generic categories does not let you know where the data ends up.

• EnvíaloSimple Transaccional, an Argentine transactional email delivery service, which is what carries the content of the form to the OHMYBITZ mailbox.
• EnvíaloSimple Marketing, from the same provider, only if you ticked the optional box. It is where the mailing list lives.
• Cloudflare, a United States provider that supplies the form's anti-abuse verification and the visitor count. It receives the technical data described in section 3 and returns a result or a statistic; it does not receive any data you type into the form.
• The site's hosting provider, which operates the server where the form is received and keeps the access logs.
• The creator you are asking about, when the inquiry is about a specific person, so that they can confirm availability and interest. In the comedy and entertainment segment, whoever handles the relationship with that creator.
• The legal, accounting and tax advisors of OHMYBITZ, when an inquiry turns into an agreement and only as far as that agreement requires.
• A competent authority, when there is a legal obligation to hand over the information.

Each provider processes the data on behalf of OHMYBITZ, under instructions and without using it for its own purposes. The only two third-party components the site loads are the visitor count and the anti-abuse verification, the latter only on the pages that have a form. Neither has an advertising purpose and neither builds profiles. No advertising platform and no social network receives anything merely because you visit a page. The cookie policy says what is on the site today and what would be needed if that changed.

7. International transfers

OHMYBITZ is located in the United States of America, so processing your data involves an international transfer as soon as you write from another country. The data is processed in the United States of America by OHMYBITZ and by the provider of the anti-abuse verification and the visitor count, and in Argentina by the email provider.

Argentina holds an adequacy decision from the European Commission, so the transfer to the email provider does not require additional safeguards for data leaving the European Economic Area.

The United States of America does not hold a general adequacy decision. When your data comes from the European Economic Area, the transfer to OHMYBITZ relies on the explicit consent you give by ticking the mandatory checkbox on the form, after reading this policy. That consent can be withdrawn at any time, and withdrawing it means that OHMYBITZ will stop processing your data and will not be able to continue the conversation through that channel.

The United States of America does not hold a declaration of adequate level of protection from Argentina or from Colombia either. For those countries the transfer likewise relies on your consent, described in this policy and collected on the form.

The anti-abuse verification and the visitor count are the case that works differently, and it is worth stating precisely. They run when the page opens, that is, before you tick any checkbox, so they do not rest on your consent. They rest on the legitimate interest of OHMYBITZ, which is section 4. The technical data they process is in section 3, it does not include anything you write and it is not used to identify you. The transfer to that provider relies on the contractual safeguards that provider offers for international transfers.

8. How long data is kept

A verifiable period says more than the formula of keeping data for as long as the liabilities arising from the processing last, so here they are with a number.

• An inquiry that goes no further. Twenty-four months from the last message exchanged, and after that it is deleted.
• An inquiry that turns into an agreement. For the term of the agreement and up to six years after it ends, which is the period that covers the applicable accounting, tax and limitation obligations.
• Mailing list. Until you unsubscribe. The record of the subscription and of the unsubscription is kept for twelve months longer, which is the proof that the consent existed and that the withdrawal was acted on.
• Technical log of submissions. Twelve months.
• A profile sent to ask for representation that goes no further. Twelve months from the reply.
• A creator's profile. For as long as the relationship that allows it lasts. When it ends, the profile is taken down from the site.

9. Your rights and how to exercise them

You may exercise the following rights over your data at any time and free of charge.

• Access. To know whether OHMYBITZ processes data about you and to obtain a copy, with the detail of the purposes, the recipients and the retention period.
• Rectification. To correct inaccurate data or complete data that is incomplete.
• Erasure. To ask that it be deleted, when it is no longer necessary for the purpose that justified it or when you withdraw your consent.
• Objection. To object to processing based on the legitimate interest of OHMYBITZ, and in any case to object to receiving commercial communications.
• Restriction. To ask that it be kept without being used, while a challenge to its accuracy or to the lawfulness of the processing is resolved.
• Portability. To receive, in a structured and commonly used format, the data you provided, and to ask that it be transmitted to another controller.
• Withdrawal of consent. To withdraw it without giving reasons, without that affecting the lawfulness of the earlier processing.
• Complaint to the supervisory authority of your country. Section 14 says which one applies in each case.

To exercise them, write to privacy@ohmybitz.com stating which right you are exercising and which country you are writing from, so that OHMYBITZ applies the time limit that corresponds. OHMYBITZ will ask only for the minimum piece of information that allows it to confirm the request is yours, which as a general rule is the same email address you wrote from, and will ask for an identity document only if there is reasonable doubt about who is making the request.

OHMYBITZ answers within one month of receiving the request, and where the regulations of the country in which you reside set a shorter period, that one applies. Section 14 says which one applies in each case.

OHMYBITZ does not require you to give reasons for an erasure request. That requirement reverses the burden that the regulations place on the controller.

10. Automated decisions and editorial classification

OHMYBITZ does not make automated decisions that produce legal effects on you, and it does not build profiles with your data.

The site does group creators by topic, by format and by type of event, based on what each one states. It is an editorial classification, a person reviews it before it is published and it produces no legal effect on anyone. It is not a system that evaluates people or decides about them.

11. Security and incident notification

The site is served over an encrypted connection. The credentials and the configuration of the services involved in sending are not accessible from the site. The forms include integrity checks and usage limits to stop automated sending. OHMYBITZ reviews these measures when its infrastructure changes, and does not publish their detail because describing them would help to get around them.

No measure removes the risk entirely. If a security incident occurs that affects your data, OHMYBITZ will notify the competent supervisory authority and, when the incident may involve a high risk to your rights, you as well, within the shortest period the rules applicable to your case require, and in any event without undue delay.

12. Minimum age

The site is aimed at professionals. To submit a form you have to be of legal age in your country of residence, and in every case at least eighteen years old. OHMYBITZ does not knowingly collect data from minors. If it detects that a submission comes from a minor, it deletes that data.

13. The data of the creators on the roster

This section is addressed to the creators the site publishes, and it is the largest processing operation OHMYBITZ carries out.

What is published and where it comes from. Public name, portrait, country of residence, active channels, audience and demographic figures, topics, formats accepted, awarded credentials and the type of event the creator fits. All of it comes from the creator's media kit and from what the creator stated to OHMYBITZ. OHMYBITZ does not estimate any data. What a creator did not state is not published.

On what basis. Performance of the representation agreement or of the commercial agreement that allows OHMYBITZ to present that creator, together with the legitimate interest of both parties in that creator's profile reaching whoever is hiring.

Purpose limitation. That data is used to present the creator's profile to brands, agencies, event organizers and media outlets, on the site, in a commercial proposal and in an OHMYBITZ media kit. It is not transferred to a third party for any other purpose without the creator's written authorization.

The figures are stated by the creator. OHMYBITZ publishes them with their source shown in the profile and does not guarantee them. A creator can ask at any time for them to be updated with a more recent cutoff.

Taking down a photo or correcting a piece of data. Write to privacy@ohmybitz.com. OHMYBITZ corrects or removes the item and publishes the site again. If the relationship ends, the whole profile is taken down.

A creator who chooses not to be on display. A creator can ask for one specific piece of their data not to be published, or to be left out of part of the site. Writing to the same address is enough.

14. Additional information by country

OHMYBITZ applies the same catalog of rights set out in section 9 to everyone. What changes from one country to another are the deadlines, the procedure and the authority in charge of this matter, so this section brings them together for the countries where OHMYBITZ is in regular contact.

This section is informative and describes how OHMYBITZ works. The law applicable to this site and to the relationship with OHMYBITZ is that of the State of Florida, United States of America, under the terms of the legal notice. That OHMYBITZ recognizes the rights of a country and applies its deadlines is its own decision about how it serves the person who writes in, and not a statement about which rules bind it.

• Spain and the European Economic Area. To anyone writing from the European Economic Area OHMYBITZ recognizes the rights of Reglamento (UE) 2016/679 and applies its deadlines: one month from the request, extendable by two further months when the request is complex, with notice to you of the reason. You may lodge a complaint with the Agencia Española de Protección de Datos, at aepd.es, or with the authority of your Member State. OHMYBITZ has no establishment in the European Union and has not appointed a data protection officer.
• Argentina. To anyone writing from Argentina OHMYBITZ recognizes the rights in section 9 and applies the procedure of Ley 25.326 and of its Decreto 1558/2001. That law sets shorter deadlines than the general ones: ten calendar days for access, and five business days for rectification, updating or erasure. Access is free of charge at intervals of no less than six months, unless you show a legitimate interest, in accordance with its article 14, subsection 3. The supervisory authority in Argentina is the Agencia de Acceso a la Información Pública.
• Colombia. To anyone writing from Colombia OHMYBITZ applies the procedure of Ley 1581 de 2012 and of Decreto 1074 de 2015, which compiled Decreto 1377 de 2013. A query is handled within a maximum of ten business days, extendable by five further business days, and a claim within a maximum of fifteen business days, extendable by eight further business days. You may consult your data free of charge at least once per calendar month. The supervisory authority in Colombia is the Superintendencia de Industria y Comercio, through its Delegatura para la Protección de Datos Personales, at sic.gov.co.
• Mexico. Mexican law calls for a document with a name and a form of its own, so for data subjects located in the United Mexican States OHMYBITZ publishes its Aviso de privacidad (privacy notice) on a separate page. That is where the ARCO rights, their deadlines, the transfers and the authority are set out.
• United States of America. OHMYBITZ recognizes the rights in section 9 for any resident who exercises them, whatever the state they write from. It does not sell or share personal data for behavioral advertising purposes, in the sense that state privacy laws give those terms, and for that reason the site does not publish a mechanism for opting out of sale: there is no sale to opt out of. Nor does the site respond to the browser do-not-track signal, because it carries out no tracking that such a signal could stop.

If you reside in another country, write to privacy@ohmybitz.com all the same. OHMYBITZ will handle your request with the catalog in section 9 and within the time limit set by the rules of your country or, failing that, within one month.

15. Changes to this policy

The house may update this policy when the site, its activity, a provider or the applicable regulation changes. The version in force is always the one published at this address.

The panel above carries two dates, and they are not the same thing. In effect since is the date the text you are reading came into force, and it only changes when the text changes. Reviewed is the last time the house read it through to check it is still correct, and that one changes even when nothing needed changing.

A change that materially affects your rights, or that introduces a new purpose, is announced on the site before it takes effect, and where that purpose requires consent it will be requested again. A change of this kind is never applied retroactively to data already collected.

Spanish is the reference language of this document. Any version in another language is interpreted by reference to the Spanish text.