Privacy Policy

1. Data Controller

The Data Controller is:

Jimmy processes the personal data of users who use the platform as Data Controller, including but not limited to creating and managing accounts; providing the functionalities of the Platform; managing campaigns; complying with legal and accounting obligations; and ensuring the security of systems.

Where the User enters into the platform personal data of their own clients, partners or other third parties, the User acts as Data Controller of such data and undertakes to provide the data subjects with an appropriate privacy notice and, where necessary, obtain their consent. In relation to such processing, JIMMY acts as Data Processor pursuant to Art. 28 GDPR, on the basis of a specific Data Processing Agreement (DPA) governing the instructions of the Data Controller, security measures, any use of sub-processors and transfers of data to third countries. In such cases, the user appoints JIMMY as Data Processor for these purposes. By way of example and without limitation, the user acts as Data Controller when uploading the data of their own clients and directly managing campaigns and payments.

2. Purposes and Legal Bases

Jimmy is a platform that enables different categories of users (Brands, Creators, Agencies) to connect with each other to promote and establish collaboration relationships, based on commercial proposals and quotes drawn up through the service provided by the platform.

On the platform, therefore, some profile and contact data of users and information entered in collaboration proposals (for example description of the activity, economic conditions, duration and type of services, categories of interest) is disclosed to the other category of users, within the limits of the functionalities, visibility filters made available and the choices made by the user.

In the context of services provided by Jimmy, data may also be processed by AI systems used by the platform, to facilitate the matching between supply and demand of collaborations, such as, for example, to suggest profiles, projects or opportunities potentially in line with the interests or profile of the user, to sort and classify search results and content shown on the platform itself, to automatically analyze some information relating to the use of the service in order to optimize its operation and quality for the Data Controller.

Personal data is processed for the following purposes:

3. Personal Data Processed

In relation to the forms and contact channels linked to Jimmy, campaign management flows and Jimmy's communication channels, the following categories of data are processed:

• Personal and contact data, such as first and last name, stage name, pseudonym, residence or domicile, phone number, email address, any role, profession, activity, or type of user, links to social profiles, website or other information entered on the platform.
• Data relating to the professional activity of Brands and Creators, or tax data, such as VAT number, tax code, banking/IBAN data for the management of payments and collections, professional areas.
• Data relating to user consents and choices, including timestamps, version of accepted texts and technical proof of consent, where required.
• Technical browsing and log data, such as IP address, user agent, browser, device and operating system information, as well as data relating to errors, access and security.
• Data collected through cookies or equivalent tools, including analytics and marketing tools that may be activated, such as Google Analytics 4, Meta Pixel, PostHog and Microsoft Clarity.
• Third-party data: users may enter on the platform personal data of third parties (e.g. corporate contacts, collaborators, contacts of other parties involved in campaigns). In such cases the user guarantees that they have provided such third parties with adequate notice and have collected, where necessary, their consent, holding Jimmy harmless from any liability. Jimmy acts as Data Processor, while the user acts as Data Controller.

Within the context of the use of the forms and contact channels linked to Jimmy, the Data Controller does not request nor intend to process special categories of personal data (for example health data, political opinions, religious or philosophical beliefs, trade union membership, sexual orientation), unless such information is entered by the user entirely voluntarily in free-text fields.

In such cases, the Data Controller will process such information only if strictly necessary to manage the user's request and in compliance with the guarantees provided for by applicable law.

4. Informational Communications

JIMMY SRL may use the data provided by the user to send:

• service communications, strictly related to the user's request, registration on a waiting list, early access, progress status or technical/organizational updates relating to Jimmy;
• additional promotional communications, such as invitations to events, marketing initiatives, offers, commercial news, only within the limits permitted by applicable law and, where required, with the user's specific prior consent.

The user may at any time withdraw consent or object to receiving promotional communications, including when based on JIMMY's legitimate interest, using the link in the communications received (where available) or by writing to support@jimmy.love.

5. Cookies and Tracking Tools

To offer the best service, the site may use:

• technical cookies or equivalent tools necessary for the operation of the platform, the provision of the service requested by the user and site security;
• analytical or profiling cookies or other tracking tools (e.g. for analytics, session analysis, heatmap or marketing), including Google Analytics 4, Meta Pixel, PostHog and Microsoft Clarity.

Such tools are activated only with the user's express consent, collected through a cookie banner or equivalent systems, in compliance with applicable regulations.

Where session recording or heatmap functionalities are enabled, these are configured with field masking measures and data minimization to avoid unnecessary collection of information entered in forms.

More details on cookies and tracking tools used, their purposes and retention periods are available in a dedicated Cookie Policy, accessible from the banner or footer of the site.

6. Recipients and Transfers

Personal data may be communicated to:

• authorized Jimmy personnel, adequately trained and bound by confidentiality obligations;
• external suppliers who provide technical, organizational or professional services (supporting service management, e.g. hosting providers, email services, form management, analytics services, marketing, IT security, maintenance, banking and electronic payment services), appointed, where required, as Data Processors pursuant to Art. 28 GDPR;
• consultants and professionals in general, appointed as Data Processors;
• other category of Jimmy service users.

The Data Controller does not sell personal data of users, does not disclose it nor intend to transfer it to a third country or to an international organization.

Some service providers may be based or process data outside the European Economic Area. If, for technical or organizational reasons, personal data is transferred to countries outside the European Economic Area (EEA), the Data Controller ensures that the transfer takes place in compliance with Articles 44 et seq. GDPR, in particular: to countries for which there is an adequacy decision from the European Commission; or in the presence of adequate guarantees, such as standard contractual clauses adopted by the European Commission, possibly supplemented by additional security measures.

7. Data Retention

Personal data is retained for the time necessary for the purposes for which it was collected. In particular:

• data provided during registration on the platform and entered in the user profile (e.g. personal, contact and professional information) is retained for the duration of the contractual relationship and as long as the account remains active. In case of a request to delete the account or termination of the relationship, such data is deleted or anonymized within a reasonable time and, in any case, no later than 24 months from the end of the relationship, subject to further retention obligations provided by law or the need to retain data for the ascertainment, exercise or defense of a right in judicial proceedings;
• data collected through contact forms or waiting lists may be retained for the time necessary to respond to requests, to manage communications relating to the project, and, in any case for a maximum period of 24 months from the last useful contact, unless consent is withdrawn or a deletion request is made, and always provided that their further retention is not necessary to comply with legal obligations or to protect the rights of the Data Controller;
• technical logs are generally retained for a maximum period of 12 months, except for security needs, verification of offenses or legal obligations;
• backups are deleted or overwritten, where technically possible, approximately within 30 days;
• data collected through cookies and processed through consent-based analytics or marketing tools is retained according to the times indicated in the cookie policy, normally not exceeding 24 months, subject to any further storage in aggregate or anonymous form, or until consent is withdrawn;
• data relating to campaigns, contracts and relations between Brands and Creators is retained for the duration of the relationship and, subsequently, for the period necessary for the limitation of related rights, i.e. ten years;
• invoicing and accounting data is retained for the period required by tax and civil law, i.e. for ten years from processing.

The retention periods indicated above may be reduced if the user exercises their rights (e.g. withdrawal of consent or deletion request), unless further retention is necessary due to a legal obligation or for the protection of the Data Controller's rights in judicial or extrajudicial proceedings.

For data processed through analytics or marketing tools, the Data Controller undertakes, where possible, to configure such tools so as to limit retention periods to the standard periods indicated by the respective suppliers, avoiding retention exceeding the purposes pursued.

Data made visible to other Jimmy service members remains accessible to such parties for the time the user keeps their profile active and does not modify the relevant visibility settings, subject to the latter's right to request at any time the deletion of their account or the restriction of the visibility of specific information.

It remains understood that other members, once they have received the data, process it independently for their own legitimate purposes and according to their respective retention periods, each remaining directly responsible for compliance with applicable law.

8. Security and Processing Methods

JIMMY SRL adopts adequate technical and organizational measures to protect personal data, taking into account the nature of the processing actually carried out.

Such measures may include access control, limitation of authorized persons, backups, technical logging and measures to prevent unauthorized access, loss or improper disclosure of data.

Security measures are subject to periodic verification and updating in relation to the regulatory, technological evolution and risks associated with the processing carried out.

Processing is carried out, through paper, IT and electronic tools, by authorized and appointed persons, in compliance with the principles of fairness, lawfulness, transparency, minimization and storage limitation.

9. Data Subject Rights. Nature of Data Provision.

The user may exercise the rights provided for in Articles 15–22 of the GDPR, within applicable limits, including:

• access to their personal data;
• rectification of inaccurate data;
• erasure of data;
• restriction of processing;
• objection to processing;
• data portability;
• withdrawal of consent, when processing is based on consent.

To exercise their rights, the user may write to info@fil.it. The user also has the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali).

The deletion or restriction carried out by the Data Controller does not automatically result in the deletion of data already independently processed by other members; in such cases, the user may exercise their rights directly against such parties, according to the methods made available by them.

The provision of identifying, contact and tax data necessary for the creation and management of the account, use of the platform and invoicing is mandatory: failure to provide it results in the impossibility of registering, accessing services or concluding contracts through the platform.

The provision of further optional data (e.g. additional profile information, preferences, descriptive notes) is optional, but failure to provide it may limit certain functionalities or the completeness of the profile, or compromise or entirely prevent the correct functioning of Jimmy, making it impossible to execute the contract.

10. Changes to this Policy

The Data Controller may update this Privacy Policy at any time, where necessary following regulatory updates, or following technical and organizational changes, as well as implementation of services and/or activation of new Jimmy functionalities. The updated version will be made available on the site with indication of the date of last update.

11. Contacts

updated 30.09.2026