Who Gets Your Data? How to Check an Influencer Marketing Platform
Short answer
Before you give a platform your data, find out who runs it: the full company name and address in the footer and terms, the data controller in the privacy policy, a KRS number or CEIDG entry, and the payment rules. Polish law on electronic services and the GDPR require a provider to publish this itself. If it is missing, do not sign up.
Signing up to an influencer marketing platform looks harmless: an email, a password, a profile name. In practice you hand over far more. A creator leaves account statistics, a niche, rates, a shipping address, and at the first payout — invoicing details and a bank account number. A brand types in a brief, a campaign budget, an audience description and its advertising plans.
None of that is incidental. On one side it is a set of data about a specific person and their earnings; on the other, a fragment of a company's marketing strategy. Before either goes into a form, it is worth knowing who receives it.
A platform cannot be anonymous
A brand name, a logo and a promise to connect creators with brands do not tell you who you are contracting with. A serious service shows its operator without making you hunt: in the footer, in the terms and in the privacy policy.
The minimum that should be findable in seconds:
- the full name of the company or sole trader, not just the marketing name;
- the registered address;
- a contact email address;
- registration numbers — in Poland KRS, NIP, REGON, as applicable to that legal form;
- a statement of who the data controller is;
- terms of service and a privacy policy;
- complaint and contact procedures.
If a service expects your data but does not disclose its own, that is not an unfinished website. It is the absence of the information you would base the decision to register on.
What a creator risks
The set that accumulates in a creator profile is more sensitive than it looks: name, email, phone, social account handles, statistics, screenshots from analytics panels, a shipping address, contract and invoicing details, a bank account number, a history of brand deals.
Separately each item seems minor. Together they form an earnings profile of a specific person: what they charge per publication, which niche they work in, where they live and how to reach them. That combination is valuable to anyone selling contact databases or impersonating brands in messages to creators. It applies to every earning route — including the other ways of making money on Instagram, all of which end with your payout details sitting in someone's system.
So billing data goes in only once you know who the other party to the contract is and who is responsible for paying you. A promise of campaigns is not enough — we covered what settled terms look like under the influencer contract.
What a brand risks
Creating an account and a campaign leaves behind the contact person's details, the industry, the budget, the brief, the product description and the target audience. A brief and a budget are not formalities; they are a record of what the brand plans to do in the market over the coming months.
If it is unclear who runs the service, it is equally unclear where that information ends up and who can see it. With a platform that charges a subscription or handles payments, a second question follows: who exactly are you paying, and who is liable if the campaign never happens.
We compared how platforms operating in Poland handle payments separately, in the piece on influencer marketing platforms.
What the law requires
Disclosing who the service provider is comes from legislation, not from good manners.
Electronic services. The Polish Act of 18 July 2002 on providing services by electronic means requires, in art. 5, that the provider give clear, unambiguous and directly accessible information, including electronic addresses and the name, registered office and address of the provider. Art. 23 sets a fine for missing or false details. The text: Journal of Laws 2002 no. 144 item 1204.
Personal data. GDPR art. 13 requires the controller to give its identity and contact details at the moment the data is collected — the regulation. The Polish supervisory authority explains the duty from the user's side in its material on the information obligation and transparency.
Offers to consumers. For distance contracts the trader must provide, before the contract is concluded, the business address, email address and phone number — the Polish competition authority sets this out in its guide to the right to information.
Intermediary platforms. If the service works as a marketplace, transparency duties under the Digital Services Act apply too — trader traceability is governed by art. 30 of Regulation 2022/2065.
A good landing page is not the same as a platform
Standing up a service is easy now: a template, a form, a price list, a few marketing texts. There is nothing wrong with that in itself — the problem starts when a project collects data like a business and sells a service like a business, without the legal and organisational layer behind it.
Which leaves three things you cannot take on trust. A “GDPR-compliant” badge does not replace naming the data controller. A claim about a large creator base says nothing about where that data came from or whether the people in it know they are there. A subscription price list does not tell you who you are paying.
How to check a platform in a few minutes
1. The footer. Look for the full legal name, address and registration numbers. A contact form is not the same as company details.
2. The terms. They should name the provider with its address. If the whole document only ever uses the marketing name, you do not know who you are contracting with.
3. The privacy policy. It has to name the data controller — a specific legal entity, not the name of the website.
4. Payment rules. Who charges, in what form, and what happens if the campaign falls through. Where the platform handles payments, check who holds the money until the material is approved — we described that under secured payment.
5. Registers. Polish companies are in the KRS search, sole traders in CEIDG. The biznes.gov.pl guide walks through verifying a counterparty step by step.
6. The domain. Domain registration data can help, but it does not replace what is on the site: a domain having an owner does not mean you know who provides the service and processes the data.
Where to report a suspicious service
If a platform collects personal data without naming a controller, the report goes to the data protection authority, UODO. If it targets consumers, charges fees or misleads about who it is — to UOKiK, which lists failure to provide reliable, truthful and complete information among practices infringing collective consumer interests. For services acting as online intermediaries, DSA obligations come into play as well.
How this looks at Blogger Bank
The service is operated by PRIMAVERA HOME Sp. z o.o. Sp.K.A., registered in Warsaw (02-699), ul. Kłobucka 23B/U1, KRS 0000949334, NIP 5372642157, REGON 380322806. The same details appear in the terms and the privacy policy, and the KRS number can be checked in the Ministry of Justice search without asking us for anything.
The settlement rules are public: the commission is 5% on the brand side and 5% on the creator side. A job carries a brief and terms agreed before the start, and the brand-creator conversation stays in one place instead of private messages.
If you check us the same way you would check any other platform — good. That is the point of this article. Create a creator profile or browse current brand jobs once you are done verifying.
Sources
- Act on providing services by electronic means (Poland), art. 5 — lexlege.pl
- Act on providing services by electronic means (Poland), art. 23 — lexlege.pl
- GDPR, art. 13 — eur-lex.europa.eu
- UODO, the information obligation and the transparency principle — uodo.gov.pl
- UOKiK, the right to information — prawakonsumenta.uokik.gov.pl
- Digital Services Act, art. 30 — eu-digital-services-act.com
- Biznes.gov.pl, verifying a counterparty — biznes.gov.pl
- UOKiK, infringement of collective consumer interests — uokik.gov.pl
Frequently asked questions
Is an email address in the footer enough?
No. A contact address is one of the required details, but it does not replace the provider's name and registered office. Without them a user cannot tell which entity they are contracting with or who answers for the service.
Is the platform's brand name enough as a data controller?
Not if it does not identify a specific entity. A privacy policy should name the controller in full, with an address, so users know where to send a request for access to their data or its deletion.
Which registration details should a platform publish?
A company gives its name, registered office, KRS number, NIP and REGON. A sole trader gives their name, address and NIP. Those details let anyone find the entity in a public register without contacting the service.
Should a creator enter invoicing details on a new platform?
Only after checking the operator, the terms, the payment rules and the privacy policy. A bank account and billing data are too sensitive to type into a service whose owner cannot be established.
Should a brand enter a campaign budget on an unfamiliar platform?
Not until it is clear who runs the service and how campaign data is used. A budget, a brief and an audience description are parts of a marketing strategy, not technical details needed to open an account.
Where can you check the company behind a platform?
Polish companies appear in the KRS search run by the Ministry of Justice, sole traders in CEIDG. NIP and REGON numbers let you confirm that what the website claims matches the register.
Where do you report a platform that hides its details?
A missing data controller goes to UODO. Missing reliable information about the trader in an offer aimed at consumers goes to UOKiK. Both authorities accept reports from people affected by the practice.
Can a platform pass creator data to brands?
It can, if that follows from the rules presented when the data was collected. The privacy policy should tell the user which data reaches brands and on what legal basis it happens.
