This is a translation of our German privacy policy. If the two versions differ, the German version prevails.
1. In short
- We only collect the data we need for your application, your request or to run this website.
- We do not sell data and do not pass it on for advertising.
- This website sets no cookies and does not measure its audience. No statistics tool is running.
- Fonts and images are served from our own hosting. We do not embed content from social networks.
- You can ask for access, correction or deletion at any time. An informal message is enough.
This policy applies to the website whitefieldmgmt.com. It is based on the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).
2. Who is responsible?
Hushyar Yilmaz GbR (Whitefield Management)
represented by its partners Arwin Hushyar and Ciwan Emin Yilmaz
Leonhardtstraße 3
30175 Hannover
Germany
Email: info@whitefieldmgmt.com
Phone: +49 178 5387576
You can reach us at these contact details for all privacy questions and to exercise your rights. We are not required by law to appoint a data protection officer.
3. Visiting the website and hosting
Our website is hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. When you open a page, Netlify processes technically necessary connection data in server log files: IP address, date and time of the request, the page requested and the amount of data transferred, browser, operating system and the previously visited page (referrer).
This data is needed to deliver the website, to keep it stable and secure and to defend against attacks. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). We do not combine log data with other data and do not use it for advertising. Netlify stores log data only for as long as it is needed to keep the website secure and stable and deletes it afterwards. Netlify determines the exact period based on the amount, nature and sensitivity of the data.
We have a data processing agreement with Netlify under Art. 28 GDPR. Netlify may process data in the USA. The transfer is based on the European Commission's adequacy decision for the EU US Data Privacy Framework (Art. 45 GDPR), to which Netlify has committed, and additionally on standard contractual clauses (Art. 46(2)(c) GDPR). The connection to our website is encrypted with TLS.
4. Applications from creators
The application form is in German. If you apply, we process: name, age and country; main platform, handles, follower count, average views and niche; information on previous collaborations; your email address and, if you provide it, your WhatsApp number; optionally a screenshot of your insights; and, if you are under 18, the name and email address of a parent or legal guardian and your statement that they know about the application.
Purpose: We check whether we can work together and contact you for that. We also look at your publicly available profiles on the platforms you name.
Legal basis: By applying you ask us for a management contract. We process your details to review and answer this request (Art. 6(1)(b) GDPR). You can withdraw your application at any time, for example by email to info@whitefieldmgmt.com. We will then delete it. We only write to you on WhatsApp with your consent (see section 7).
Storage period: If we do not start working together, we delete your application no later than six months after our decision. We need it for that long to answer follow up questions and to defend against possible claims (Art. 6(1)(f) GDPR). If a management contract is concluded, we transfer the necessary data to the contractual relationship and inform you separately.
Obligation to provide data: You are not obliged to apply. Without the required fields we cannot process your application. There is no automated decision making or profiling. A person decides on every application.
If you are under 18
You can apply through the form from the age of 16. If you are 16 or 17, we ask for the name and email address of a parent or legal guardian. We write to them and ask them to confirm the application. We do not process your application further before that. If we receive no confirmation within 30 days, we delete the application together with the details of your parents. If you are under 16, your parents have to contact us on your behalf. We only conclude contracts with minors with the consent of all persons holding parental responsibility.
Information for parents and legal guardians
If your child has applied to us, we received your name and email address from your child. We use these details only to inform you about the application and to ask for your confirmation. The legal basis is our legitimate interest in protecting minors and involving their legal guardians (Art. 6(1)(f) GDPR). We store your details together with the application and delete them with it. Without your confirmation this happens after 30 days. You can object to the processing at any time and ask us to delete the application. You have all rights listed in section 12.
5. Requests from brands and contact form
If you write to us through the request form for brands or the contact form, we process the data you enter: name, company, email address, optionally a phone number, details of the planned campaign and your message.
Purpose and legal basis: We answer your request and prepare a proposal where appropriate. The legal basis is pre contractual measures at your request (Art. 6(1)(b) GDPR) and our legitimate interest in answering requests (Art. 6(1)(f) GDPR). You do not have to give us any data. Without the required fields we cannot answer your request.
Storage period: We delete requests that do not lead to an order no later than twelve months after the last contact. Business correspondence relating to orders is kept as required by German commercial and tax law (usually six to ten years).
6. How the forms work
All forms on this website use Netlify Forms, a service of our host Netlify (see section 3). Netlify stores form data and uploaded files on our behalf and makes them available to us. We also receive a notification by email. Data may be processed in the USA. The safeguards named in section 3 apply.
To protect against spam, every form contains an invisible field that only automated programs fill in. Netlify also checks incoming form data for spam automatically and uses the Akismet service of Automattic Inc. (USA) for this. The legal basis is our legitimate interest in protection against abusive submissions (Art. 6(1)(f) GDPR).
7. Contact by email, phone and WhatsApp
Email and phone: If you email or call us, we process your details to handle your request. The legal basis is Art. 6(1)(b) GDPR where a contract is being initiated, otherwise our legitimate interest in communication (Art. 6(1)(f) GDPR). Our mailboxes are hosted by IONOS SE (Montabaur, Germany).
WhatsApp: You can write to us via the WhatsApp buttons. A connection to WhatsApp is only established when you tap one. We only write to you on WhatsApp if you write to us there first or if you voluntarily give us your number for this purpose in the application form. WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland then processes your phone number, profile name and message content. Processing in the USA by the parent company Meta cannot be ruled out. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with a short message. We will then only write to you by email. If you are under 18, we only write to you on WhatsApp after your parents have confirmed the application. We delete chats about an application together with the application.
8. Cookies and local storage
This website sets no cookies. We only store the following in your browser's local storage:
| Name | Purpose | Duration | Basis |
|---|---|---|---|
| wf-theme (local storage) | Remembers that you chose the dark design with the switch at the top of the page | Until you switch back to the light design or clear the storage | Strictly necessary for the function you selected, Section 25(2) no. 2 TDDDG |
| wf-motion (session storage) | Remembers that you stopped the looping animations with "Pause animations" | Until you switch the animations back on, at the latest until you close the tab | Strictly necessary for the function you selected, Section 25(2) no. 2 TDDDG |
9. Audience measurement
We currently do not use any audience measurement tool.
10. Fonts, images and external links
We serve fonts and images from our own hosting at Netlify. No fonts are loaded from Google or other providers and no videos, maps or posts from social networks are embedded.
Links to our creators' profiles (for example on TikTok, Instagram or YouTube) and to our sister brand Æ Society (aesociety.de, also operated by Hushyar Yilmaz GbR) are simple links. Data is only transmitted to the respective provider when you click such a link. Their privacy policy then applies.
11. Who receives your data?
Within Whitefield only the people who handle your application or request have access. We use these service providers:
- Netlify, Inc., USA: hosting of the website and processing of the forms (processor)
- Automattic Inc., USA: spam check of the forms via Akismet (on behalf of Netlify)
- IONOS SE, Germany: operation of our mailboxes (processor)
We do not pass applications on to brands or agencies. We only use them for Æ Society if you agree. Beyond that we only pass on data if you have consented or if we are legally obliged to do so.
12. Your rights
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Withdrawal of consent with effect for the future (Art. 7(3) GDPR)
Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object to this processing at any time on grounds relating to your particular situation.
To exercise your rights, an informal message to info@whitefieldmgmt.com is enough.
Right to lodge a complaint: You can complain to a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Der Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany, www.lfd.niedersachsen.de.
13. Applications as a talent scout (freelance)
If you apply as a talent scout using the form on the German page "Karriere", we process the data you enter: name, email address, country, optionally your WhatsApp number and a link to your profile, your details on experience and available time, your message and the confirmation that you are of legal age. If you apply by email instead, we process the details in your message for the same purpose.
Purpose and legal basis: We check whether a freelance collaboration is possible and get back to you. The legal basis is the performance of steps prior to entering into a contract at your request (Art. 6(1)(b) GDPR). We need the mandatory fields in order to assess your application. If you provide your WhatsApp number, we only write to you there with your consent (see section 7).
Storage period: If no collaboration results, we delete your application no later than six months after our rejection. You can withdraw it at any time and we will then delete it immediately. If a collaboration results, we transfer the necessary details to the contract documents and keep them as required by commercial and tax law.
The role is aimed at adults. We do not accept applications for it from persons under 18 and delete them. Section 6 applies to how the form works.
14. Changes to this policy
We update this privacy policy when our website or the legal situation changes. The version published here applies. Last updated: November 2026.