GDPR Declaration
Last updated: 19 July 2026
1. Data Controller
The controller of your personal data is the operator of elitecompanion.cc ("we", "us"). Contact for all data protection matters: the support section of your dashboard, or the contact details published in our Terms of Service. This declaration is issued under Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR").
2. Scope of This Declaration
This declaration applies to all personal data processed in connection with elitecompanion.cc, for both Advertisers and Clients. It supplements our Privacy Policy, which describes in detail what data we collect, why, how long we keep it, and with whom we share it.
3. Legal Bases We Rely On
We process personal data on the following legal bases: performance of a contract (operating your account, publishing profiles you submit, processing payments, sending transactional emails, Art. 6(1)(b) GDPR); legal obligation (age verification, prevention of exploitation and underage content, accounting records, cooperation with authorities, Art. 6(1)(c)); legitimate interest (fraud prevention, duplicate-account detection, platform security, Art. 6(1)(f)); and consent where required (biometric identity verification, Art. 6(1)(a) and Art. 9(2)(a)).
4. Explicit Consent to Biometric Processing
Identity verification of Advertisers involves biometric data within the meaning of Art. 9(1) GDPR: facial images from your identity document, verification selfie, live video recording, and face embeddings derived from them. This data is processed only with your explicit consent, which you give before starting verification. It is used exclusively to confirm that you are a real person, at least 18 years old, advertising yourself, and not operating duplicate profiles. Biometric data is never published, never used for marketing, and never shared except with the verification processors listed below.
5. Withdrawal of Consent
You may withdraw your consent to biometric processing at any time through the support section of your dashboard. Withdrawal has the following consequences: your stored verification media and face embeddings are deleted, your verified status and badge are removed, and your profile can no longer remain published, since verification is a condition for advertising on the Platform. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal, and does not delete records we are legally required to keep.
6. Processors and Recipients
We share personal data only with processors necessary to run the Platform, each bound by a data processing agreement: Didit (identity document and age verification), Amazon Web Services (facial comparison for verification and duplicate detection), Stripe (payments), and Cloudflare (hosting, media storage, email delivery). We disclose personal data to public authorities only where required by law or necessary to protect the safety of any person.
7. Transfers Outside the EEA
Some processors may process data outside the European Economic Area. Where that happens, transfers are protected by an adequacy decision of the European Commission or by Standard Contractual Clauses, together with additional technical measures such as encryption in transit and at rest.
8. Retention
We keep personal data only as long as needed for the purposes above. Account data is deleted or anonymised within 90 days of account deletion. Verification media is kept only as long as needed to establish and evidence verification status. Payment records are kept for the period required by tax and accounting law. Full retention details are in the Privacy Policy.
9. Your Rights
Under the GDPR you have the right to: access your personal data and receive a copy; rectify inaccurate data; erase data ("right to be forgotten"); restrict processing; data portability; object to processing based on legitimate interest; and withdraw any consent at any time. Verification decisions that affect you are always reviewed by a human; you will not be subject to a decision based solely on automated processing. To exercise any right, contact us through the support section of your dashboard. We respond within one month.
10. Right to Complain
If you believe our processing of your personal data violates the GDPR, you have the right to lodge a complaint with your local supervisory authority in the EU member state of your residence, place of work, or the place of the alleged infringement.
See also our Privacy Policy and Terms of Service.