Annex P - Privacy Policy (placeholder until public URL is live)

Attached to: Creator Contractor Services Agreement
Agency: Cipher Solutions
Version: 0.1 draft for review

If the public Privacy Policy URL in Agreement §16 is blank at signing, this Annex P applies until replaced by a URL notice.

1. Controller / contact

Controller (company data): Cipher Solutions __________________ (legal form), UIC ______________, seat ______________, privacy email: __________________

For fan data on Creator Platform Accounts, Creator is typically the primary controller; Agency processes as service provider per Agreement §9.6.

2. Data we process about Creator

Identity: full name, date of birth, address, ID details needed for age/likeness verification
Contact: email, phone, messaging handles
Financial: Baseline statements, revenue extracts needed to invoice fees
Likeness / Intimate Materials: reference media, Generated Content, chat operational data
Technical: access logs for vaults and portals

3. Purposes

Perform Services under the Agreement
Verify age and likeness rights
Calculate and collect fees
Secure Intimate Materials in encrypted environments
Comply with law, platform rules, and dispute handling

4. Legal bases (GDPR where applicable)

Contract performance
Legitimate interests (security, fraud prevention, fee recovery) balanced against Creator rights
Consent where required for certain NSFW processing or marketing (Schedule B / separate opt-ins)
Legal obligation (tax/accounting retention)

5. Security

Intimate Materials are stored with encryption in transit and at rest where technically applied, access control, compartmentalization, logging, and staff confidentiality obligations (Agreement §9).

6. Sharing

Processors/subcontractors under contract (chatters, editors, hosting, DocuSign). No sale of personal data. Disclosures where required by law or platform process.

7. Retention and deletion

Operational Intimate Materials deleted on exit per Agreement §12. Tax/contract records retained as required by Bulgarian accounting/tax rules. Backup rotation ≤ 90 days for residual encrypted copies not used in production.

8. International transfers

If tools host data outside Bulgaria/EU, Agency uses appropriate safeguards (e.g. SCCs) where required.

9. Creator rights

Where GDPR applies: access, rectification, erasure (subject to legal retention and Agreement §12 exceptions), restriction, portability, objection, and complaint to the Bulgarian Commission for Personal Data Protection (CPDP).

10. Breach notification

Per Agreement §9.4.

Creator acknowledgment: ______ · Date: __________
Agency: ______ · Date: __________

Cipher Solutions | Confidential | Annex P