Privacy Notice

Last updated: 25 October 2026. This notice explains how Creoroute handles enquiries submitted through this website.

1. Who we are and how to contact us

Creoroute is an independent introduction and information service operated by a self-employed professional, not a bank, payment institution or incorporated company. The service is presented under the name Creoroute.

For privacy questions and requests to exercise your rights, email: Contact email pending activation.

2. Information we collect

When you send an enquiry, we collect the information you choose to provide: name, contact email, country, whether you are a creator or agency, approximate monthly payment-volume range, the topic of your enquiry and any optional message. We also record when you acknowledged this notice and the notice version.

For website security and enquiry administration, we may process technical information such as IP-address-derived rate-limit keys, security-verification results, timestamps, the referring website, the page used to enquire, and campaign parameters. Our private CRM may contain business correspondence, follow-up tasks, status updates, notes about an introduction and referral-commission records.

Please do not include identity documents, payment-card or account details, passwords, explicit material, information about your sex life, or other sensitive personal data in the initial enquiry form. Do not send details of another person unless you are authorised to do so.

3. Why we use the information and our legal bases

• Answering your request: to review your enquiry, communicate with you and, when you ask, explore a possible introduction. We rely on your request and, where appropriate, your consent to being contacted (GDPR Article 6(1)(a) or steps at your request before a potential arrangement, Article 6(1)(b), depending on the interaction).
• Organising enquiries and introductions: to maintain accurate correspondence and follow-up records and manage legitimate business relationships, subject to a balance against your rights (Article 6(1)(f)).
• Protecting the website: to detect abuse, prevent spam and protect the service (Article 6(1)(f)).
• Legal and accounting duties: to retain necessary records where the law requires this (Article 6(1)(c)).

We do not use your enquiry to subscribe you to marketing emails. Any optional marketing programme would require a separate notice and, where needed, consent. You may withdraw consent for consent-based processing at any time by contacting us; previous lawful processing is not affected.

4. Sharing information

We may disclose relevant business contact and enquiry details to a potential third-party account or payment provider only if you choose to proceed with an introduction. The provider's identity will be disclosed to you before any formal application. The provider is responsible for explaining its own terms, checks and privacy practices.

We also use Cloudflare to host, protect and operate this website and its CRM/database. Technical infrastructure providers may process data under their relevant contractual and privacy terms. We may disclose information if legally required. We do not sell enquiry details or use them for advertising audiences by default.

5. International processing

We use cloud infrastructure and may interact with providers in different countries. Depending on the provider and configuration, data may be processed or accessed outside the European Economic Area (EEA). Where required, international transfers must be supported by an adequacy decision, applicable Standard Contractual Clauses or another lawful transfer mechanism. Before sharing data with a particular provider, we will explain any material provider-specific transfer arrangements that apply.

6. How long we keep information

Enquiries and follow-up records are held only while reasonably necessary to respond, evaluate a possible introduction, manage an ongoing relationship or resolve an issue. Inactive enquiries should be reviewed for deletion, ordinarily within 12 months after the last substantive interaction; longer retention may be necessary for an active introduction, accounting obligations or legal claims. The period for those records depends on the relevant legal obligation and circumstances.

The CRM supports individual record deletion and an optional automatic retention mechanism; the precise operational schedule must be finalised before collecting real enquiries. Security-rate-limit records are temporary and are cleared automatically after they expire. Backups, when configured, follow a separate limited retention schedule.

7. Security and automated decisions

Data is transferred over HTTPS and stored in Cloudflare D1. Access to the private CRM is restricted by Cloudflare Access and server-side verification. We apply anti-spam controls, access restrictions and reasonable technical safeguards. No internet service can promise absolute security.

We do not make decisions that produce legal or similarly significant effects solely by automated means. Any account-opening decision is made by the independent provider, under its own procedures.

8. Cookies, browser storage and anti-bot verification

The website does not include advertising pixels or non-essential analytics cookies by default. It may store limited enquiry-source details in your browser's session storage to understand how you found us. Cloudflare security and Turnstile verification may use technical identifiers or cookies needed to detect abuse. The restricted owner-only CRM also relies on Cloudflare Access authentication. If non-essential tracking is introduced later, we will update this notice and obtain consent where required.

9. Your rights

Depending on the circumstances and applicable law, you may ask for access to or correction of your data, erasure, restriction, portability, object to processing based on legitimate interests, or withdraw consent. Some requests may be limited by legal recordkeeping obligations. To make a request, use the privacy contact email above. We may reasonably verify your identity before disclosing personal information.

You may also complain to the Cyprus Commissioner for Personal Data Protection or another competent EU data protection authority.

10. Changes to this notice

We may update this notice when the service or our processing practices change. The current version and date will be published here. Material changes affecting your rights will be communicated where required.