Privacy Policy

Last updated: July 2026

1. Who We Are

Hgiant CRM ("we", "us", "our") is operated by Hgiant / NextGen UGC. We are committed to protecting your personal data and your right to privacy. This policy explains how we collect, use, and share your personal data in compliance with the EU General Data Protection Regulation (GDPR) and applicable US privacy laws, including the California Consumer Privacy Act (CCPA/CPRA).

2. Data We Collect

When you interact with us — for example, by responding to a marketing campaign or scheduling a meeting — we may collect:

  • Full name
  • Phone number (including WhatsApp and Telegram)
  • Email address
  • Lead source (e.g., Facebook campaign, website, WhatsApp link)
  • Meeting and photoshoot scheduling details
  • Sales and payment information
  • Messages exchanged between you and our team
  • Production details (photographer, location, comments)

3. How We Use Your Data

  • To communicate with you about our services (meetings, photoshoots, sales)
  • To schedule and manage appointments
  • To process payments and track sales
  • To deliver creative content (UGC videos) to you
  • To improve our services and customer experience

Our legal basis for processing under GDPR includes: your consent, the performance of a contract, and our legitimate interests in operating our business.

4. Data Sharing

We share your data with the following service providers to operate our business:

  • Meta / WhatsApp Business API — for WhatsApp messaging
  • Telegram — for Telegram messaging
  • Meta / Facebook Lead Ads — for lead generation
  • NextGen UGC platform — for content delivery

We do not sell your personal data to third parties.

5. Your Rights

Right to Access & Portability

You can request a copy of all your personal data, in a portable machine-readable format.

Right to Erasure ("Right to be Forgotten")

You can request that we permanently delete all your personal data, including messages and related records.

Right to Rectification

You can request that we correct any inaccurate or incomplete personal data.

Right to Object / Opt-Out

You can object to processing based on legitimate interests or opt out of marketing communications at any time.

Right to Restrict Processing

You can request that we limit how we use your data while a complaint is being resolved.

6. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes described above, or as required by law. You can request erasure at any time (see Section 5).

7. International Transfers

Your data may be transferred to and processed in countries outside the EU/EEA (e.g., the United States where our service providers are located). We rely on Standard Contractual Clauses and adequate safeguards to protect your data during such transfers.

8. Security

We implement appropriate technical and organizational measures to protect your personal data, including encrypted storage, access controls, and audit logging of data access and erasure actions.

9. How to Exercise Your Rights

To exercise any of your rights, contact us at the phone number or email provided during your initial interaction with us. We will respond within 30 days (GDPR) or 45 days (CCPA) of receiving your request.

10. Supervisory Authority

If you believe we have not properly handled your data, you have the right to lodge a complaint with your local data protection authority (EU) or the California Attorney General (US).