Skip to content
EXXOTIC MODELS

Privacy

Outline of the privacy policy. The final text is being legally reviewed and will then be published here.

1. Controller

The controller responsible for the processing of personal data on this website is:

EXXOTIC Management UG (haftungsbeschränkt)
Äußere Bayreuther Str. 59
90409 Nuremberg
Germany
Email: info@exxotic-management.com

Represented by the management: Dimitri Kuksin. We have not appointed a data protection officer, as we are not legally required to do so. For any questions about data protection, you can reach us using the contact details above.

2. The essentials in brief

  • This website presents models and links to their profiles on platforms such as OnlyFans, Fansly, Patreon or Instagram. Some of these links are affiliate links (section 8).

  • We do not use cookies without your consent. Our own counting of views and link clicks works without cookies, without identifiers and without storing your IP address.

  • Google Analytics only runs if you agree in the consent banner. You can withdraw your consent at any time via “Cookie settings” at the bottom of each page. As long as Google Analytics is not set up, neither the banner nor the link will appear.

  • Creators upload their ID document for age verification. Only our review team sees it, and we delete the images after the review (section 12).

  • We serve fonts ourselves. Platforms and social networks are not embedded, only linked.

3. Accessing the website and server logs

Every time you access this website, our server automatically processes data transmitted by your browser: IP address, date and time, the address accessed, status code and amount of data transferred, the previously visited page (referrer), as well as browser and operating system (user agent). This data is technically necessary to deliver the website and to detect and fend off faults and attacks.

The legal basis is our legitimate interest in a secure and stable operation of the website (Art. 6 (1) (f) GDPR). The logs are deleted after 14 days, unless they are needed for longer to investigate a specific security incident.

To protect against misuse of the contact form, we briefly count how often an IP address submits it. This count exists only in the server's working memory and expires after ten minutes.

Hosting

The website runs on our own server in a data centre in Germany. Operator of the data centre: RAW Productions GmbH. We have a data processing agreement with this provider pursuant to Art. 28 GDPR.

The connection to this website is encrypted using TLS. You can recognise this by “https://” and the padlock symbol in your browser's address bar.

4. Images and media (Amazon S3)

We deliver images and other media directly from storage at Amazon S3, a service provided by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (“AWS”). The files are stored in the Frankfurt am Main region (eu-central-1). When an image is loaded, AWS processes your IP address and your browser's technical details in order to deliver the file.

The legal basis is our legitimate interest in fast and reliable delivery of the website (Art. 6 (1) (f) GDPR). We have a data processing agreement with AWS. Transfer to the USA cannot be ruled out, as the parent company Amazon.com, Inc. is based there. It is certified under the EU-US Data Privacy Framework, which ensures an adequate level of data protection (Art. 45 GDPR). In addition, the EU Commission's standard contractual clauses apply.

5. Cookies and browser storage

Cookies and similar techniques (such as the browser's local storage) store information on your device or read information from it. Under Section 25 TDDDG, this is only permitted with your consent, unless it is strictly necessary for a service you have requested.

  • We store your selection in the consent banner in your browser's local storage so the banner does not reappear every time you visit a page (strictly necessary, Section 25 (2) No. 2 TDDDG). The entry only contains your selection and the date. It remains until you change it or delete your browser data.

  • Google Analytics only sets cookies after you have given your consent, see section 9.

Our counting (sections 6 and 7) and the contact form do not use cookies.

6. Counting views without cookies

To understand which articles are read and how they are found, we count views of our journal using our own method, operated on our own server. In doing so, no cookies are set and no information is stored on or read from your device, and no identifier is created that recognises you again. Only the page accessed and the name of the website you came from are transmitted, never the full address. Only daily totals per page and a rough category of origin (such as “search engine” or “social networks”) are stored. We likewise count how many requests come in via the contact form, without any reference to you personally.

Your IP address is not stored for this purpose. If you have “Global Privacy Control” enabled in your browser, we do not count your visit.

The legal basis is our legitimate interest in data-sparing traffic measurement in order to improve our offering (Art. 6 (1) (f) GDPR).

7. Counting link clicks

The links on the profiles first go through a redirect on our own server (addresses in the form /go/…) and from there to the respective platform. With each click, we increment a counter for that link and that day. Only this daily total is stored — no IP address, no cookie, no identifier, no referrer. It is not possible to determine who clicked. Recognisable search engine bots, browser pre-loading processes and visits with “Global Privacy Control” enabled are not counted.

We use these figures to see which profiles and platforms are popular and to reconcile affiliate billing. The legal basis is our legitimate interest in data-sparing performance measurement (Art. 6 (1) (f) GDPR).

8. Links to platforms and affiliate links

On the profiles you will find links to third-party offerings, for example OnlyFans, Fansly, Patreon, Brezzels, Instagram, TikTok, YouTube, or the models' own websites. These are ordinary links: simply visiting our pages does not transmit any data to these providers. Only when you click a link do you leave our website, and your browser establishes a connection to the respective provider. From that point on, that provider's privacy policy applies; the provider is itself responsible for the processing carried out there.

Some of these links are affiliate links. So that the platform can recognise that you came via our site, the link may contain a partner identifier, and the platform may set its own cookies or collect data in connection with this. If you take out a subscription or purchase something there, we may receive a commission; in doing so, we generally only learn that and to what extent a transaction occurred via our link, but not who you are. The legal basis for providing the links is our legitimate interest in generating traffic and commissions (Art. 6 (1) (f) GDPR).

9. Google Analytics (only with consent)

If you agree in the consent banner, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Without your consent, Google Analytics is not loaded and no connection to Google is made.

Google Analytics sets cookies (e.g. _ga, _ga_*, storage period of up to 2 years) and collects information about your use of the website: pages visited, time spent, origin, device type, browser and your approximate location (derived from the IP address; Google Analytics 4 does not itself store the IP address). Google uses this to create reports on website usage for us. We have disabled Google signals and the sharing of data with other Google products for advertising purposes; in consent mode, advertising cookies and personalisation are always rejected.

The legal basis is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). You can withdraw it at any time with effect for the future by changing your selection via “Cookie settings” at the bottom of each page; Google Analytics cookies will then be deleted.

We have a data processing agreement with Google [PLEASE CHECK]. Google may transfer data to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). Further information: Google's Privacy Policy.

10. Contact form and email

If you write to us via the contact form or by email — for example with a general question or because you would like to be taken on as a model — we process your information in order to respond to your enquiry. In the contact form, this consists of name and email address (required fields), and optionally phone number, subject and message, as well as the answers in any additional fields of the respective form (such as links to your profiles), plus the page on which you submitted the form and the time of your consent. We do not accept files (photos, ID documents) via the form.

We store the enquiry in our administration system and send it to ourselves by email. Sending is handled by Amazon Simple Email Service (AWS, address see section 4, Frankfurt am Main region). We do not send a confirmation to your email address.

The legal basis is your consent (Art. 6 (1) (a) GDPR), which you give in the form, and — where collaboration is involved — the initiation of a contract (Art. 6 (1) (b) GDPR).

11. Model profiles

The profiles on this website (name or stage name, images, description, links) are published with the agreement of the respective models. Anyone wishing to have a profile changed or removed should contact us using the details in section 1.

12. Age verification using ID documents

Anyone creating their own profile as a creator, or taking over an existing one, uploads the front and back of an official identity document (ID card, passport or driving licence) before the first review. We use the ID solely to verify that the person is of legal age and matches the profile. This ensures that no minors are shown on this website.

We process the images of the ID document along with the information visible on it (in particular photo, name and date of birth) as well as the file name, file type, file size and time of upload. You may redact anything we do not need for the review before uploading, for example the ID or access number, address, height or eye colour. The photo, name and date of birth must remain visible. We compare the photo with the profile pictures only by visual inspection; no automated biometric evaluation takes place.

The ID images are not stored in the public media storage (section 4), but in our database on our server in Germany (section 3). Only the management and our review team can view them; every access is logged. We never publish them and do not pass them on to third parties.

As soon as the review is complete, we delete the ID images. We also delete them if we reject or block a profile, if an ID cannot be verified (in which case we ask you to upload it again), and if you delete your account. Only a note is kept stating that, when, and by whom the review was carried out.

The legal basis is the performance of the agreement regarding your creator profile, for the publication of which age verification is a prerequisite (Art. 6 (1) (b) GDPR), as well as our legitimate interest in protecting minors and not showing profiles of minors (Art. 6 (1) (f) GDPR). [PLEASE CHECK: Copies of German identity cards are additionally subject to Section 20 (2) PAuswG — consent of the holder and labelling as a copy.]

13. How long we store data

  • We delete enquiries via the contact form or by email once they have been dealt with and no retention obligation applies, at the latest after 6 months. If an enquiry leads to a collaboration, the statutory retention periods for business correspondence (six years) and accounting records (eight years) apply.

  • ID images are kept until age verification is complete, at the latest until the profile is rejected or blocked, or until your account is deleted (section 12).

  • Counts (sections 6 and 7) do not contain personal data and are not deleted.

  • Server logs after 14 days, Google Analytics data after the period set in the property.

14. Your rights

You have the right to access the data we have stored about you (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw any consent given at any time with effect for the future (Art. 7 (3) GDPR). Simply contact us using the details given in section 1.

Right to object (Art. 21 GDPR): Where we process data on the basis of our legitimate interest (Art. 6 (1) (f) GDPR), you may object at any time for reasons arising from your particular situation. We will then no longer process the data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, or the processing serves to assert, exercise or defend legal claims.

Right to complain: You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, www.lda.bayern.de.

15. Changes

We will update this privacy policy whenever our website or the legal situation changes. The version published here at any given time applies.

Last updated: October 2026