Both, in different scopes. This is called a joint controller relationship under GDPR Art. 26.
- Meet Your Fan is the data controller for: account signup, authentication, payments, platform-wide notifications, platform analytics, anti-fraud.
- The influencer is the data controller for: the entrant list of their campaign, any UGC they receive, their own marketing contact with entrants (broadcasts, winner notifications).
- Meet Your Fan is the data processor (acting on the influencer's instructions) for storing and delivering those campaign-specific communications.
In practice this means:
- A GDPR request from an entrant can be filed with either MYF or the influencer. Both must respond in scope. MYF's platform gives influencers tools to honour requests in their scope.
- A breach affecting one campaign's entrants is the influencer's responsibility to communicate, with MYF's technical assistance.
- A breach affecting the platform is MYF's responsibility.
The Joint Controller Agreement is one of the terms an influencer accepts when running their first campaign. You don't have to negotiate it; you do have to read it.