What kind of IP should we protect if we do not have any proprietary tech?

User contributed content have special rules of their own, in particular copyright is presumed to like with the author so you need as part of the terms to acknowledge (if necessary) and seek the right to republished in electronic media, or respect the right for users to delete the content. See the recent rulings on "Right to Forget". Also not well known are the laws on privacy and identity, as an EU site you should be aware of the Data Protection Directive and its implications for your business. On the other hand, if you've some special in-house database or analytical tools, those should be copyrighted and employees should be made aware of what trade secrets should not be disclosed to competitors. Protection is a matter of identifying risks (probability of event, expected loss/outcome) and matching appropriate resources to mitigate, manage or move it to the agency best able to handle that risk (eg cybersecurity).