Privacy Policy

1. Introduction and Transparency

We are committed to the protection of personal data as a fundamental principle. We dedicate all necessary resources to process your data in full compliance with Regulation (EU) 2016/679 (GDPR) and local Gibraltar legislation. Transparency is an essential pillar of this framework, and this document explains how we collect, use, and protect your information when you interact with our affiliate services.

We reserve the right to periodically update this policy to reflect changes in our processing methods or legal requirements. We encourage you to check this page regularly for the latest version.

2. Who We Are and How to Contact Us

Referio Global Limited , a company based in Gibraltar, 260 Main Street, Suite 2, GX11 1AA, identification number 126034, acts as the Controller when processing your personal data.

• Data Protection Officer (DPO): You can reach our DPO directly regarding any questions about your data at [email protected], marked “In the attention of the Data Protection Officer”.

3. Detailed Categories of Personal Data Processed

We collect data directly from you, giving you control over the information provided. This includes:

• Account Registration: Name, surname, phone number, and email address.
• Contractual Requirements: For signing an affiliate contract, we require your personal identification number, home address, and bank account number (IBAN).
• Tax Compliance: Documentation proving tax exemptions, where applicable, to ensure correct withholding.
• Technical & Behavioral Data: We collect traffic data  provided by your device to ensure system security, stability, and technical administration. We also process information about your behavior on the site to personalize your experience.
• Cookies: We use cookies and similar technologies to store and collect information according to our Cookie Policy.

4. Purposes and Legal Grounds for Processing

We process your data for the following specific purposes:

• Provision of Services: This is based on the execution of the contract between us. It includes:
  • Verifying consent for Terms and Conditions.
  • Creating and managing Affiliate Accounts.
  • Identifying affiliates and processing payment of due sums.
  • Fulfilling tax obligations, including withholding taxes and providing income certificates upon request.
  • Sending non-commercial notifications and providing technical support.
• Service Improvement: Based on our legitimate interest in developing our business, we may analyze your site behavior or invite you to complete satisfaction surveys.
• Marketing: We aim to keep you updated on the best offers and promotions via email, SMS, or push notifications.
  • Profiling: We may use your behavioral data to create a profile and provide personalized recommendations.
  • Consent: Marketing is generally based on your prior consent, which you can withdraw at any time via your account settings or the “unsubscribe” link in messages.
• Defending Legitimate Interests: We take measures to protect our platform and users from cyberattacks, prevent and detect fraud attempts (which may involve sharing data with public authorities), and manage general business risks.

5. Data Retention and Erasure

As a rule, we store your personal data for as long as you maintain an account on our platform. You may request the deletion of your information or the closure of your account at any time.

• Important: Deletion is often irreversible; you should download all necessary documents (such as income statements) from your account before exercising this right.
• Exceptions: We may retain certain information even after an account is closed if required by legal obligations (e.g., tax/accounting laws) or to protect our legitimate interests.

6. Data Recipients and International Transfers

We may provide access to your data to:

• Companies within our corporate group.
• Service providers (couriers, banking/payment, marketing, IT, and business infrastructure).
• Professional consultants (accountants, lawyers, auditors).
• Public authorities, when legally mandated.

International Transfers: While we primarily store data in Romania, we may transfer data to entities outside the EU or Gibraltar. In such cases, we ensure your rights are protected through Standard Contractual Clauses (SCCs) or other recognized certification schemes.

7. Data Security

We implement industry-standard technical and organizational measures. Your data is transmitted using state-of-the-art encryption algorithms and stored on secure servers with built-in data redundancy. However, please be aware that no internet transmission is 100% secure, and we cannot be responsible for vulnerabilities in systems outside our control.

8. Your Rights Under GDPR

You have a comprehensive set of rights regarding your personal data:

• Access: You can request confirmation of whether we process your data and receive a copy of that data along with details on its use.
• Rectification: You can ask us to correct or complete inaccurate or incomplete data.
• Erasure: You may request data deletion if it is no longer necessary, if you withdraw consent, or if it was processed illegally.
• Restriction: You can ask to “freeze” the processing of your data while its accuracy is being contested or if the processing is illegal but you oppose deletion.
• Portability: You can request your data in a structured, machine-readable format to move it to another controller.
• Objection: You can object to processing based on legitimate interests or for direct marketing purposes.
• Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing that significantly affects you.

Exercising Your Rights: We aim to respond to valid requests within one month, though this may be extended to two months for complex cases. We do not charge a fee for these requests unless they are clearly unfounded or excessive. To protect your privacy, we may require additional information to verify your identity before fulfilling a request.

9. Complaints

You have the right to file a complaint with the Gibraltar Regulatory Authority (GRA). However, we encourage you to contact us first so we can attempt to resolve any concerns amicably.