Version 2026-09-10
Who is responsible
The published header identifies the legal operator and public privacy contact. ClubAffili determines the purposes of its own account administration, security and business operations. For partner-related processing, the applicable tenant notice and processing agreement identify whether ClubAffili acts as a processor, independent controller or joint controller. The role must reflect actual decisions and data flows.
Information and sources
Depending on the features you use, information includes account identity and contact details; referral relationships and attribution identifiers; qualifying transaction, commission and payout records; verification records where required; wallet addresses and related activity where used; support correspondence; technical security information; and policy acknowledgement and communication-preference records.
Information comes from you, your account activity and participating partners reporting qualifying events. For business outreach obtained indirectly, the relevant notice must name the actual source or source category, identify the information used and explain the outreach purpose. A public work email, member ID or linkable wallet address can still be personal data.
**Private personal details and corrections.** Your account settings let you maintain a private full legal name, country, contact phone number, residential address and separate postal address. These fields are kept separately from the display name and optional contact card used in the network. Other members cannot access them through the portal. Authorised personnel and service providers may process them where necessary for account administration, verification, support or legal obligations, subject to appropriate access controls. This is not a promise that only you can ever process the data.
Keep these details accurate and update them when they change. Editing the private contact phone does not change your sign-in details or the phone used by the separate verification flow. Changes to the private legal name, country or residential address clear existing identity verification and may require fresh verification before actions subject to verification can proceed. Editing details does not establish that an identity or address has been verified, resolve a household eligibility conflict, or override an account restriction. You can also use the privacy contact to request correction of information that cannot be edited in settings.
Verification and abuse prevention
When a verification check is needed, we may process your date of birth, residential address, identity-document details or copies, payout-ownership evidence and the outcome of the check. The request explains what is necessary and how to submit it securely. Access is limited to authorised verification personnel and approved providers for that purpose. We do not use identity documents for advertising or partner demonstrations.
The final verification schedule must identify the actual provider, lawful basis, data categories, location and retention period or criteria before collection begins. Do not assume that all checks are legally mandated KYC: fraud and eligibility checks need their own appropriate justification. Prefer retaining a verification result over a document copy where that meets the purpose, and remove source documents when no longer needed. Automated biometric identification is not authorised by accepting these terms; introducing it requires a separate legal assessment and the applicable safeguards.
Purposes and lawful bases
| Purpose | Proposed basis to validate against the processing register |
|---|---|
Account access, referral administration and payment of valid commissions | Performance of the relevant contract, only where objectively necessary |
Statutory financial or regulatory records | Applicable legal obligation, identified in the final register |
Proportionate security, abuse prevention and service improvement | Assessed legitimate interests where appropriate |
Optional member marketing | Specific consent as the proposed default; separate from agreement acceptance |
Partner prospecting | Jurisdiction- and recipient-specific assessment; consent where required, or documented legitimate interests where lawful |
Nonessential tracking | Prior consent where required; any exception must be specifically assessed |
We explain whether requested information is required and what happens if it is not provided. We do not treat acceptance of the terms as permission for every data use.
Analytics and demonstrating partner value
ClubAffili's proposed reporting policy is to use anonymous aggregate results when demonstrating service value to prospective partners and tenants, such as overall conversion rates, qualifying activity and programme performance. Such material must not identify members or customers or allow them to be reasonably identified through small groups, detailed transactions or combinations with other information.
Creating those summaries may involve personal data internally. Removing names or hashing identifiers does not automatically make information anonymous. Identifiable operational reporting to an existing authorised tenant is a separate purpose and must be limited to that tenant's permitted data. We must not reuse it as prospecting material merely because the recipient is a potential partner.
Communications and tracking
Account security and necessary service messages are distinct from optional promotions. Marketing preferences can be changed without losing ordinary account access. Marketing emails provide an unsubscribe route. Objections and withdrawals are applied to future marketing, including related profiling, and a minimal suppression record may be retained to prevent unwanted recontact.
The published cookie and tracking notice must list technologies actually used, their purposes, providers and duration, including email pixels if enabled. Terms acceptance does not substitute for any required tracking consent. Previously declined marketing or tracking choices must not be reset by a policy update.
Recipients and international processing
Data may be processed by authorised hosting, authentication, communications, support and payment providers, and shared with participating partners only as needed for the disclosed programme purpose. Legal authorities may receive information where law requires it. The final provider schedule must identify relevant recipient categories, locations and safeguards for international transfers, and explain how to obtain a copy of those safeguards.
Prospective partners must receive only reports approved under the anonymous-reporting policy. This does not imply that hosting, support or other service providers receive no personal data.
Retention, security and automated processing
We retain each category only as long as necessary for its stated purpose, applicable legal duties and legitimate dispute handling. The published schedule must state periods or usable criteria for account records, payment records, support, outreach leads, suppression entries, acceptance evidence and backups. Deletion requests may have lawful exceptions, which must be explained.
Access restrictions, tenant separation and proportionate safeguards are required. Automated attribution and commission calculations must be described accurately. Whether any processing makes solely automated decisions with legal or similarly significant effects requires assessment; where applicable, provide the required explanation and safeguards, including a human review route. Do not publish a blanket claim that no profiling or automated decisions occur without checking.
Your rights
Depending on the law and processing basis, you may request access, correction, erasure, restriction or portability, object to processing, and withdraw consent without affecting prior lawful processing. The right to object to direct marketing applies to related profiling. You may complain to the competent supervisory authority. Contact details and the relevant authority must be provided in the final notice, including a route usable without logging in or accepting updated terms.
Requests receive a response within applicable statutory deadlines; under GDPR this is generally one month, subject to permitted extensions and notice. We request only proportionate identity verification. Rights are not conditional on consenting to marketing.