Privacy Policy

1Whose data this notice covers

Three groups of people show up in our records, and the notice covers all three across the public website and the platform behind it.

• Publishers. Anyone approved to run an account here and send traffic to advertiser campaigns, whether they trade as an individual or through a company.
• Advertisers. Brands listing campaigns with us, and the named people at those brands who manage a campaign day to day.
• Readers of this website. Anyone reading affiliate.love without an account — guides, campaign categories, this page.

Accounts are for adults: eighteen, or the local age of majority where that is higher. Nothing here is aimed at children, and a record we discover belongs to one is deleted rather than reviewed.

2Who answers for your record

Purposes and means are decided by the company below, which is also the company you hold responsible if something goes wrong.

Registered name

NAVICORE SYSTEMS LTD

Registration Number

15579166

Registered office

Waterbury Drive, Waterlooville, Hampshire, PO7 7TH, United Kingdom

Data mailbox

[email protected]

Requests to that mailbox land with one named person on the partner team rather than a shared queue, which is the difference between an answer and a ticket number.

3What the record holds, and how it reaches us

Six categories, each with the route it arrives by. A field that serves none of the purposes in section 4 is a field we do not ask for.

Registration and profile

Reaches us: You type it. Name, work email, company and country, the payout method you want to be paid on, and a description of the traffic you actually run. A person reads the traffic answer before your account opens, which is why the field exists at all.

Traffic records

Reaches us: Written automatically as clicks arrive. Click identifiers, campaign identifiers, timestamps, referring domain, device class and whatever SubID you attached to the link. These are records of events, not profiles of people: they describe a click, not the person who made it.

Conversion and fraud-check records

Reaches us: Server-to-server, from the advertiser. The advertiser's postback tells us a conversion happened and whether it qualifies. Alongside it sits our own check on the traffic that produced it — duplicate detection, pattern checks and the outcome of any hold. Without both halves nobody can be paid the right amount, and no dispute can be settled on evidence.

Payout, invoicing and tax records

Reaches us: Partly yours, partly generated. Payout amounts, billing periods, holding periods, receipts and reports, and the tax details finance law makes us keep — a VAT number from corporate publishers, and tax residency or a tax identification number where a specific obligation calls for one. Card details never enter this record: payments run through our authorised processor, SMART OUTSOURCING SERVICES S.R.L., which collects them directly under PCI-DSS. We neither see nor store them.

Identity and screening records

Reaches us: You supply it; screening providers add to it. Identification documents and, where our internal criteria call for it, proof of a residential address. Against those we run sanctions screening, politically-exposed-person screening and adverse media checks. Publishers who register directly through this website are the group most likely to be asked; it is not a blanket demand on everyone.

Website and correspondence

Reaches us: Your browser, your messages. Which pages of affiliate.love you opened, at the level of counts rather than identities, plus anything you write to the partner team and our reply. What this site stores in your browser is itemised in the cookie policy. See the cookie policy.

The circumstances that trigger identity and screening checks are set out in clause 10 of our Terms & Conditions, and the click record itself is described end to end on our tracking links and postbacks page.

4Purpose and lawful basis, line by line

Every use below stands on a basis you can check, and the middle column says why the processing is needed rather than merely convenient.

Where the basis reads legitimate interests, we have weighed the interest against what a partner would reasonably expect and written the result down. Fraud screening is the clearest case: publishers sending clean traffic are the people it protects.

5Required, optional and withdrawable

Contact details, declared traffic sources and a payout method are the floor — refuse any of them and there is no account to run. Marketing preferences and anything you volunteer beyond the application form are optional, editable in your account, and removable by writing to the data mailbox.

Withdrawing marketing consent stops the announcements and nothing else. Service mail about approvals, holds and payouts is part of the contract and keeps arriving.

6Who else ever sees it

Advertisers receive the traffic their own campaign generated — click counts, conversion counts, the commission owed. What they cannot see is your other campaigns, your other advertisers or your total earnings.

Behind us sits a short list of suppliers: hosting, transactional email, the payment processor named in section 3, and the identity and screening providers named there too. Each works under a written processing contract that forbids using your data for anything of their own. Disclosure beyond that list happens only where a court, a tax authority or a regulator compels it, and we say so unless the law forbids saying so.

We do not sell personal data, rent it, or hand it to data brokers. How campaigns and placements are vetted before any of this begins is set out on our compliance and brand-safety page.

7Where the processing happens

The records live on servers inside the European Union. Where a supplier operates outside the EU or the UK, the transfer runs on Standard Contractual Clauses — with the UK addendum where UK data is involved — or another mechanism the law recognises, and we do not start using a supplier before that paperwork exists.

8How long each record survives

Nothing is kept because deleting it is inconvenient. Each row below ends for its own reason.

Account in use

For as long as the account is open

Account closed

Erased after twelve months

Click and postback logs

Twenty-four months

Support and dispute threads

Twenty-four months

Invoices, receipts and tax records

The period finance law fixes

Screening outcomes

As long as the obligation that produced them requires

Billing periods and cut-offs, which is what most retention questions are really about, sit on the payment schedule page.

9How the record is defended

Transport and storage are encrypted, access is granted per role rather than per employee, and the grants are reviewed rather than assumed. Suppliers are held to a comparable standard before they are given anything. Should a breach ever put your rights at real risk, the regulator and you both hear it from us within the statutory window.

10Fraud holds, scoring and human review

No decision with a legal or similarly significant effect on you is taken by software alone. Commission is arithmetic: the rules published on a campaign brief, applied to the tracking and postback record. Fraud checks can put volume on hold, and when they do, a person looks at it and can be argued with.

The route for arguing is clause 7 of the Terms & Conditions, which sets the window for raising a disputed figure and what we pull from the logs when you do.

11Rights you can exercise, and the regulator behind them

Write to [email protected] and name the right you want to use. We may need to establish that you are the account holder first; after that the answer comes inside the statutory month, and if the request is genuinely complex we tell you before the month runs out rather than after.

Access

A copy of the account file, the click records attached to it and the payout history behind them.

Rectification

Anything inaccurate gets corrected; anything incomplete gets completed.

Erasure

The account and its traffic records go on request. Paid invoices and screening outcomes stay for as long as the law that produced them says, and we name what stayed rather than leaving you to guess.

Restriction

Processing can be frozen instead of deleted while a dispute over accuracy or basis is open.

Objection

Anything resting on legitimate interests — fraud screening included — can be objected to, and we either justify it or stop.

Portability

The data you gave us, in a machine-readable file you can take elsewhere.

Withdrawal of consent

Marketing consent ends the moment you say so, without affecting anything sent before that point.

Unhappy with what came back? Say so to us first — most of it is a misunderstanding we can fix faster than anyone else can. That route is not a precondition, though: the Information Commissioner's Office, our supervisory authority in England and Wales, will hear from you whenever you choose to go there, and a complaint to the regulator in the EU member state where you live is equally open to EU partners.

Supervisory authority

Information Commissioner's Office (ICO), United Kingdom

Contact page

ico.org.uk/global/contact-us/

Complaint form

ico.org.uk/make-a-complaint/data-protection-complaints/

ICO helpline

0303 123 1113

12Revisions to this notice

When a processing activity changes, the affected section is rewritten and the date at the head of the page moves with it. If a change alters what happens to records we already hold, open publisher and advertiser accounts hear about it directly instead of being left to notice the new date.