GDPR Compliance

01 What is GDPR?

The General Data Protection Regulation (GDPR) is a comprehensive data protection law enacted by the European Union that came into force on 25 May 2018. It governs how organisations collect, use, store, and share personal data of individuals in the EU and European Economic Area (EEA).

Key principles of GDPR that we follow:

• Lawfulness, fairness, and transparency — we process data lawfully and transparently
• Purpose limitation — data collected for specified, explicit purposes only
• Data minimisation — we collect only the data we need
• Accuracy — we keep data up to date and accurate
• Storage limitation — data is not kept longer than necessary
• Integrity and confidentiality — data is processed securely
• Accountability — we are responsible for and can demonstrate compliance

02 Who This Applies To

This GDPR compliance policy applies to:

• Residents of the European Union (EU) and European Economic Area (EEA)
• Residents of the United Kingdom (UK) under the UK GDPR
• Any individual whose personal data is processed by OfferHubBounty, regardless of location, where EU/UK GDPR applies

Even if you are not located in the EU/EEA/UK, we apply strong data protection standards to all users globally as part of our commitment to privacy.

03 Our Role: Data Controller vs. Data Processor

As a Data Controller

OfferHubBounty acts as a Data Controller for personal data collected directly from our website visitors, registered publishers, and advertiser contacts. In this role, we determine the purposes and means of processing personal data.

As a Data Processor

When processing end-user data on behalf of advertisers (e.g., tracking conversions from advertiser landing pages), OfferHubBounty may act as a Data Processor. In this case, the advertiser is the Data Controller and we process data strictly according to their instructions and our Data Processing Agreement.

04 Lawful Basis for Processing

We rely on the following lawful bases under GDPR Article 6:

• Article 6(1)(a) — Consent: Where you have given explicit, freely given consent (e.g., marketing emails, newsletter sign-up). You may withdraw consent at any time without penalty.
• Article 6(1)(b) — Contract: Where processing is necessary to fulfil our contract with you as a publisher or advertiser (account management, campaign operations, payments).
• Article 6(1)(c) — Legal Obligation: Where processing is required to comply with law (KYC/AML checks, tax reporting, regulatory compliance).
• Article 6(1)(f) — Legitimate Interests: Where we have legitimate business interests that are not overridden by your rights (fraud prevention, network security, platform analytics). We conduct Legitimate Interests Assessments (LIAs) for such processing.

05 Data We Collect & Why

Under GDPR's data minimisation principle, we collect only what is necessary:

• Identity data (name, company) — required for account setup and contract performance
• Contact data (email, phone) — required for account communication and support
• Financial data (payment details, tax information) — required for processing payouts and tax compliance
• Technical data (IP address, click data, sub-IDs) — required for tracking campaign performance and fraud prevention
• Marketing data (communication preferences) — processed only with consent

We do not process special category data (health, religion, biometric data, etc.) unless explicitly required by law and with appropriate safeguards.

06 Consent Management

Where we rely on consent as the lawful basis:

• Consent is obtained through clear, affirmative action (opt-in checkboxes — never pre-ticked)
• Consent requests are separate from other terms, clearly worded, and explain exactly what is consented to
• We record the date, time, and method of consent for all marketing communications
• You can withdraw consent at any time by clicking "unsubscribe" in any marketing email or by contacting us at privacy@offerhubbounty.com
• Withdrawal of consent does not affect processing that occurred prior to withdrawal

For campaign-level consent management (advertiser landing pages), publishers and advertisers are responsible for implementing appropriate consent mechanisms for end-users. We require all advertisers to warrant that their lead generation practices are GDPR compliant.

07 Data Subject Rights

Under GDPR, EU/EEA/UK individuals have the following rights regarding their personal data:

• Right of Access (Article 15): Request a copy of all personal data we hold about you, including purposes of processing and recipients
• Right to Rectification (Article 16): Request correction of inaccurate or incomplete personal data
• Right to Erasure / "Right to be Forgotten" (Article 17): Request deletion of your data where it is no longer needed, consent has been withdrawn, or processing was unlawful — subject to legal retention obligations
• Right to Restriction of Processing (Article 18): Request that we temporarily stop processing your data while an accuracy or lawfulness dispute is resolved
• Right to Data Portability (Article 20): Receive your data in a structured, commonly used, machine-readable format and transmit it to another controller
• Right to Object (Article 21): Object to processing based on legitimate interests or for direct marketing purposes (we will stop immediately for marketing)
• Rights related to automated decision-making (Article 22): We do not make solely automated decisions with significant legal effects on individuals

08 How to Exercise Your Rights

To exercise any of your GDPR rights:

1. Send an email to privacy@offerhubbounty.com with the subject line "GDPR Data Request"
2. State clearly which right(s) you wish to exercise
3. Provide sufficient information for us to verify your identity (we may request ID verification for security)
4. We will respond within 30 days. Complex requests may take up to 90 days — we will inform you if an extension is needed
5. Responses are provided free of charge. For manifestly unfounded or excessive requests, a reasonable fee may apply

09 Data Retention Under GDPR

We retain personal data only as long as necessary under GDPR's storage limitation principle:

• Active account data: Retained for the duration of the business relationship
• Inactive account data: Deleted or anonymised after 36 months of inactivity
• Financial & payment records: 7 years (legal/tax obligation)
• Conversion & campaign data: 5 years (dispute resolution and auditing)
• Consent records: 3 years after consent withdrawal or account closure
• Support communications: 2 years after case closure

Data that is no longer needed is securely deleted or anonymised so it can no longer be linked to an individual.

10 International Data Transfers

As a global network, we may transfer personal data outside the EEA. All international transfers comply with GDPR Chapter V requirements:

• Standard Contractual Clauses (SCCs): We use EU Commission-approved SCCs for transfers to countries without an adequacy decision
• Adequacy decisions: Transfers to countries recognised by the EU Commission as providing adequate data protection are permitted without additional safeguards
• Binding Corporate Rules: Where applicable within our group structures

You may request information about the specific safeguards we have in place for your data transfers by contacting our privacy team.

11 Data Security Measures

We implement appropriate technical and organisational measures under GDPR Article 32:

• TLS/SSL encryption for all data in transit
• AES-256 encryption for sensitive data at rest
• Role-based access controls — staff access only the data they need
• Regular security testing, penetration testing, and vulnerability assessments
• Staff data protection training and awareness programmes
• Vendor due diligence — all third-party processors are assessed for GDPR compliance
• Data Processing Agreements in place with all third-party processors
• Pseudonymisation of data where technically feasible

12 Data Breach Procedures

We have documented procedures in place for detecting, reporting, and investigating personal data breaches under GDPR Articles 33–34:

• Internal detection: Automated monitoring systems flag potential breaches immediately
• Assessment: Our team assesses the severity, scope, and risk to individuals within 24 hours of detection
• Regulatory notification: Where required, we notify the relevant supervisory authority within 72 hours of becoming aware of a breach
• Individual notification: If a breach is likely to result in high risk to your rights and freedoms, we will notify you directly without undue delay
• Documentation: All breaches are documented in our breach register regardless of whether notification is required

13 Children's Data

Our services are directed at adults aged 18 and over. We do not knowingly collect or process personal data of individuals under 18. Under GDPR Article 8, processing of children's data for online services requires parental consent. If we discover we have inadvertently processed a child's data, we will delete it immediately and investigate how it occurred. Please contact privacy@offerhubbounty.com if you have concerns about a child's data.

14 Publisher & Advertiser GDPR Obligations

Publishers

Publishers promoting campaigns through our network are independently responsible for:

• Ensuring their websites and marketing practices comply with GDPR and applicable local laws
• Obtaining valid consent from end-users where required for tracking cookies and data collection
• Maintaining a compliant Privacy Policy on their owned media
• Not collecting or transmitting personal data through tracking links beyond what is specified in campaign terms

Advertisers

Advertisers are independently responsible for:

• Ensuring landing pages and lead forms have compliant privacy notices and consent mechanisms
• Lawfully processing lead data received through OfferHubBounty campaigns
• Providing OfferHubBounty with accurate information about data processed in campaigns
• Honouring data subject requests (access, deletion) for leads received through our network

15 Data Processing Agreement (DPA)

Where OfferHubBounty processes personal data on behalf of advertisers (acting as Data Processor), a Data Processing Agreement (DPA) is required under GDPR Article 28. Our DPA covers:

• Subject matter, duration, nature, and purpose of processing
• Type of personal data and categories of data subjects
• Obligations and rights of the data controller
• Sub-processor management and approval process
• Security and confidentiality obligations
• Breach notification procedures
• Data deletion and return upon contract termination

16 Supervisory Authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe we have not handled your personal data in accordance with GDPR. You may contact:

• In the EU: Your local national data protection authority (e.g., CNIL in France, BfDI in Germany, DPC in Ireland)
• In the UK: The Information Commissioner's Office (ICO) — ico.org.uk
• Full list of EU DPAs: edpb.europa.eu

We encourage you to contact us first so we have the opportunity to resolve your concern directly.

17 Contact Our Data Protection Team

For any GDPR-related questions, requests, or concerns, please contact our dedicated privacy team: