GDPR & Data Rights
Your data rights under GDPR, CCPA, and global privacy law — explained clearly. No legal jargon. Just straightforward answers and the tools to exercise your rights.
Contents
1. Who This Page Applies To
EEA/UK Residents
Individuals in the European Economic Area, United Kingdom, or Switzerland who interact with our website or platform.
Network Operators (EU/UK)
Businesses using AffClix who are subject to GDPR as data controllers and need to understand our processor obligations.
Global Users
Where other privacy laws apply (e.g. CCPA for California residents), additional rights are described in Section 10.
2. Our Role Under GDPR
AffClix operates in two distinct capacities under GDPR, depending on the context:
| Context | GDPR Role | What This Means |
|---|---|---|
| affclix.com website visitors & platform account holders | Data Controller | AffClix determines why and how your data is processed. Our Privacy Policy governs this. |
| End-user click/conversion data processed on behalf of network operators | Data Processor | We process data only under the documented instructions of the network operator (the data controller). Our DPA governs this. |
Our Data Protection Officer (DPO) can be reached at [email protected].
Our EU Representative (Art. 27 GDPR) is: AffClix EU Ltd., c/o Matheson LLP, 70 Sir John Rogerson's Quay, Dublin 2, Ireland.
3. Your Rights Explained
Under GDPR (and similar laws), you have eight core rights regarding your personal data. Here's what each means in plain English:
Right of Access (Art. 15)
Ask us for a copy of all personal data we hold about you, why we hold it, who we share it with, and how long we keep it. We must respond within 30 days.
Right to Rectification (Art. 16)
If your data is inaccurate or incomplete, you can ask us to correct it. If we've shared the data with others, we'll inform them of the correction.
Right to Erasure / "Right to be Forgotten" (Art. 17)
Ask us to delete your personal data. We'll comply unless we have a legal obligation or legitimate interest to retain it (e.g. financial records, fraud prevention data).
Right to Restrict Processing (Art. 18)
You can ask us to "freeze" your data — we keep it but stop using it — while you contest its accuracy or while we assess an objection.
Right to Data Portability (Art. 20)
Request your data in a structured, commonly used, machine-readable format (JSON or CSV) that you can transfer to another service.
Right to Object (Art. 21)
Object to us processing your data based on legitimate interests or for direct marketing. We must stop unless we have compelling legitimate grounds that override your interests.
Rights Related to Automated Decisions (Art. 22)
Not be subject to a decision based solely on automated processing (including profiling) that produces legal or similarly significant effects — without human review.
Right to Withdraw Consent (Art. 7(3))
Where processing is based on consent, you can withdraw it at any time. Withdrawal doesn't affect the lawfulness of processing before withdrawal.
4. How to Submit a Data Rights Request
We've made it straightforward to exercise your rights. Use one of the following methods:
Email Request
Email [email protected] with subject line "Data Rights Request" and include:
- Your full name and account email address
- The specific right you wish to exercise
- Any relevant context or details
Account Dashboard
Logged-in users can manage many preferences directly:
- Download your data export (JSON)
- Update or correct your profile
- Manage marketing preferences
- Request account deletion
Response Time
We acknowledge requests within 72 hours and provide a full response within 30 days (extendable to 90 days for complex requests with prior notice).
Identity Verification
We may need to verify your identity before fulfilling a request to protect your data. We'll ask for the minimum information necessary.
No Charge
Exercising your data rights is always free. We only charge for manifestly unfounded or excessive requests, where permitted by law.
5. Legal Bases We Rely On
| Processing Activity | Legal Basis | GDPR Article |
|---|---|---|
| Providing the AffClix platform to registered customers | Contract performance | Art. 6(1)(b) |
| Processing payments and managing subscriptions | Contract performance | Art. 6(1)(b) |
| AI fraud detection and platform security | Legitimate interests | Art. 6(1)(f) |
| Improving platform features via analytics | Legitimate interests | Art. 6(1)(f) |
| Sending transactional emails (invoices, security alerts) | Contract / legal obligation | Art. 6(1)(b)/(c) |
| Financial record-keeping and tax compliance | Legal obligation | Art. 6(1)(c) |
| Marketing newsletters and promotional emails | Consent | Art. 6(1)(a) |
| Analytics and marketing cookies | Consent | Art. 6(1)(a) |
| Responding to legal requests from authorities | Legal obligation | Art. 6(1)(c) |
6. Data Processing Agreement (DPA)
For network operators and enterprise customers who are data controllers subject to GDPR and who process personal data through the AffClix platform, we offer a comprehensive Data Processing Agreement that:
- Documents AffClix's role as a data processor under Art. 28 GDPR
- Sets out subject matter, duration, nature, and purpose of processing
- Includes Standard Contractual Clauses (Module 2: Controller to Processor) for international transfers
- Lists all approved sub-processors with their locations and processing activities
- Establishes breach notification obligations and timelines
- Documents technical and organisational security measures (TOMs)
Request a DPA
Email [email protected] with your company name and VAT/registration number. We will send a pre-signed DPA within 2 business days. Enterprise customers on MSA contracts receive a customised DPA as part of their agreement.
7. International Data Transfers
AffClix's primary infrastructure is hosted in the United States (AWS us-east-1) with disaster recovery in the EU (AWS eu-west-1). When personal data originating from the EEA/UK is transferred to the US, we rely on the following safeguards:
Standard Contractual Clauses
European Commission-approved SCCs (2021 version) incorporated into our DPA for all data transfers from EEA/UK to third countries.
UK IDTAs
UK International Data Transfer Agreements (IDTAs) for transfers from the UK, effective since March 2022.
8. Sub-Processors
We use the following sub-processors that may process personal data on our behalf. We maintain Data Processing Agreements with each and conduct due diligence on their security practices.
| Sub-Processor | Service | Location | Transfer Mechanism |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure & hosting | US (primary), EU (DR) | SCCs + AWS DPA |
| Stripe | Payment processing | US | SCCs + Stripe DPA |
| SendGrid (Twilio) | Transactional email delivery | US | SCCs |
| Intercom | Customer support chat | US | SCCs |
| Cloudflare | CDN, DDoS protection, DNS | US (global edge) | SCCs |
| PostHog | Product analytics (EU instance) | EU (Frankfurt) | No transfer required |
| Datadog | Infrastructure monitoring & logs | US | SCCs |
| PagerDuty | Incident management | US | SCCs |
We will notify customers of any new sub-processors with at least 30 days' notice before they begin processing personal data, allowing time to object.
9. Data Breach Policy
AffClix maintains a documented Incident Response Plan and will:
- Within 24 hours of discovering a breach: contain the incident, assess scope and risk, and notify our DPO.
- Within 72 hours: notify the relevant supervisory authority (ICO for UK, lead DPA for EEA) if the breach poses a risk to individuals' rights — as required by Art. 33 GDPR.
- Without undue delay: notify affected individuals directly if the breach is likely to result in a high risk to their rights and freedoms — as required by Art. 34 GDPR.
- For network operators acting as data controllers: notify them within 24 hours of confirming a breach affecting data processed on their behalf, to enable them to meet their own 72-hour notification obligation.
To report a suspected security incident, email [email protected] immediately.
10. CCPA — California Residents
The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants California residents additional rights:
The right to know what personal information we collect, use, disclose, and sell.
The right to request deletion of your personal information, subject to exceptions.
The right to correct inaccurate personal information we hold about you.
We do not sell or share personal data for cross-context behavioural advertising. No opt-out required.
The right to limit use and disclosure of sensitive personal information to necessary purposes.
The right not to receive discriminatory treatment for exercising your CCPA rights.
To exercise CCPA rights, email [email protected] with "California Privacy Request" in the subject line. We will respond within 45 days.
For the 12 months preceding January 1, 2025, AffClix has not sold or shared personal information of California consumers as defined under CCPA/CPRA.
11. Contact & Supervisory Authorities
Supervisory Authorities: If you are unsatisfied with our response to a data rights request, you have the right to lodge a complaint with your local supervisory authority:
- EU: Your national Data Protection Authority — Full list of EU DPAs
- UK: Information Commissioner's Office (ICO) — ico.org.uk
- Ireland (lead DPA): Data Protection Commission — dataprotection.ie
- California: California Privacy Protection Agency (CPPA) — cppa.ca.gov
