Draft for legal review. Text in [square brackets] must be completed before launch.
This Privacy Policy explains how [LEGAL ENTITY NAME] ("we", "us") collects and uses personal data when you visit this website, apply to the Heater Partners affiliate program or contact us. It is written to meet the requirements of the EU General Data Protection Regulation (GDPR) and similar laws.
1. Controller and contact
The controller of your personal data is [LEGAL ENTITY NAME], registered in [COUNTRY] under number [REGISTRATION NUMBER], with registered office at [ADDRESS].
For any privacy question or to exercise your rights, contact us at [PRIVACY CONTACT EMAIL]. [If appointed: Our Data Protection Officer can be reached at [DPO EMAIL].] [If required: Our EU/UK representative is [REPRESENTATIVE NAME AND ADDRESS].]
2. What data we collect
Affiliate applications: business or company name, first name, surname, e-mail address, company address (street, city, postal code, country), chosen username, a one-way hashed version of your password (we never store your password in readable form), the version of the Terms & Conditions you accepted, your marketing preference and the date and time of your application.
Contact form: your name, e-mail address, the topic you choose and your message.
Security and technical data: to protect our forms against abuse we process your IP address in a pseudonymised (salted and hashed) form for rate limiting, and the result of an automated bot check. Our hosting provider processes standard technical data (such as IP address, browser type and request time) to deliver and secure the website.
We do not use analytics, advertising or social-media tracking on this website.
3. Why we use your data and our legal bases
To assess your application, verify your identity and business, and set up and manage your affiliate account: steps taken at your request before entering into a contract, and performance of that contract (Art. 6(1)(b) GDPR).
To prevent fraud and abuse, secure our website and forms, and keep records of the Terms you accepted: our legitimate interests in operating a secure and fraud-free program (Art. 6(1)(f) GDPR).
To answer your messages: our legitimate interest in responding to enquiries, or steps prior to a contract (Art. 6(1)(f) or (b) GDPR).
To send you news and offers by e-mail, only if you opted in: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by using the unsubscribe link or contacting us.
To comply with legal obligations such as accounting, tax and anti-money-laundering rules: legal obligation (Art. 6(1)(c) GDPR).
4. Who we share data with
Casino operators whose brands are part of the program, where needed to assess or manage your participation.
Service providers acting on our behalf under data-processing agreements: website hosting and security ([HOSTING PROVIDER], including its bot-protection service), e-mail delivery ([E-MAIL PROVIDER]), affiliate tracking platform ([AFFILIATE PLATFORM]) and payment providers ([PAYMENT PROVIDERS]).
Authorities, courts or professional advisers where required by law or to establish, exercise or defend legal claims.
We do not sell your personal data.
5. International transfers
Some of our service providers may process data outside the European Economic Area. Where this happens we rely on an adequacy decision or on Standard Contractual Clauses approved by the European Commission, together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.
6. How long we keep data
Approved affiliates: for the duration of the relationship and up to [X] years afterwards to meet legal, tax and accounting obligations.
Rejected applications: up to [24] months for fraud-prevention purposes and to defend legal claims, then deleted.
Contact messages: up to [12] months after the conversation ends.
Pseudonymised rate-limiting records: up to [24 hours].
7. Your rights
You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to data portability and to withdraw consent at any time (without affecting processing carried out before withdrawal).
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where an alleged breach occurred. Our lead authority is [SUPERVISORY AUTHORITY].
To exercise your rights, contact [PRIVACY CONTACT EMAIL]. We may need to verify your identity before responding.
8. Security
We protect your data with encryption in transit (HTTPS), strict access controls, password hashing (Argon2id) and anti-abuse measures. No method of transmission or storage is completely secure, but we work to protect your data in line with industry standards.
9. Automated decisions
We do not make decisions about your application based solely on automated processing. The automated bot check only helps us block spam submissions.
10. Age
Our program and this website are intended only for adults aged 18 or over (or the age of majority in your jurisdiction, if higher). We do not knowingly collect data from minors.
11. Changes to this policy
We may update this policy from time to time. The current version and its date are always shown on this page.